{ "Event": { "published": true, "date": "2023-09-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-20", "timestamp": 1695254581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4a20ea47-2bb4-485f-af40-0315bc2acf0a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841b8965-574e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LockBit)", "timestamp": 1695170523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170523, "uuid": "2f8fed57-450c-45ef-bd4b-472ed03dfc71", "comment": "Malware payload (LockBit)", "value": "52322ea19c5ca4b384769f40cce8f7c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170523, "uuid": "69d0c3b7-b561-437e-ae1c-bbfe8dd69064", "comment": "Malware payload (LockBit)", "value": "01e7ba4b23b94269f16bef68f685950b8e036ae0f79aad335123de53e3e43057", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170523, "uuid": "a4d49883-6ef9-43f1-b749-905868e30414", "comment": "Malware payload (LockBit)", "value": "72260c22dd40790c2f8f3aeb7a17a62cafb773da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170523, "uuid": "01fe4186-6523-4655-b8a1-822a85912942", "comment": "Malware payload (LockBit)", "value": "faa524323548b810211288d2302d1a3c771c0b00baac744b78c31d0e1285c21b38f97bf529bdfb6ee1829d4169c560c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170523, "uuid": "1480440d-aa66-4a8e-9f5a-0dc6d260ddb2", "value": "T105938D91B150D231F9D320BBF3BD9F799C799631232860C79BD81C929C604F7B63A64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170523, "uuid": "6a90cf4f-0de7-4c5e-849d-f8280c50b341", "value": "1536:sxh3x3j1IfceNJwqqWRy/1fXbHk4GJ/bhEWChkYEdwIlBSXsUOubPKtsWnY:ep9wOqqw61fXbEvgkYEpyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695170523, "uuid": "70106a0a-7926-44c5-af4b-2a89509bfe5f", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695170523, "uuid": "3457f963-12d2-4c13-ba6c-6ab0735e2f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170523, "uuid": "59b92dd5-bc3e-4bba-b796-3714a975b4f9", "value": "rund1132_dump.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c4d2f8-5782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695192755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192755, "uuid": "29730e03-1106-4aa8-b0d2-9d73b43a7f98", "comment": "Malware payload (AgentTesla)", "value": "dd0cced0a668e9faaf682e39e7532561", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192755, "uuid": "014d8bf4-e4ab-4686-bd6c-64409dad3298", "comment": "Malware payload (AgentTesla)", "value": "01f79ac0c3ebd21408c39739de2ddaa6dba90e638e18b77ddcdb69363c798e41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192755, "uuid": "1f52cb3b-61d6-4adc-b043-9467719e1acc", "comment": "Malware payload (AgentTesla)", "value": "4e3fa554c24ce2d34bf51f4b42943015e557c4a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192755, "uuid": "3da822b2-e332-4874-a2dd-8e51770ccd7c", "comment": "Malware payload (AgentTesla)", "value": "58ae74e35a9568aa19ddf44c31f296be4309c5508cd0c64b48cbbd02a4058c7c037a605edf834fef3b208052f4a4c030", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192755, "uuid": "16b99f54-7fa9-4026-ad7a-610669430da1", "value": "T1CFC423F05627EDBF2D8B849D3E6F63709645D5D6D57A99983B3BB0308AC0C2B429360C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192755, "uuid": "828e4b52-a26c-4cfa-bd90-d233b1406e90", "value": "12288:fbub9gaFvzhnGIwsACXKCNtn/ubepD0WQ8FALcIWeNfH:fKuaFvzhcsjXXn/QeHFiAuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695192755, "uuid": "b04af3e5-b900-43ef-b18e-c6fa2a8e137b", "value": 565889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695192755, "uuid": "51673eb5-f779-4614-b9a7-822346784de2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192755, "uuid": "637f0447-875a-4390-898d-c1f0b252bb45", "value": "PROFORMA INVOICE.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b5af21-5767-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695181388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181388, "uuid": "38608e14-aa50-4043-b52b-19efd2bde34e", "comment": "Malware payload (RedLineStealer)", "value": "774f61bf46e5967a09fc7ddf37ea03ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181388, "uuid": "0d62fa67-527d-4029-95b3-663027a1e3d7", "comment": "Malware payload (RedLineStealer)", "value": "02457b5ddeede81de594a4ee1672e646b7c321b5771c1bea1fae04ddf868c8e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181388, "uuid": "61ac9d76-8924-4709-8581-1130a26c70ff", "comment": "Malware payload (RedLineStealer)", "value": "1936d9322d092f3c9c060ab8a1c1a1c466dbd707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181388, "uuid": "21d7dc71-7f1a-41f7-a5c1-e20539b15c00", "comment": "Malware payload (RedLineStealer)", "value": "3d17d72ca89b2a38c469f3720aa6276122a7a717bdffa06e028a5a54fcdb0cc84923434854b1621e617c4d1401583632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181388, "uuid": "79ee69af-87e4-429e-a497-0db8990b689b", "value": "T1C2652357BBD90832DCF26B7448F612874A35FEA6AE1497A737468C5D60F28C8483533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181388, "uuid": "7fb1de8f-b6d9-4ad5-b8b2-113f5e6046da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181388, "uuid": "fa8b40f1-b577-43a7-b779-9a420fc95637", "value": "24576:+yLUub2T+NOJW9Lgr6wLCmAn8fAVtGoOe5Rp63BMBxmsDxm3+1SET7oJAgTWvzcl:NLZb2toFCCmAn8fBI2xMtcgTWn8cSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695181388, "uuid": "b0de4a97-19e5-455e-9106-1edfd2ccb503", "value": 1467392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695181388, "uuid": "2fff717f-4960-45cb-9e76-7b12c209295d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181388, "uuid": "f6390f8e-82f0-4e1c-a99d-2fd60a8cd4e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71bdf77-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241878, "uuid": "8485061b-9975-417a-9b4f-6c2d465bd838", "comment": "Malware payload", "value": "ed4e7fcd674dabcbb974d3263c5ccbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241878, "uuid": "2e4bb13b-4a7f-4895-9b32-185dee8c7b5d", "comment": "Malware payload", "value": "029287b825f36a4e937df82abf8d8d7687255bb1ebac639f7b8d0b8afc5bb1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241878, "uuid": "baa32864-906d-4708-ac5c-4c34af54ae01", "comment": "Malware payload", "value": "41720a5f1d055221a5a5e9218cc030b04c541346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241878, "uuid": "2be72297-7802-46c7-b622-a7cf93a07bfe", "comment": "Malware payload", "value": "08afbef63b7cce814d0e3b25aa6f1434c5c105e38f55e290bcf62e4412c6f7ae0c78e2de94ac10aa1b2b663850366224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241878, "uuid": "587fbd14-b3ee-4c4f-8ccb-0c0fc6c767d3", "value": "T18C038D25E9C38872D26E56BD4D0DD638D83A2E213F2971C3EBAF2D0DCD256C61A19371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241878, "uuid": "a6b1c3e7-3a13-4dd6-8937-057eca9e35c4", "value": "768:aKSmX3MVD4GXZEyuhhq5Db3QHGVkK/8KU6s47T:TBAp5XQHGVkXKGYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241878, "uuid": "5195545d-e39a-4dd0-a4e6-b25bea694459", "value": 39832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241878, "uuid": "ba2c4c14-bc41-4267-90e6-514ddef4c092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241878, "uuid": "d7bc8b9d-042f-4e69-af61-c151ede7534b", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.13864.24608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ba284a-578d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1695197721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197721, "uuid": "5dd7e6fb-38e6-4285-95e2-18189dbf4235", "comment": "Malware payload (NanoCore)", "value": "bc15d9095a6d6fc6c794516a839793e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197721, "uuid": "6e9f6f49-1307-4b94-a263-798efc8c4351", "comment": "Malware payload (NanoCore)", "value": "03c24c4da5f42a1b9a770e84a0dd1f8e690b9e6873bf338fbec1d75d80006739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197721, "uuid": "c7dbf468-f413-4a2f-b48c-29781420a6cb", "comment": "Malware payload (NanoCore)", "value": "5652fa0fdc9789468533a30da488f712e1f961ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197721, "uuid": "020659a0-63ab-4922-b47c-359477a4d9ab", "comment": "Malware payload (NanoCore)", "value": "974231cfa213e5f524a10a2750be5a208669668a9ad7d86ade8593e1aa5f4cb39d6a789ffc74853becc8be0268ccb2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197721, "uuid": "d22c05b5-400d-4c6b-a11a-f6cf49c0744d", "value": "T1B7254AAC365076DFC857CD76DAA82C64EA60647B530FD20390131AEDAA4DA97CF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197721, "uuid": "e51034d0-84b3-4f74-bef2-b8961a4b5ed1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197721, "uuid": "ad1d0c6f-7b29-44ff-b5aa-0416b63cbfbc", "value": "12288:muZhuQRRDG2iNtATWB31OCpt6CPd10cddP8+mWArPexApa91J/wUWYjxYBbA8hae:VDG1MTs37DHFvA74qa91pwajI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197721, "uuid": "fb8caf9e-a421-475b-a797-d5323cad6e8f", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197721, "uuid": "1bbc3a8b-3756-45aa-a699-16f027cbd8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197721, "uuid": "22f3dce3-eb48-477f-9d06-6a665de574fa", "value": "NEW ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2003a895-57a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695206003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206003, "uuid": "d3aee0e1-7ab7-4ca0-81a4-087c010be6c2", "comment": "Malware payload (RedLineStealer)", "value": "96972b77034518996dc8143ef0ddce5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206003, "uuid": "e3d12ec9-424c-4ca5-a682-37cd91269a5a", "comment": "Malware payload (RedLineStealer)", "value": "03e7f53f34d234b11033a728832bc044321144dd2cafe693fe2233ed2df17b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206003, "uuid": "f2d95874-ebc8-4a20-8fb0-fb3dd664b6e6", "comment": "Malware payload (RedLineStealer)", "value": "3e3b80d9075bf9e9c6e54932a93cccd8baa8754e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206003, "uuid": "031cc3d0-9ad5-4d23-96c9-87e07a41c69a", "comment": "Malware payload (RedLineStealer)", "value": "ec767fa607b9861527c3c26dcfe748ace534d93f0a128523837ee39a671f1251f86b992b4886b7e587f864965f798bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206003, "uuid": "a8d5046f-c110-4757-aac3-22dcb216d1cc", "value": "T142652311ABC88155D8F1277009FE03CB0D31BD615EB087EB199AF9682DB36E8963177E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206003, "uuid": "cd77c4ef-7c7d-4d3a-b6b1-9d31bedc719b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206003, "uuid": "827fd3bf-ce91-4651-8874-6c21646617a1", "value": "24576:OybZNvNkLlKXvW3KkS4HXoAQMWTQh5m03b71vpFZXtSQqlBkvcqo5YXrgFr:dbZNvmJH3IeYAN6ErKMro5ogF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695206003, "uuid": "ebfeb43a-3f3e-4f31-ad25-d6c505af3fe9", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695206003, "uuid": "9f50aaa4-cb06-4fe6-83c7-4fef6a30601a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206003, "uuid": "324932d2-709a-43af-bd90-59d73d246a68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179e63d1-57bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1695218874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218874, "uuid": "c16ac7d2-24bf-4daa-8d35-08185838a14f", "comment": "Malware payload (NetSupport)", "value": "010f8c47f326e20c34fd1c5d1f95da55", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218874, "uuid": "5f2ce3f5-3716-4b85-bed8-1127eb565fec", "comment": "Malware payload (NetSupport)", "value": "0658d68ea82738c4bc4e07c790ddf05b62fcfce392909c223ddaa160e72a266e", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218874, "uuid": "36dd19d1-1f89-461a-a866-520209e5c94e", "comment": "Malware payload (NetSupport)", "value": "b47271c416a73e1f15f524b4b6058795fd5755b0", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218874, "uuid": "01101a7e-bffd-40a7-83ba-d1f68aeaf89a", "comment": "Malware payload (NetSupport)", "value": "bafda23bd9d29d2e15961afb4e34726562c2554d5db90982adcc227e99bd6d7853e58084643c79a795ff77d69a470f54", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218874, "uuid": "88e153ce-1e3f-4b98-89d4-3554048898a4", "value": "T13CE5331626A2FBB6C1D1F577E4ACA8104A7DB4BDE4F77476492EA253FA3D031A81F100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218874, "uuid": "3faec3dd-c0e6-4093-9f39-a0d89fdf4d04", "value": "98304:t1bFXamhRFY89YYc9jh23redpmQRiXuYESBZFR02jZ4:rbHxYoY59V0redpmQRiNfZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695218874, "uuid": "3360bff2-c94c-46c8-a87e-3cbd3580cd52", "value": 3175525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695218874, "uuid": "61b77008-2f8d-4123-87c9-7dbdd54af1c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218874, "uuid": "1acd0bbf-549d-4298-b10b-33803cd5d963", "value": "p.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfd35a9-57c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695219421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219421, "uuid": "2dc1eff2-cb2f-4945-80ad-630fb493f400", "comment": "Malware payload", "value": "1f1c2cdd7abfadf77e1900da19b9d825", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219421, "uuid": "32950565-8b96-466e-aedc-e5c717d5e088", "comment": "Malware payload", "value": "07b260f9b5c959a3da16d76697990104bb7ccaabc793090f90ea56d993e66d11", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219421, "uuid": "7b4becd9-1351-437f-92e9-b9d5aae5096c", "comment": "Malware payload", "value": "5e8fb270309ff5efc3e34f215b017f8168d7fe73", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219421, "uuid": "285ec8d0-9246-4c3a-9679-0ad6a35c94cf", "comment": "Malware payload", "value": "a9be795f409d43e463ae1ee712322ec854a059ea4048df764f080f2a57fb00fa9386ae22f739e561b9d837d0d6dd670d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219421, "uuid": "f82bf169-4421-4a3e-aa54-e464757efb49", "value": "T1B0311EC9B167E0622F731BF10357265DE67EE18112208129B768CED82F30A6CDB432F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219421, "uuid": "480d097c-b0b7-435b-8ffc-a81317c996d0", "value": "24:KqaAwAGIY45bjOxR2WY4YQMGaZZgCPv74Us7/MseXYW55laYFLQTHEeqr7:QbIf5bjYcWfYQMGCgC74UsR49lauP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219421, "uuid": "7deffedd-69b8-4790-a420-bb8769e6171f", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219421, "uuid": "6e4eadee-dbd6-4e51-8c85-390e7b04b258", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219421, "uuid": "0744cc81-e58e-480d-987d-72e7741f3fe2", "value": "payment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acce316-5760-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695178238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695178238, "uuid": "2a0a8956-e333-4ec6-be58-095688c50483", "comment": "Malware payload (RedLineStealer)", "value": "8867c0477244bf35406ccd5c22b37be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695178238, "uuid": "64eaf2ed-7279-4351-84bd-614c0cd0b886", "comment": "Malware payload (RedLineStealer)", "value": "083060da183ea3251c08d498ae6a91c4b5df1cb7eff4e9a242ab8111ee7b4896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695178238, "uuid": "e50a657d-a621-4339-a209-62bb05e72a9d", "comment": "Malware payload (RedLineStealer)", "value": "362e817f31a8a5ab3dabc329c1ae8a4753cd98bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695178238, "uuid": "f22eb788-83c2-42cc-847a-7222e84044ab", "comment": "Malware payload (RedLineStealer)", "value": "64974b8fdefa05637a947169fd5d37cdea37d8c6120b0845792178add88c3a103200e8fa9f596e1a91d6295319add381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695178238, "uuid": "0bb54c02-28f3-4a49-8fc1-f1cb16f6527e", "value": "T1636533075BD45133DC78577888BA97C31A39BCB109B4CF167F68A9A31CB1855BA3270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695178238, "uuid": "15a463be-b5fe-4f0f-ab39-57870a302882", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695178238, "uuid": "56daed88-33be-4083-ba7f-79dde45c78f6", "value": "24576:Gyo9Lxs67Gx8vTFATiMS8xlrpX8b4r7QD0GYwh/do5D1dqS0hwYp:Vo/s67Gx8BKnxlrm8rFu/do9ZrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695178238, "uuid": "81331a9d-8ad5-480e-aea4-8997c1d07e46", "value": 1468928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695178238, "uuid": "b4ed7b9c-83c2-464f-9dde-535e53667451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695178238, "uuid": "2b00d7ca-9fcc-4777-b15d-f1be58b9a1c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c13e50-5788-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695195616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195616, "uuid": "1ffc6569-2cb5-4c8e-bfe6-c9abd2db46a3", "comment": "Malware payload (RedLineStealer)", "value": "72f6d9473e2b8f1dd4f670cb00d4e3aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195616, "uuid": "9e4de2a7-e056-48a5-bbc5-ed5c28d2451c", "comment": "Malware payload (RedLineStealer)", "value": "08ab620c40699dde267ac86a558d85f3e5349825444e331ef03bcd57ee4896b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195616, "uuid": "bbe98a6e-9fe1-4a3f-a629-a159b17fc97c", "comment": "Malware payload (RedLineStealer)", "value": "7b04d544d4f93930de62bf7046639413661ed1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195616, "uuid": "20410819-96c6-4381-b283-751c5e19aa68", "comment": "Malware payload (RedLineStealer)", "value": "9f4f4a7682afdfc3e5801e810a7157a0ce30aed6bc0825c0fa116cb27c2803f16152bf5f59ef9a66d88c7ada6143e1c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195616, "uuid": "d2cfaab5-74b1-4931-a92e-2f572d86a6a1", "value": "T12184F112BD95C072D2A641304821C7B46E7BBC73DC79968B3794A6AE2E323C2DF25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195616, "uuid": "e9befd1b-7b46-4ef8-8f05-f80d3c509017", "value": "ebb1ad55f48b70b0a48dee8a767738f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195616, "uuid": "a06b8a24-a743-4eec-bc65-6b9bed6447a5", "value": "6144:/L0cvzlbVntvRX+0fc2aOcXb9m5bK6Dw17IZosLePmzvrCE+lekqkuu6T:TTLlbL5O0k2gwbW17PsYmzDCWkq0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195616, "uuid": "be950fc9-f18f-4074-8c76-cd3d09385f01", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195616, "uuid": "670821cc-4f91-4cce-bcd5-63e2e503bc02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195616, "uuid": "8c062799-7ed5-49ea-b12f-58df92f8e96e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1d9c80-5776-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695187909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187909, "uuid": "4a3af8f9-f6ed-4833-b25a-04f54f3583d3", "comment": "Malware payload (Smoke Loader)", "value": "340585a42460d2241419a561f573e23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187909, "uuid": "194567c1-04c5-4806-9352-09ae1fe83b0a", "comment": "Malware payload (Smoke Loader)", "value": "0931c75c0c5153d6e25c2026fb209c8bbadfa422bc2fe3f3afcdff81f22a2131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187909, "uuid": "ae1f4a44-16bd-4cb9-80c2-3a33bfdb7a20", "comment": "Malware payload (Smoke Loader)", "value": "0904d9b22a048a8b7d4a422058649321b13ea1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187909, "uuid": "aae0b015-eada-4c73-9177-69a5e839ef0a", "comment": "Malware payload (Smoke Loader)", "value": "fe1e9a734154dacdf9443633649fea84448558590ef5b94385658ca465da6837e23fde2a3d5ed76f27fb8557d9bcd042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187909, "uuid": "f697c6e0-4536-4c81-ba6a-a082ffbc267d", "value": "T15934D01235E1C432D567423C4865CBB46A7FBC7368658A8B3B841BBE6E313D2AF25307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187909, "uuid": "e5895dec-9190-44f5-b233-978ca4327b8b", "value": "55f2fae2d830ccf9734788609a42549e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187909, "uuid": "17cebcfc-1efb-4600-949e-2ec2854398de", "value": "3072:e5FPmWeoJZ7k8dGXPEtpSdlZAIYhEDDxp+9gzORlNcWIXRuyD5Wq2T1M:8uIJS8oXctS9CE/KNXcVutq2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695187909, "uuid": "4d5dcfa6-0e0a-4354-bb14-cc71e189ae10", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695187909, "uuid": "a6eddc18-5d79-41a8-8028-b2ca85da53a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187909, "uuid": "9bafde08-4d26-4367-9180-c07d332dd1c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8717fc16-57bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695217772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217772, "uuid": "96127fb9-d8e6-4228-adae-5046c1a36ebb", "comment": "Malware payload (AgentTesla)", "value": "8d7eea4fa1b573b722cac003a8aa205f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217772, "uuid": "8141294f-efa6-4539-9ccb-6e2cee857ba9", "comment": "Malware payload (AgentTesla)", "value": "0998cd32377cfe6c7692fe81f133383175e31720ef3a39b2bba7d63144445215", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217772, "uuid": "87805e14-aec4-4e99-bac2-cec87168da43", "comment": "Malware payload (AgentTesla)", "value": "e36bb22e4e07f9324895d4f9f1c9bfe4530427e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217772, "uuid": "ef306ed4-acd6-4a98-8ffb-53fa248d6e76", "comment": "Malware payload (AgentTesla)", "value": "4dc6b2bff1b2b147a32aae3421eecc5e3f6c881cad85d39b98a3949b4504daa9d613a3632cfa1c3f312a372812ba39b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217772, "uuid": "7b95c3c6-0378-4bd7-adf7-f27f01f3ba6f", "value": "T1C6941215BA90C84FC4D247B24D6ACAF9A726BC65EC31066737D0BF5F7836481890B763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217772, "uuid": "57f2419a-9ee2-47b7-8dc4-6dc4dd81512c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217772, "uuid": "7484576f-e057-40f6-ace3-513725725821", "value": "12288:2Ywe749s4i8IZO4zG3aZuqjOA8jLWeapOlp:2Ywe74m/MvaZFOAGLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695217772, "uuid": "acdefcde-9939-4912-8957-12dd0423398d", "value": 410430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695217772, "uuid": "193b8a04-bae6-4288-9d2d-c96b9677ed1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217772, "uuid": "1f0095c3-2dd1-4cf3-b8ca-81bc7b2b3b83", "value": "maxlobbing2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4544909-5765-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695180455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180455, "uuid": "64342465-e4ef-4f0f-aad3-e91335e18c2d", "comment": "Malware payload (MysticStealer)", "value": "dbcebb7048fbe124f6dba30503723ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180455, "uuid": "62c3eeae-5433-447b-8bcc-929f83e534ba", "comment": "Malware payload (MysticStealer)", "value": "0a34f0dd0827af6ff153a0c6b8fa601c2b81a7c893d82fdfd999b752671b83c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180455, "uuid": "a1a028da-dc3c-479b-969e-13baa2aeb009", "comment": "Malware payload (MysticStealer)", "value": "898288eb3659388fd4d03ceebab5fd64defb07e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180455, "uuid": "cbb5b569-51b4-4387-a5e0-e1c8c2a92dab", "comment": "Malware payload (MysticStealer)", "value": "949d8694f66de71e76fc26ca13e5baca79a791a4b96551488785029ad0fdd53ef0412a4ee0d48ac9657ab2aa64cafbec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180455, "uuid": "98bd504f-52bd-436c-b3d1-5af7e67fffb8", "value": "T1466523966BE6D8A2F8713B3084F713C30375BCE35DA84B573745544B0AE3A84AA3172E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180455, "uuid": "c6c84a65-3c94-4e90-8fe5-dc9fd6aced28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180455, "uuid": "9e7de430-fac8-473b-973c-07d3fb2e980d", "value": "24576:nyp05xXJx+YFJsOTIgjNQxXSZ8EoKzaXwinuRUJAViLWyUuV7hE3S72PJHlkx:yuJgMJsaQ4Z8EoKzaXwuuGTCMhE3ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695180455, "uuid": "331228b8-2deb-46c4-abd3-cfe13b1a3d0b", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695180455, "uuid": "8f5eb928-cd0a-480c-9c67-c5e6f391eab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180455, "uuid": "75a21121-e860-48b5-bd1b-135ae5208859", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a595943e-5798-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695202361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202361, "uuid": "2b48879d-4339-4315-bee9-8eb2d6b2af49", "comment": "Malware payload (AveMariaRAT)", "value": "f8c24ebc26f8ba9af425d96914edb4b8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202361, "uuid": "1ee464ae-284a-4fbd-af46-adf4448f53c1", "comment": "Malware payload (AveMariaRAT)", "value": "0a739aef89f9d83feb593854cd205c7fd476445398cf4a7026fc8937914d9b46", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202361, "uuid": "2c6f92cb-606d-45be-a4c3-d3dc9a8c9093", "comment": "Malware payload (AveMariaRAT)", "value": "fd9fcb6637b54c174764a40a24e650c459ecc928", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202361, "uuid": "b4f3f216-2249-4f94-b197-e79b16edf20d", "comment": "Malware payload (AveMariaRAT)", "value": "942417a7057dd8f1c91ece574be5991e7e328e3f2ea960c25d1bda964c757e70c6d6c8aa0702df8d54e46e202a6f136f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202361, "uuid": "4cd7049c-259b-421e-9165-5f7d2fa966dd", "value": "T19845BFB875047DE6266F576BCA96ACEC03B6276399CBA4CD80647BC30563376FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202361, "uuid": "3b78ba45-1037-4bea-8186-25c3f6b45d15", "value": "24576:DA7xaV3sbpeM4RZVLRt1xGS/4LntTAuekClPBqwGdwauO44UvnT+d7O:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695202361, "uuid": "6489890e-98ba-4b3d-8cc0-bbbb26d0d5ef", "value": 1180635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695202361, "uuid": "8faa5bfe-393a-4477-8b85-2e665120d38b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202361, "uuid": "6b6687b2-9029-4a01-ad96-1a8ce96cfe4a", "value": "PACKSHACK-Traders US-Rfq-PO190923- europe customer990 - Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6975b1be-57c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695219440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219440, "uuid": "233b3336-3176-4d61-9454-36334aad2aec", "comment": "Malware payload", "value": "9d59d663c48250e99c43b10d6fed2cb6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219440, "uuid": "c85a2a56-cb86-4228-a941-b71abf4aa559", "comment": "Malware payload", "value": "0aef9015ef84ae6b94550f550f8c4d284df46c4dd7f204c4cf23e4fcad0cf991", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219440, "uuid": "4ab2ad27-96f5-4dc7-907d-c4e5fac13ac1", "comment": "Malware payload", "value": "ef20e144bd5530917fc730ef3e6f9703e6240117", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219440, "uuid": "288e312d-0432-4754-8028-d3f513b57cd5", "comment": "Malware payload", "value": "2fee5803eeee37cae7c69b70fe1d73ed58f1e435f5ba8075a7b5968dab71b01025ce0cb1b7eaea317244b6b6dede0737", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219440, "uuid": "d745c641-3392-42f6-8fed-cbebc71d0ba2", "value": "T1BB318B6A02D3A31146F283675524CDA4EB4FA43F970509027B6CF4806F384BE5BDABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219440, "uuid": "04fd0676-a929-4ca4-9525-e1736e97aed0", "value": "24:tfMpE/Ot6wO5CL5w182oQnzUQqyQOt65AQJPypzX7S6yCRyy7JytEytX0jWFFGhj:tfM+/K6p5Cdw18/QzUQQK6eQJapzX6od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219440, "uuid": "46870275-7cd9-49d5-9c2c-33e46a0e3258", "value": 1447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219440, "uuid": "b0b8bb32-e584-4491-a101-5f115bd34636", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219440, "uuid": "55175d54-8479-47b4-b9cd-528bf2ce4307", "value": "paymnt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ed5fe3-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695194359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194359, "uuid": "9b8e7842-ce88-4885-af2b-15dd9188cb8a", "comment": "Malware payload (Smoke Loader)", "value": "d21f457f0a5b46195d821fa971344e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194359, "uuid": "1de5c8f7-f304-477a-8304-8e5d31819660", "comment": "Malware payload (Smoke Loader)", "value": "0c40e99ccd352e86095dd75f786dc8846c45fe0cd4ddf619ac6aa4f7ea7ae9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194359, "uuid": "72783630-791f-44b1-a4be-ffe5c7a39cca", "comment": "Malware payload (Smoke Loader)", "value": "b67303d6016cdfcabe02f3444b9e70a2949b826f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194359, "uuid": "35eb9381-f30a-4dde-a46f-3da12a686db5", "comment": "Malware payload (Smoke Loader)", "value": "c75fbd9c89dbd596cf66a87000bd3c453e7d76117b5b5995eae93639dbd7c75ff27b94163654c9956b8f6f52d2e212ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194359, "uuid": "ecd56af7-9c45-41d9-b948-228b3b2c72d8", "value": "T13234D01235E5C033D5A742354860C7B06E7FBC369E258A9B3B946A6E5E313E3AF25307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194359, "uuid": "d95fa7c1-bf77-4cdf-b9a3-f5397fc6b3eb", "value": "55f2fae2d830ccf9734788609a42549e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194359, "uuid": "58750b25-e062-432b-8118-e84e5c4c745f", "value": "6144:fjqZ/KZ9VfxBIknCdwTUFW0mkvdFPu0hTZB:u1e9VfxvnCdTFWqZFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194359, "uuid": "13bd8537-e159-408a-9692-fee3503f9274", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194359, "uuid": "644e4b9e-b163-4dda-b059-6f0d8c492632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194359, "uuid": "4465f50d-e373-41a6-bc89-aef576e5461e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8ae238-57ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695216731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216731, "uuid": "5e9a5572-7817-4c4c-97db-d1c00fe4efbd", "comment": "Malware payload (AgentTesla)", "value": "1db53de564c21ad06380fc078aa848c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216731, "uuid": "3b585c9a-be15-4ce7-9fa0-2b9605d17518", "comment": "Malware payload (AgentTesla)", "value": "0d93db96a7c71d216d6d4cb96abad741ecf89db460d2b32c82049471fa9504da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216731, "uuid": "5e6733f4-e35b-4ef4-be77-4b68ab64695f", "comment": "Malware payload (AgentTesla)", "value": "cdc806d66951637863f9423a600879efc382b370", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216731, "uuid": "dc486f05-1967-40ce-bee9-946ce8410ec9", "comment": "Malware payload (AgentTesla)", "value": "1d4d68be1bd051c4926d5e92184e8bf25937a2ad616898d675dd2441a4c49dc72fa6777c6c972cbef0513078916ab91b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216731, "uuid": "3003495b-0f9f-4aed-a5f9-284f909bbc3e", "value": "T1A0F4F1103A6C9FA2C27953F68299894913F2642E607EE3554DC378CF3A61F90CF61B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216731, "uuid": "b9053d2f-5bc9-423d-97eb-1a5436884834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216731, "uuid": "8f902ebd-495e-4427-9a08-99be5a61c6dd", "value": "12288:RdhUe2iNtZzdOusEOzJOfjwaWKAOWcbplxYQ7jqeLU7nAatj/6ireSKv:ZUe1tdLvPfjwaiDcZz7jvLU7nP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216731, "uuid": "3e87d1f6-7b39-4553-8407-4d37e44f1f84", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216731, "uuid": "38b41ff3-3aff-434f-b003-024366b42e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216731, "uuid": "218d8b87-8042-4519-aaf2-307ab0f9b722", "value": "Grain push barges picture.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84b2e49-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241880, "uuid": "434ca86a-30f3-4277-8ba8-509af1f34b2f", "comment": "Malware payload", "value": "295b01663ea913400e6d2983d7559a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241880, "uuid": "b362e27b-5d3f-4210-87b2-f698cc6c1328", "comment": "Malware payload", "value": "0e006728f2ce12948ccdf8f1db45b01eeea8e8203615352ad3200dfd1096ff77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241880, "uuid": "ddd07dda-8d1d-4db8-b372-3c846a4906d3", "comment": "Malware payload", "value": "5b9972be240e09e105e20fe20d0f6c494293f09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241880, "uuid": "94c5a467-90cd-4a11-8b9c-587e17999f01", "comment": "Malware payload", "value": "3220a270b2aa34307aee7e688f3dfdeafa20a14a23cf70de90570e70124bf8b098373850fd986932ff859c893c2d8f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241880, "uuid": "049acb7e-e9c7-44ae-86d4-321b88291e6c", "value": "T17C61C8D7E6D248B2C34EC5797A898128EB31DB3133A197439F6DA10ADC153805EFEA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241880, "uuid": "36bf6402-f7ce-41c7-a63a-ad9bc05cbc87", "value": "48:OEPoItHHkHL4D3fTyh6aRev5fFmQbiDgkc6mHTraCfVnkKQjhg4EboFc:nPznZ7fTtzWDgkc6AVnkbg9Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241880, "uuid": "52155818-13c0-4964-a592-332c402e99da", "value": 3445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241880, "uuid": "fdb911f0-5792-4b97-ba35-8c8de95c3682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241880, "uuid": "a4825455-743d-4f26-b20d-c14555924188", "value": "SecuriteInfo.com.Trojan.BAT.Qhost.17556.21223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3844302d-5796-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695201319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201319, "uuid": "334865ae-5962-45ac-9dcb-5db79ecf5c2a", "comment": "Malware payload (RedLineStealer)", "value": "b221c45c6298f78fb7f45bb29aca6cb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201319, "uuid": "9db10e13-5369-4d4b-b43a-681a983d3d22", "comment": "Malware payload (RedLineStealer)", "value": "0e76ac2617f6d3a3ea3e6ef3356e16a93ec5c63a080c848ab0027d120f2f9b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201319, "uuid": "e4eab32e-0307-4ff7-b881-63777b86bd75", "comment": "Malware payload (RedLineStealer)", "value": "9bad55bf3bb0ac721ffe6b05d6c3f93985a925d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201319, "uuid": "b9f203f4-8f23-4776-aa25-bffe8d481f2d", "comment": "Malware payload (RedLineStealer)", "value": "a96c9b9c30ec7e10158e82a75e43c068c36f9a01db344dadf4bd20113c39052479afe4301ccd598b7c22c4864360abf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201319, "uuid": "d130d98a-95ca-4605-9ef7-74791573cf24", "value": "T16F854B8FB90193DFD524FCF059108AB31196DE10A8503B7393DAF9F5EA3A282415EA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201319, "uuid": "b8594860-affb-4979-b8fe-4f19bfc5ac21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201319, "uuid": "7d6c3c22-9c82-49a8-b0e2-a834a757677d", "value": "12288:7/Nbq+9Jg/1lA+L6Hx1gygTGH74gQ0I/W:7Fbq+92lA+LUx1RgCH74gRUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695201319, "uuid": "7d6040c5-6f2b-4d6e-b711-a0de442e4952", "value": 1714176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695201319, "uuid": "a799a158-89a0-498e-9c80-f73aafd17bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201319, "uuid": "35bf1f11-e0aa-4f83-9bd8-998ea0a4b10c", "value": "b221c45c6298f78fb7f45bb29aca6cb8.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0128f17b-57e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695234727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234727, "uuid": "d37d659d-4b2e-48c3-a18c-04eef4e287e3", "comment": "Malware payload (AveMariaRAT)", "value": "710be6c7edbd56231c80ea627e7614c9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234727, "uuid": "cdc5856f-07c6-48a8-b963-b51f4a1e7d5d", "comment": "Malware payload (AveMariaRAT)", "value": "0eb1c727cb604fcaf30556be5783afb142e223d5fe037af252f98cbe1d0a2803", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234727, "uuid": "a83393ea-58c3-40de-9ef0-2f444fff9386", "comment": "Malware payload (AveMariaRAT)", "value": "a3e4aba67d90ed15872263756b48623f86a83067", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234727, "uuid": "772b6321-5aec-4c81-b48f-d6f44f733983", "comment": "Malware payload (AveMariaRAT)", "value": "55e57031cf1f10c6998a3e75b9b7ad967cb3164caa2d5c6749725ff4c065cb04d83f6296accdad4f99da026c39fcb14e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234727, "uuid": "b39115dd-ad1b-4bc5-9489-c89ae41d6eb0", "value": "T1E1D4B7FADD058942D2303673EF61B7329F294FD8B1E22005E21ABA567035F9E892DD53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234727, "uuid": "43f363a9-f751-4cd5-a4f2-beb5889dc27b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234727, "uuid": "6cdc3e6c-3c22-4025-8172-a42eff9ac14f", "value": "6144:mYa6OipsvVVAkIhUqsVZjxNNp+Epb/HpS4YSamRW1OeUgSxXbI5:mYxZkIlEx1bpjHA4YYRKOeA1bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695234727, "uuid": "dc0098f8-f2a4-4984-913d-9bee397f8e61", "value": 618985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695234727, "uuid": "983dd048-d717-4943-9c3d-3c9ea9e9c155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234727, "uuid": "d9515118-4a48-461b-999a-a2512af1ceab", "value": "SecuriteInfo.com.FileRepMalware.6355.6567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52492f5a-57a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695209094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209094, "uuid": "8aa80c50-54f0-48ea-9f37-fc643b59510c", "comment": "Malware payload (AgentTesla)", "value": "2b61f3f7e9dd004a37d2480313a0df39", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209094, "uuid": "da8df0c0-2a07-4d30-afc3-5e9fa5ab46f9", "comment": "Malware payload (AgentTesla)", "value": "0f153e7da13556161c16cda9153ed3c59a692cfdbb0a7cb6fb2753f3cb9a6618", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209094, "uuid": "9e924277-9dc8-47ba-ab82-f63ab092520a", "comment": "Malware payload (AgentTesla)", "value": "2134c5d2a71129aa7ccd56f6a74fcde94f232059", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209094, "uuid": "7c86c6a9-4585-4d1b-9232-2a9ef7cf6462", "comment": "Malware payload (AgentTesla)", "value": "c71662ee37fc4b642f724cefff409b79ecb4011e21365116a1af946b9623a5ee5b43a90bfaddb8f60ffaf9568f42e5a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209094, "uuid": "916f6b10-48eb-4abb-ad6a-5643829e6c9b", "value": "T1ABE423806CE2D06D9BF178FB5555165F61B66A8FA9DC80A12F7F3C32C6B80F9061E270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209094, "uuid": "826090ee-d767-4156-ac03-ddc67951df2f", "value": "12288:Milt2i+Bq3sWAe0xH5qzgwY4O3zbpyH9fZg8CSC/0J50n73MJcZrH:Milt1Z3sWAe0W8ZJQxS8CSCsJ5073++H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695209094, "uuid": "b519b9c2-83fd-4f76-979f-669ca27df0fa", "value": 666505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695209094, "uuid": "0e7d9b43-508c-436d-8cb2-046b486d4267", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209094, "uuid": "18dbf112-cd7e-45d2-a157-a4a624d6c48c", "value": "CV Lic. H&S Olivetti Renzo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7c0b86-57b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695216067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216067, "uuid": "2bc51c5f-ff70-4070-9c03-712978619f5b", "comment": "Malware payload (GuLoader)", "value": "344097615bbed01923c5bfa4507e07da", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216067, "uuid": "e8c1c1de-8a85-496c-a27f-5b4370e24b27", "comment": "Malware payload (GuLoader)", "value": "0f4808a14343d9631bd50f7d327daf27de3c470816e5cf8fd0b92928f81370e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216067, "uuid": "49800d4e-d614-4838-8be4-f444b5ceca71", "comment": "Malware payload (GuLoader)", "value": "9604fbcd7fb767a1fc8433689e6d8dbf5f6d9bc2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216067, "uuid": "6552eca2-ec6a-4306-bc3f-fefa576fe7b9", "comment": "Malware payload (GuLoader)", "value": "9299281297b17f5cffc75afc85d4cc83da897478b8844103539c8d1a0262a187fbcf4868a54354f731ced2d132947e8b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216067, "uuid": "197fd63c-6958-47e8-8ce7-b253a139ce08", "value": "T12A453302429D9B32F39761B24D963D1FCE91CF1420B537822F22BE91D876AF5E91A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216067, "uuid": "71cead10-c2c6-46ce-8944-e2c26db45183", "value": "24576:PlY4e8txwpsmTBmRr++qiOKpTnDeSsp1jQW3GwiAtsp1kt4KdAZJO3FqdPH5oUPh:acwGAARrtsKpTYpyW3GwY6tMqOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216067, "uuid": "5d19ed00-e0d7-4b5d-9f64-e7095cba4f80", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216067, "uuid": "0d7c0d79-4749-4d79-96c6-97552dd9b03b", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216067, "uuid": "440150a5-ec2d-49f5-b034-95bf972c715c", "value": "fac23_0000201.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c887a72a-5793-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695200273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200273, "uuid": "e8f36252-30de-4e89-92a9-4ccba13b71f5", "comment": "Malware payload (AgentTesla)", "value": "aae3fd5f37cfe30d323d7d80a6d6f2d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200273, "uuid": "22891ed6-59b3-4982-a400-cfa5f4d32bbd", "comment": "Malware payload (AgentTesla)", "value": "104c937fc2b61a982610bc109941759dd8a5e48fbb868d9c03e3c1602e83b593", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200273, "uuid": "bc9061d6-3a5b-4e85-81a6-3afa48077e01", "comment": "Malware payload (AgentTesla)", "value": "f00e4e310e6dd1121e8923ab4559659ced724dfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200273, "uuid": "3fa663ec-a243-4dd7-820f-c114ceb8225f", "comment": "Malware payload (AgentTesla)", "value": "76263c7d9f39c4dc556c2a4e524c88762cda803dbd521bbc1d80ace06495d0a3a604939163b2d1c1ea0fd36a64e78e8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200273, "uuid": "55f7e2dd-e4b4-44bc-a2e9-367936c5821f", "value": "T17F256DD1B1548DDAE96B07F1AD2AA43012E37E9D54A4C10C1DDABB9B36B3341209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200273, "uuid": "a88242ee-752c-4612-9d4e-e3660901ab56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200273, "uuid": "e6f9ea20-ef43-4ca1-8767-3fd57fc712de", "value": "12288:wd6U/2iNtGx6i0aAfcqBP8nbMkjgilSFGJspcnrPupaIgOL1:xU/1ax6NaAfcMP8brjgi9nxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695200273, "uuid": "54931c0d-0cd9-4618-b20a-75e664a375d8", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695200273, "uuid": "35d77535-3d67-4ece-8813-a15017553b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200273, "uuid": "13734d99-b9f2-4b69-9af1-1a6da1e9f251", "value": "NzDQIFjHGuWNBdG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e13646-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695194488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194488, "uuid": "389cda1e-c7ad-46ae-966c-4473a18f2612", "comment": "Malware payload (AgentTesla)", "value": "1bc2d2afdc016c3f908c961706087094", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194488, "uuid": "1f4511c3-2fc1-403e-96ea-13c5bbdff1b3", "comment": "Malware payload (AgentTesla)", "value": "105b794d85b5a1da2dc39cab29f7cddccaaedcb000943c04a5cef0f8c6f94e62", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194488, "uuid": "c4668b79-7021-4349-8785-4ba133221727", "comment": "Malware payload (AgentTesla)", "value": "dcae488dca344fdf6b76f819476b5421c06f3b31", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194488, "uuid": "485ef6fd-8dfe-4569-9ef4-8ccfb7cb2552", "comment": "Malware payload (AgentTesla)", "value": "bb430ab1cef314d4b3eaf82e36ce8ae5189b7430e0bd2a714c5a3f5008964d9faf65a2f0725a5c42ff4f6b7d997727f8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194488, "uuid": "85831c42-a4f7-48f1-802c-83856cf71072", "value": "T16DC423DBA79F6F9D37C5045470DC2D6631034A34A4B8B38D867EBC75BA6C1C8E0062B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194488, "uuid": "7d0951ac-1b37-4bcf-843b-3a807099e5b5", "value": "12288:x/hh10Xh52q8qTt5MpfMSykLd5h1zyHogdEk8PbNpETATc7e6E:Th10XCNpfMJkR5h1zyIg6k8PvLTc7e6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194488, "uuid": "2bdf3d06-a654-4274-a655-119e5fb241af", "value": 581506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194488, "uuid": "16e69fa5-5949-451f-97db-8a17074f3a3a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194488, "uuid": "229d1491-0d3d-4f7a-82bf-1096d5b2b185", "value": "INV01562.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6c7174-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229000, "uuid": "e9da20ba-649e-4044-a266-5c0dd574c238", "comment": "Malware payload", "value": "b4f3a5054f0e99f8d3f01a7012ea591d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229000, "uuid": "be9e81b9-f7d1-49ce-8fbf-d93c91ae2b39", "comment": "Malware payload", "value": "10f5af8eb8756da0b191701980fa8558ddd19fa6ed62b94f1972294fcd80471f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229000, "uuid": "ded00d97-a40e-43a9-9762-41a8149d64c1", "comment": "Malware payload", "value": "07742c8f6bb67a596e4a742445d5923c9f4f35e4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229000, "uuid": "4c686020-fdaa-4533-b7e8-15372ac7bdfe", "comment": "Malware payload", "value": "a9afe78434ac5fcb47112ed9a908610929ca07bc80c1a7d91cc176b42f891b0ce3fa8104306cd1ad4a64ff83252a66ab", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229000, "uuid": "d6e5d604-3bdc-4e69-91ab-fdf4da2881cf", "value": "T1AB456BD25CCCBA82C70942B7EB12F9FD0A7BFE0D948524D63571EA4A293316D1C7A439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229000, "uuid": "3ae64aac-8b48-435e-ae3e-a32adc18f898", "value": "24576:vWQmmav30xSZy6w6VH6NGyZyew6Vs6N9OUJwVQsTQZSunPSw83:eQmmQ306+6VaPK6VtqVjTXun6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229000, "uuid": "93ae28a1-c60c-4ec2-91de-9597ba1f8001", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229000, "uuid": "d4135260-9a0b-4378-a4b2-943660ad664e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229000, "uuid": "74acb291-61c3-40d4-b49e-7c5a744ee711", "value": "ENQUIRY NEED QUOTATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2aadaee-57a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695209229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209229, "uuid": "ef0845c7-d453-4cfb-bef4-f174512850d4", "comment": "Malware payload (AgentTesla)", "value": "f382cf4c379414f63ab9f9bd16e98b6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209229, "uuid": "66a53a81-131b-4f07-8b78-222d0591230d", "comment": "Malware payload (AgentTesla)", "value": "1125f1469e4241cdafae0c0595f8a446eb1a9a7afd107be20deb9f51835d4da9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209229, "uuid": "db8a7b30-c2c0-400c-aee2-60d98de96632", "comment": "Malware payload (AgentTesla)", "value": "4b295318180bc477baf16a728c0ac0f862ad49ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209229, "uuid": "e8ffd530-5872-4866-9969-94e2576ad08e", "comment": "Malware payload (AgentTesla)", "value": "f46b5267694709f4a86706917f8897d02f16d33a8b036cbc5010f81397341107ad59a2176cc50eeea9d55d480d8061eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209229, "uuid": "b41bcdcc-ec48-44ee-bfd4-c94ef7c39b5d", "value": "T1E0256CD1B1548DDAE96B07F1AD2AA43012E37E9D54A4C10C1DDABB9B36B3341209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209229, "uuid": "579c8756-e89a-44ec-a713-20af62d4db24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209229, "uuid": "29615a1f-9fe9-4268-a3dd-c0645f072c79", "value": "12288:0dOUM2iNtDCdyO94DazVF/kLmfnlCSLkvCWuaSGSRrpLprmxK:lUM16jWYVF/kmnlxLk6QdSRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695209229, "uuid": "4830ee3b-893e-4d5a-b2f4-f8a51af04af2", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695209229, "uuid": "6dabc006-d7de-49b3-b754-1d34c8a4ed76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209229, "uuid": "20908649-ccff-461b-a0f2-2cae8a16913b", "value": "sipari\u015f formu_831519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaea125c-5796-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695201619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201619, "uuid": "a566bbcf-a5ed-46c7-82dc-d62f615342d2", "comment": "Malware payload (Loki)", "value": "4d2c51f78f596bbd1630847fd6a28473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201619, "uuid": "0663fbe7-e85e-4a07-88c4-709c8938093f", "comment": "Malware payload (Loki)", "value": "113604a26f601d835c435c7445751145354b2dc4c019bb4b88d4a6b416074a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201619, "uuid": "22530b16-882e-4da8-bdc8-eb23e48b3c44", "comment": "Malware payload (Loki)", "value": "f79612cab2c0fa4e66c68277467da95b0b680bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201619, "uuid": "48e1337e-dc7b-4b42-a2bc-2e7e728460ee", "comment": "Malware payload (Loki)", "value": "e9c0f5d994dbd27b3a2b12f8b27ceb2ef84d5f749242e4807be159320caab47998aceb1d19e69c031fcf74fc7cb2a56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201619, "uuid": "2f3efac9-d336-40b4-aabd-1159798bea9a", "value": "T1A2C4E0113B7CAFE2D63A53F14298898503F1A56E603ED3564CC3B4CF6A52F908B51BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201619, "uuid": "8b3b0050-64e1-44c4-ad62-83348263904b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201619, "uuid": "a6224895-ab9e-4162-a8a6-795fcedcb94e", "value": "12288:3dDjEU/2iNtOGy+8tkWZfpRxmoZ7PhxFDnem:5gU/1iGy+8xf/0GPhxFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695201619, "uuid": "6f2cfc89-5362-4ddd-bfa6-419872132264", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695201619, "uuid": "c5eb978f-65ee-4a5d-863f-7ea7de17ac1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201619, "uuid": "e1edfa6a-2aef-4117-8429-de772e1ae498", "value": "Aanvraag voor offerte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8da26b0-57c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695220111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220111, "uuid": "fddc45df-05fe-487c-8db3-eaaea3a65195", "comment": "Malware payload (RedLineStealer)", "value": "6becc531a37b1b3d57011593862504d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220111, "uuid": "72556de8-58d6-42de-9028-eebe5cc6f100", "comment": "Malware payload (RedLineStealer)", "value": "1495761831ec4d2773095ae921055267c1f3055fa9837c9f704909bcebfa92d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220111, "uuid": "e72414ed-3ad1-420c-b40f-08585bbd8200", "comment": "Malware payload (RedLineStealer)", "value": "d6526055ea27ca18b177482d83d63b002fe3bbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220111, "uuid": "21d14085-19a6-4049-beac-3430541dec70", "comment": "Malware payload (RedLineStealer)", "value": "830806dfcce84a7391e2d5c87911faeac2d1063ffc68e1b2d8457c3b481883dcc2fcdebdf24ed402269990b6c05d7fef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220111, "uuid": "e09ae5b5-6428-4e47-80f3-11db784e4fac", "value": "T19E6523426FE92472F8385B7418F701C32932B8613E6A965F674BA91F19F3A64B134733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220111, "uuid": "7759f683-fb43-4a14-be97-25e3306a0c35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220111, "uuid": "77d1cef5-89b1-4978-a5b5-7b3ca25d0983", "value": "24576:FyKunNJqk8Doa2P1m4Z1I2ARF7Qe7meMYF6lkwlXs4fCB603JfbUJVe:gLNoeNX1CRKeKeMD24X5EJfQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695220111, "uuid": "868dc158-5fd8-435a-8a55-12ac9709d473", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695220111, "uuid": "087482b3-d787-4d69-881b-b3cdd89ca3b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220111, "uuid": "a8b5edf3-acf7-4544-8e85-ec1090559b15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a316cc3-579b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695203497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203497, "uuid": "25ebd634-a3de-4ada-8c34-0d090a871f7e", "comment": "Malware payload (Stealc)", "value": "082b97e6dac6081eb5ef13bb3d30b9cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203497, "uuid": "cdb7a4b4-3629-464a-b729-175f0c0f36fb", "comment": "Malware payload (Stealc)", "value": "1593dc6a32a51ecdb1ace6ce4b4b69e5c102710b802a4c4bee016d3f20635801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203497, "uuid": "7eb32b2e-436e-44bc-8764-dfac9d3b83ec", "comment": "Malware payload (Stealc)", "value": "bca14ac45b9c3549aefefe5b09a1b576fb464a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203497, "uuid": "593337fd-03b5-47f2-8c8f-68a785d4030d", "comment": "Malware payload (Stealc)", "value": "fe8c9f6a60f62c1694f87a4956f73f8a0a3f3a22828eefd620faa197ea7a62b741a99222f95ac17ef8dece55100e3126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203497, "uuid": "5a2565ab-4197-4c98-b23d-964485dd7e6d", "value": "T15C34C01239E1C073E66745358825D7B46A7FBC735A258A8B3B902BAE6E313D29E11307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203497, "uuid": "bcbf92d4-ab55-407d-8856-b98a77bc55c3", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203497, "uuid": "331e29b9-64a3-4048-86eb-bea8cb31ca7c", "value": "3072:rdUEE0Q6lTz2hRSyDyT/lh0qVHklctXUXMdiIXc0705sZ35vOnAZbTzm:DpJz2fJDqNhpClcJUXyXc1mVOn4bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695203497, "uuid": "298d8467-e68d-48b0-9ef0-ab0ec6ddc3af", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695203497, "uuid": "b2c40f99-658e-4b2a-a370-e1814d74d1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203497, "uuid": "a4e2b271-9df2-4156-98e8-0f3e7e4286e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd26d7f-57b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1695215717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215717, "uuid": "7d09fc4b-b8f1-4d23-9b65-a114948d9a30", "comment": "Malware payload (RaccoonStealer)", "value": "8e16f708713d59a7764c78dc59b9b12a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215717, "uuid": "ae661acc-c2b0-4bc9-825c-5140f7ce6336", "comment": "Malware payload (RaccoonStealer)", "value": "159ec0b1b8fca14c3b5e20dd42d3ef37fb77cf2818e008e7694aa003a5702010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215717, "uuid": "cc232d56-7ead-4451-9b3b-5b111007362f", "comment": "Malware payload (RaccoonStealer)", "value": "ca33ab8943ae25fee116aed6e9b154e0e52035f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215717, "uuid": "5238c4aa-eea7-4f0a-a8c5-6a925de5075f", "comment": "Malware payload (RaccoonStealer)", "value": "f7d6b41537e8af501f80296b06905adf386f12faf90f007c60d63035f89b582a70214a4ea39fd881b02248f6c49e4d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215717, "uuid": "6c3896ed-bfd1-49ed-90de-d9c2169270ef", "value": "T1A134D01235A5C072E5A7D5354865C7B46E7FBC3369258A8B3B802BBEAE313D39A14307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215717, "uuid": "5577e12f-1349-416d-9514-16cc227b57b5", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215717, "uuid": "2cc38f54-73b8-4da4-841b-eb67870c5c7b", "value": "3072:bffu0FebfDTUilVw9WXgtjXGNgC9vGKo4Ek6miS5vfXTzj:D3eTUwO9WXobGNgAGn4EzwfXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215717, "uuid": "e46985ad-407a-4c33-8b7a-aa3ba7bd5491", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215717, "uuid": "6bc832b3-0de0-4447-a8c1-2d30c1fed44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215717, "uuid": "81bc5d27-ac7b-4e8d-88a5-e2638cc63717", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e89394-5779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695189157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189157, "uuid": "ac850a21-f280-4f0c-9902-b63c6fdebdfa", "comment": "Malware payload (RedLineStealer)", "value": "e8a7453bd7511a1a3828c66b0c9e8751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189157, "uuid": "bf7b6fdf-31d4-46a2-b59f-1df800079afc", "comment": "Malware payload (RedLineStealer)", "value": "15e90202f17c05b22c4ac4ae1d5ab2f48a703e366799b25595762311af47ead7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189157, "uuid": "2ab0579c-1186-48f9-b670-361d4d89e299", "comment": "Malware payload (RedLineStealer)", "value": "19ab53f57de2344866b5c8e040f9d92a24c683d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189157, "uuid": "ba016402-5ebc-4bf9-9bcb-e4a3b88d435c", "comment": "Malware payload (RedLineStealer)", "value": "acf4901f898dd8c496c407f7725abd9ff9cabcb790d97058d5a39724e3da8dedd9a5d9b643e84597022b975a29ba9e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189157, "uuid": "6d42fcc6-c486-4205-9428-583b2bf92210", "value": "T197652361E7E4127AE8741734A5F553C31B39FC814A21C32F725AA86F0DB2AD4697433E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189157, "uuid": "2bf41244-7e02-4b7b-aab4-5d150667f0c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189157, "uuid": "f6cef59e-2193-4147-b341-39f65260ddf4", "value": "24576:iyptdKGfoBuoasWb22ASydDWzqK9cCzhr/VFpQA82T8nT/29H:J7oB9aV13qKpzl/V3NT8T/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695189157, "uuid": "726dd612-c6e1-46bd-b467-b458f0f249ba", "value": 1471488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695189157, "uuid": "b293a2c6-0ee9-408f-93ea-96396c2a6152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189157, "uuid": "ef6ea9df-a099-4659-835d-d1cfe19353a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9943095-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695199362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199362, "uuid": "7344212d-e241-40ac-8dfb-9fd0cc7c2ae7", "comment": "Malware payload (AgentTesla)", "value": "998d63679f009512f53982b06aacbc54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199362, "uuid": "f95bb3a8-e657-4e0c-a3bc-71c4433520d7", "comment": "Malware payload (AgentTesla)", "value": "15fcc8d00acb8914e18319ad17918b821adf16f84858b728e15ec432b973a648", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199362, "uuid": "067e7a90-a969-413d-9e8e-bd892db6e298", "comment": "Malware payload (AgentTesla)", "value": "42e14db18c1715930c39431cfd7e5d4ef3697e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199362, "uuid": "3c083d3f-7d39-462c-88fd-19ab05055749", "comment": "Malware payload (AgentTesla)", "value": "1b38ef03d1404d84f7164d91c53d417d645c8987bff1b80a7fece9177bb687304132f0f8314dc4d24b5e169042d15f94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199362, "uuid": "1f90eb39-53f7-410b-8d40-45232b06b48d", "value": "T188D4124037788F03E5185FB84470348167B58D47F975EB2C8DCAB1EA4AA7BA9CB1274B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199362, "uuid": "38cf84b1-d0be-4334-aff4-abec3c282abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199362, "uuid": "e09d7429-ab35-4b1b-aca8-60d7527ae2a0", "value": "12288:NV14idhwt3Nmim1mTBGCbGklMwrFL6vXTYPt3RobOzDeEiIBDaAU:T14iduV+mCklMwrFL6vXTYhRoCz6EiI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199362, "uuid": "5ad17c47-0a2d-443e-a402-6f1f97806076", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199362, "uuid": "091d4123-c8c9-4675-9e83-5cf438413872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199362, "uuid": "15f0afe3-bd5d-4b88-a357-7707cab3f3ff", "value": "48857571199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2defeff8-57ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695216764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216764, "uuid": "39ee6b09-e313-4520-81e6-d6b8be801528", "comment": "Malware payload", "value": "7002e4fd15441f387b83d57337a6922b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216764, "uuid": "641b9ce7-a6cc-4951-bed3-d1be138bd98c", "comment": "Malware payload", "value": "16e49d9e032209040144a5de7591d1e0c1f47a16a792ed9de425e1ddcce23c71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216764, "uuid": "a9a3fe43-40c8-4fab-959f-f26f4c71a562", "comment": "Malware payload", "value": "1a13b5a71f41bc0e458d31a96be4650c47164f6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216764, "uuid": "8889b560-f4c1-4eeb-a6c2-9fa3d0262b97", "comment": "Malware payload", "value": "d9b93bbe3de3c9e8e71186a4eff0b4e7464ddee92e19777ae67d1ad5e98ffcac7881738925eea8b043e256ff886e09c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216764, "uuid": "787b1dc0-b9e9-456e-be53-add4043cba47", "value": "T18121B44177760947E72BD935A1AE5726BD24B64C93F8BD295B11F1CA4C36F1188108B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216764, "uuid": "3e05106b-f05b-44d5-8385-044e0ed8810b", "value": "24:gg4PKyBHtROWvAxLlLs+gr1CQ5JHCLMat7UxAuY:qxRAvLsVRCw/g7U+uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216764, "uuid": "5b1e38ce-9b24-48c3-bc97-1fd4889a5daa", "value": 1242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216764, "uuid": "3fe9ce66-523d-47a9-8f8a-8d76185d78fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216764, "uuid": "8a2244e2-bd1d-46b6-8c0f-7b6bc694daac", "value": "SecuriteInfo.com.ELF.Svirtu-AA.24429.14780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c2ca1e-57d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1695227625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227625, "uuid": "c01ced83-f9d5-4222-b858-93008fdd59f1", "comment": "Malware payload (Amadey)", "value": "56c197e493f74f9233a16cdefab3109f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227625, "uuid": "21108473-7f0a-4361-ba95-10a26fe9fc9e", "comment": "Malware payload (Amadey)", "value": "172cb28c1c7948ece5287c566e9a684c56e64d85574d1636d5204e168771ce01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227625, "uuid": "5f23de56-dce1-448b-9631-381b56c15618", "comment": "Malware payload (Amadey)", "value": "af35bd2fd5d884bdf6bea8aac695e98f5a00715a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227625, "uuid": "f51fdcaa-35e1-4662-8360-fa0bad476c97", "comment": "Malware payload (Amadey)", "value": "e889425b826af3daddaa3ffed0c8bd411245feb9c4649921b2448b4cf0a3eb5841712145b26604aa26826ddf08986c0f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227625, "uuid": "39653c38-789d-4846-8bc1-da0e5c1f5400", "value": "T11576226335085984D4A96C34F52FBCB523B26D27C68058BF71FABECA1972DA0F1C7906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227625, "uuid": "8e4b67c6-ad83-46c2-8e53-809d02184c0a", "value": "a4516a6804cddd5e52a802d79bbd487b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227625, "uuid": "234fc8e6-5eac-4403-bfe7-7d76b4f70135", "value": "98304:ULop5mhzd71cBjG9Azp56BV8cM0AnwGSOnTXsYGeCW1zbiG54WeOVEMMRHGV7E:0op5mqU9KE8nNZnTXaexbZWsMGV7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695227625, "uuid": "d71da6e8-aaf3-4607-b082-656afb97f389", "value": 7263744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695227625, "uuid": "bb48052b-858d-489c-a409-f235bd8e826e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227625, "uuid": "cc41f8ac-4b69-4dcd-afab-9f01954051c9", "value": "SecuriteInfo.com.Win32.BotX-gen.30049.24820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c808dc3c-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695195977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195977, "uuid": "0862d20e-0771-4d13-9777-36839e44d6e0", "comment": "Malware payload", "value": "ff3ca704eb86e3eaf618acb0c978c4d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195977, "uuid": "f0d968c9-ef64-40c1-9751-3dc1e4e1f4c1", "comment": "Malware payload", "value": "18394fd10e530275215617a23daa038e85b0abc289a3634643fee27945941982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195977, "uuid": "ab4a9e78-7d14-4923-ba29-fcb4174e1bd0", "comment": "Malware payload", "value": "0ed3c8cda272904857bda08c6af24b6dd72cc15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195977, "uuid": "f3be0ea0-35ef-4a6c-bd50-6d27c108bf5b", "comment": "Malware payload", "value": "c7d9357c196da92f1c1d01b07ac6e722829e7f14ac9bd2aa6334857385144810b9f494ebb0c65a50196a6df21701202a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195977, "uuid": "59a7892a-548c-4807-9166-e53e3984b8cb", "value": "T1CAE5331565703EE7FC4DA4B551A038362A520E748A5C25CA59BEE424FB06F7BE8F02CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195977, "uuid": "9e3e6ae7-4b8c-484a-ac3a-d7cd1550ce80", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195977, "uuid": "55298513-1115-47f6-9a97-31e1a16f0174", "value": "98304:Z8OeWOJrycUiKoCbNvdE0Zeh85a0oeXZiID:Z83hMVhZe+55L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195977, "uuid": "1178d315-cdda-4af4-b89f-e9d29515c8c4", "value": 3229029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195977, "uuid": "63f9151a-8565-4e74-b3f2-07d22fb3c564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195977, "uuid": "ef0c1677-2fd5-43cd-8c20-2454443a2090", "value": "ff3ca704eb86e3eaf618acb0c978c4d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40573bd5-57c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695221948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221948, "uuid": "e049b40e-d4ff-4ee0-8597-0f78231ce190", "comment": "Malware payload (RedLineStealer)", "value": "22d34ff361985400efd81d865705194f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221948, "uuid": "750498b8-5183-474e-beba-c7314c8e39d3", "comment": "Malware payload (RedLineStealer)", "value": "188c63d9c2fc36af2a1e2e3fb808420c14e79fd0efffba7f6430535e1008f17c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221948, "uuid": "df8af0c9-04e9-4a09-8b35-0e9f0f4ed112", "comment": "Malware payload (RedLineStealer)", "value": "f5ca38341e8553ae152fd6743c27f9733247f9a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221948, "uuid": "bd24cf79-8669-41af-a166-3e66efdd78f9", "comment": "Malware payload (RedLineStealer)", "value": "e4b220a0da78b1605a92e13c1e14926be9cbf7d3d7e16f772a7d7b9a8106f428be29c7ec4b434b672cf01522ea885a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221948, "uuid": "aaf3c314-2bde-46b3-8565-5025f0bcf45d", "value": "T1F9359E2178A2D7B3EDE210B643ACB969125ED9B4077586CF17C8D6FEC6502C27B33189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221948, "uuid": "0b041716-2ade-41db-835b-803ba2b52a8f", "value": "275c1ac8a0a90e452d90c6b023f705b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221948, "uuid": "031dfeca-ffa6-401d-929b-80b3a8131527", "value": "12288:jsud2dAHOvLBwvJ5zkrqJd0YSFYvtZ4tGxHXmnluGwGfJ2oCV6S962Dyu:YW2dAHOvLBwvjJSIYkksV6S9Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221948, "uuid": "bc72bb58-83f3-4d94-b157-8e0f52d4d9a4", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221948, "uuid": "d93891b5-a7a5-4c82-bc98-ff782a5572d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221948, "uuid": "b1e5fbff-971b-43b9-9fc1-55cd1bbbf0ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d73c8e-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695228994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228994, "uuid": "594dfc51-6555-48ac-8131-322df78045bc", "comment": "Malware payload (AgentTesla)", "value": "3dd1f68f16c0f3d9943b71a69c79a9ca", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228994, "uuid": "c5cb446b-0966-4d48-9e59-a77c03993501", "comment": "Malware payload (AgentTesla)", "value": "1a0877854d1dbca39a40b3c89b4474f59e2f8a8911245ce49f88512a951cb271", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228994, "uuid": "064fb699-9443-40de-8947-1e90ff17ac9d", "comment": "Malware payload (AgentTesla)", "value": "3448be1b42ca2e27f17fb3b696bc92cc29fd6d10", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228994, "uuid": "57775b66-7419-4ae4-8157-8185e204625a", "comment": "Malware payload (AgentTesla)", "value": "cf947f52875d3182360ada76d7b920cb9eff27ca6ea8732011b38361cd7d542fde5c85a20bbc1fce555bbbd3a315ee11", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228994, "uuid": "75ba5b37-908d-46be-8d36-8fe709cc78a8", "value": "T19405336B9A1F138443EAE65EDFF41301E9EF06487604A3BC2D4402D199E93B6C9736F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228994, "uuid": "d83701d1-ed98-4b88-9171-439c145d851f", "value": "12288:AQl07NqawDM2GXBvu1+mSmHoZVwzEx47VWcrDCfAaWDgUlI1etONdZ+fKuVja:AQlSMawQuAmRHQVwzEhcnug7AN+fZja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228994, "uuid": "6a105738-cb77-4446-ba17-18cb0e8b3f8a", "value": 840005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228994, "uuid": "06db3ee4-2b30-43c2-b836-4d9c6225384b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228994, "uuid": "bf3986f2-4f87-4471-833c-3ac0199dd8da", "value": "PDA Invoices.zip.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2135c201-5799-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1695202569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202569, "uuid": "e104b6a6-1d59-4fa7-9bde-4f0b64cae8bf", "comment": "Malware payload (RiseProStealer)", "value": "f6bed00de0ca818520cdf3145dff4308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202569, "uuid": "627a5e49-3173-4449-a410-1de61e9ae611", "comment": "Malware payload (RiseProStealer)", "value": "1ac8676ca0eda46425f52efbefe7825cc8e49d31bd9108f7f26fbdcd79a4c018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202569, "uuid": "96aa7a62-7fdb-4abd-ad17-cab1eb51961f", "comment": "Malware payload (RiseProStealer)", "value": "472291ccc6d5fc926f7d0537a10f21fcdc3feec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202569, "uuid": "5626d95b-b294-478b-b5a7-2b871b663c06", "comment": "Malware payload (RiseProStealer)", "value": "2dbe8783aa38752a0c5dd89cf370af5786984b2a27d4e6fbe905813690f515471a8347574fc50ee10ded3766fa9c5c20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202569, "uuid": "96155371-918c-4614-8399-8cda91093db7", "value": "T1CE76337353540284E0D9CD398A33BEE932F2137E9F81A4B966DABFC510D2AE1D613953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202569, "uuid": "d743c2f6-9ea6-4e3b-88f8-dc2cf2926b60", "value": "6f460aa1477a9dc0ad8950fc7506f88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202569, "uuid": "e413e8fd-8062-4934-8790-baf8457793fb", "value": "98304:l7qtH+fFtFXZN8C4qms0K+cTGgw8Nx1rzkxdEdUu2cFsyWKbN5e6FgZXlCSk:k4/eXvcyglrzkbpJ4WKbEZXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695202569, "uuid": "4cb4eba2-1d77-45ab-99af-80aa7f1d7eaf", "value": 7411712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695202569, "uuid": "244ac72b-bb9f-4972-8394-c3c17b887677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202569, "uuid": "c5200f2f-1cab-42d6-950f-e2139b49e0e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbfd344-5766-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695180790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180790, "uuid": "475c9166-d4cf-436f-a635-0e4fbf9469d2", "comment": "Malware payload (RedLineStealer)", "value": "9172eb770b2bf654c44c426c20a355c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180790, "uuid": "9f10e7b3-e55b-4c02-8b12-3daeeeed9ae3", "comment": "Malware payload (RedLineStealer)", "value": "1c51997ed0b2019b32d987cac7c47cd0ec02043dd42e8c9b71959d6614d06790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180790, "uuid": "4c399cb5-29f9-4d5b-a610-f51036470e17", "comment": "Malware payload (RedLineStealer)", "value": "4ee004bfa4a00824348e1eaf911070c6d4e53a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180790, "uuid": "2cd8a514-07a1-4274-b43d-f61c53be1293", "comment": "Malware payload (RedLineStealer)", "value": "4121d7c3e0866c4b5e0a495020e0be927ec813d9efd960bc20a84d9f7d89c061a817baad37161439f7e8ec0f5332cf50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180790, "uuid": "c4986bb2-dbb9-4c43-8077-08ce49b78562", "value": "T1CE9402217393D072F4A747308471C7942E7F78321AB9999B33642B3E7EB02D09E69766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180790, "uuid": "865f17d9-efb0-41af-af07-1cc6520d5ea4", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180790, "uuid": "bbd7f5f4-3e60-401c-9ea7-881b7598763a", "value": "12288:FUraaMb4iNwgNgtBft2qNUyCQ/KQsUxTu8R:FJaziNLmfR24/LLbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695180790, "uuid": "186c73d5-8fd1-48d4-99b1-44af29dc723a", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695180790, "uuid": "1d25458e-9a02-4a88-8a3f-62585ff8d131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180790, "uuid": "90dcc2b5-0254-4412-9f90-30899bad9db3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d131481-57a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695208763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208763, "uuid": "76ea72b5-3937-498a-a69c-ce46eacd2fe3", "comment": "Malware payload (RedLineStealer)", "value": "1020126877e7a9e44c45c878506a97c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208763, "uuid": "c44ab87c-2944-4b4b-a0f4-c75dbbf33a78", "comment": "Malware payload (RedLineStealer)", "value": "1cd6dbf711212182e818072fbda50d22c131e5969ca25f63d88a9a8cb234b24d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208763, "uuid": "f01b7f3d-157a-43f7-abd2-160ceb2eaf7c", "comment": "Malware payload (RedLineStealer)", "value": "079583f53f470c6fc2558443769f1fc749575b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208763, "uuid": "cfcef294-dd77-41f8-8682-9e63ba061ff8", "comment": "Malware payload (RedLineStealer)", "value": "a681c28d8f6e700e76ba73e2e016986bb6ff91a5815925fbaf060c4f6b5f56e2372d2c79621baf613d78421bce6e6057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208763, "uuid": "2ca625ad-a563-4098-99fd-62326088a57a", "value": "T1566523436FCAD471D9A0277044F906831F357EA35A3C076E235AA45A0CB2AE1B8B177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208763, "uuid": "0fb7c1fa-4332-4fc6-9a99-957a25903a99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208763, "uuid": "fab5b2a5-8a48-4089-9705-5e2b8c5e3981", "value": "24576:PyraHYrP7F6Ys5au5ffWwiorQXIlvfFc+4cZz/Iaz4IzGjX8Zlijp0awl/Ws:araWF6YKjVOwiocXIVfFL4eI86XUA0aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695208763, "uuid": "db9d5d35-37d7-407a-9048-d48241ed9aef", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695208763, "uuid": "f44fced2-b42d-4cc9-8d89-439cf307fe56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208763, "uuid": "f7ce21d4-0a85-49aa-b06f-0776052a10f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a697666f-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695196780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196780, "uuid": "aae2e571-ec2d-49ec-851d-7e03dc219e79", "comment": "Malware payload (AgentTesla)", "value": "33f13b1cfb529173106ac3d5faf247a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196780, "uuid": "942fa4bd-4adb-400e-bba0-b1119cfb516f", "comment": "Malware payload (AgentTesla)", "value": "1d3af13724299c377941493a961676c35da6f70c36e6dea9d29fe8f10d5cd996", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196780, "uuid": "8c8dd688-f982-4d29-92cb-44da4c708878", "comment": "Malware payload (AgentTesla)", "value": "425a34056c0c756f666d383b4befb8aa12b849e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196780, "uuid": "9e5ef3da-b4fa-4164-aa8c-a8b52b539a69", "comment": "Malware payload (AgentTesla)", "value": "7e9c9635e4e376a981d9fed00cd72f409ab3c56cc10b349b164fab8d5a6e682852b58947170bbe2ced98307da9400a3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196780, "uuid": "5a45cf6d-c079-4ecb-bba0-1d99f3b519fa", "value": "T123E42304499C48F6F922CB3AC46026ACAF3323ABE16DEF78A40C59F2459735D7978375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196780, "uuid": "4f83410b-91d2-4f8a-96c1-e9e431db563d", "value": "12288:sHnW0abryvgpLCPNgKkGgB84qUQvA6tx6AEPzETUyp1kdj3zP7MZNrY1HQgmEXcg:qePyvgtCPNgKRG84qUQPtx6AozoUyAzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196780, "uuid": "61045dd2-f830-4ba9-8fc2-9872bb294385", "value": 711340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196780, "uuid": "35c3dbb8-00d5-46db-a528-e5638be34011", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196780, "uuid": "84c93444-75c3-4dc5-ac90-4d8f76236f99", "value": "Order_list_PO 184383.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baa4dcb-5787-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695194963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194963, "uuid": "8cc6bcc2-b99d-4764-bc5d-d43c532c3e15", "comment": "Malware payload (RedLineStealer)", "value": "c5d6567266ec96bef94d94dbf8559374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194963, "uuid": "f510e1c2-655c-4f5b-be24-05543a016df5", "comment": "Malware payload (RedLineStealer)", "value": "1d94b6ab75a41b8e5727b4c95471326f951d4e6df93e9534a9fb41445385f7e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194963, "uuid": "5e077de7-9895-401b-9849-561074dcea25", "comment": "Malware payload (RedLineStealer)", "value": "5f7ab39b413326a7baeca8c6cbd4ef7a0c68cd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194963, "uuid": "cd31ad6e-af90-4fc7-a48a-aaedf934204d", "comment": "Malware payload (RedLineStealer)", "value": "5e310509a4bed685f82505a93a1fe635673deef511db92ed55b6fe85e0a91a3745a21b143ea59292188d3aa38bdd0efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194963, "uuid": "f043fe62-d7d2-47cd-b516-4348b03fc938", "value": "T1DF652306E7E081B3DD396F707DF507132B31BDA25E7C9A196367A94E0D26580E83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194963, "uuid": "a61e11cc-d680-4524-bfb7-97900428bcf0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194963, "uuid": "4c054b57-a287-48d2-a9a8-9664e3465288", "value": "24576:mym+q8oaBw+k/grOFNr85BLjnrtp3iy2IiG:1MMeNr8DvjiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194963, "uuid": "8c795723-97b0-4b4b-a15a-b9f5a53988b2", "value": 1469952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194963, "uuid": "c2e2f061-8a4d-467c-a2c6-53ad9d8f8513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194963, "uuid": "55fc8c27-346b-4965-b821-5a67a19e8cb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f8577a-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229120, "uuid": "d3ade0f1-eb8a-4e07-a798-b88507747f9d", "comment": "Malware payload (AgentTesla)", "value": "86ec548550cced08a987c5c1abac565f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229120, "uuid": "a1ba4c71-8c82-4f95-906e-caf53f676c77", "comment": "Malware payload (AgentTesla)", "value": "1d9b10edd74d4d9722aa2e5156abff9f6214ce391321ced3f644a8dd844e552e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229120, "uuid": "d2decbb4-d03c-4c5f-8b34-e4daecf740bd", "comment": "Malware payload (AgentTesla)", "value": "46f30c491125c67423cbe2c477c4f5814afbd220", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229120, "uuid": "3598a61f-8afb-4d9e-ae93-1434359a9554", "comment": "Malware payload (AgentTesla)", "value": "642aa8bb81e2594e5c57e89758d90b6f12fd410c0231aec8e1a98846a00da044c064a450fbbe35e0f2db1c8ac518a2ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229120, "uuid": "ee2274fe-6c50-412e-a63a-ba8bb231e7f5", "value": "T1BEE423A5548C2D76C23F36965D20419FCF2266AF6D8DB4C36D46AD61CA86F8303F48EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229120, "uuid": "863c1773-84f1-4873-b80e-8d342f9fa4ed", "value": "12288:cfNjfMG3DLcF5YPROu7tEbJ+pUsSl2d7aiAXJjbb9pEMnjI:UjfMG3DLcDMROu7kJE42daxbNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229120, "uuid": "0be90ebf-9286-4122-aa9f-8200aae825a2", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229120, "uuid": "ddadf8e8-c68d-4c52-8392-374e200313d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229120, "uuid": "a723f411-4d21-4d09-92e2-e365f4ae3128", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129e3989-57e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695236904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236904, "uuid": "c55e7452-e463-406a-9db2-63167794d08f", "comment": "Malware payload (IRATA)", "value": "ea27a1e586242918416fd2d7c84e5555", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236904, "uuid": "5b05ac30-570f-43b7-867d-74375a7d255c", "comment": "Malware payload (IRATA)", "value": "1e6423a9e01aa7b73d2c64cffbc5f5e5f44360f38661da8de371c0035a167c6f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236904, "uuid": "4fc51a1d-66fc-4308-b9eb-e573b751fcf8", "comment": "Malware payload (IRATA)", "value": "e70bfea2ae1a6a3d666c5109da52f75db7217a0d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236904, "uuid": "9f2193cd-5c8e-4eec-bf83-4269ce7ab8a6", "comment": "Malware payload (IRATA)", "value": "ceb0d1fb4b96b046d0f246bea2444e2555b430a9c56195408fa3e6dcc54118830942a7b915fa2517be7ea17f7a328826", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236904, "uuid": "b8a116dd-d944-4de6-8c40-7e7f16bf515f", "value": "T1A9951263F361B91BC8F6D3722275163550774E188B47BB8A2D0877F928F7AE84B852D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236904, "uuid": "5b4aeeb7-7a82-42c4-b298-b4a1b8ba1061", "value": "49152:Q/XS2H1rZY8/5H25KpolqrBlOK5+yv3tvf:+C01r68/MgClfK5+yFvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695236904, "uuid": "86527057-e06e-4401-8f8f-f45dceae732f", "value": 1995502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695236904, "uuid": "9eb4a5ef-68f9-46a9-bc38-ede3c5abfa4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236904, "uuid": "77dc8974-8354-4daa-a332-5f833d160d14", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22653183-57b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695214167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214167, "uuid": "a4fc7660-89b7-4223-9124-715e03f5db90", "comment": "Malware payload (GuLoader)", "value": "30053c7f546cae21c4473b5629f92a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214167, "uuid": "dc4a9a30-cacf-4187-9d9b-e42564749efc", "comment": "Malware payload (GuLoader)", "value": "1e8890bfa6a1ad684a343377c1edb60e025f228a5ac3693e0c426d4d4ceb0675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214167, "uuid": "bd28dce5-bdb1-48db-b917-61b8a29f5fd2", "comment": "Malware payload (GuLoader)", "value": "62bff775f92afa2b1ce27f139f1181cd082c7db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214167, "uuid": "ad2274f6-647a-4159-b2ff-9a0f93fd1833", "comment": "Malware payload (GuLoader)", "value": "5475ca740aa7e08bf9317580e509c869b4d1a0901f0ef998994a5056e7de49f657159191744705fb030f148ad1204260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214167, "uuid": "407ab068-5580-4cdf-a08c-6ab67e136961", "value": "T1B34533139464DB33E3B591F17ABA2F1ACD82DF5410F679A31A10B7D1DCB09B4A91F282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214167, "uuid": "f40b4650-6e71-4f5a-9d9f-1ad9d7fc429f", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214167, "uuid": "901dbfe7-bc39-4252-a636-1f4507ba3377", "value": "24576:3awpunhEC4WOfFr++qiOKpTnDeSsp1jQW3GwiAtsp1kt4KdAZJO3FqdPH5oUPhO2:qw+i9rtsKpTYpyW3GwY6tMqOzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695214167, "uuid": "3886baf9-fea2-4e10-8efc-da001fe4be09", "value": 1209504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695214167, "uuid": "9c54899f-5ecf-49e2-a0af-3bc5045cae41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214167, "uuid": "03157dce-c241-447a-b063-f600f9ce0d8a", "value": "friluftsbadets.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8bc803-57fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695244308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244308, "uuid": "1ed5de9c-cc16-4793-ac78-f3785e3b3fc1", "comment": "Malware payload (RedLineStealer)", "value": "bd619c2eac464daef651344ce2d88847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244308, "uuid": "7bbf1f53-7f92-4f19-80d6-9b0cc679a8a7", "comment": "Malware payload (RedLineStealer)", "value": "1f2fd9f5bd935796629c5a50dd8dada92992a2020aa41c2db444630ca2ba72eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244308, "uuid": "7e3d53ab-385c-458e-98b4-72af1fb74106", "comment": "Malware payload (RedLineStealer)", "value": "54e5e75aff9f8672facf8d82efdf4ebc3e9044f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244308, "uuid": "80f6df9b-274f-45fc-a6d7-be0b66995ebd", "comment": "Malware payload (RedLineStealer)", "value": "69fcecbfd45d1c5a0ef8cf05960e04ddae3c910e569f2b661bf788bcfc185296210f29e2a755f6dff5c04a85fdbadf8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244308, "uuid": "443cc5e7-bd6e-446f-8e8a-61a737930cdf", "value": "T1195523039BE5A097CDB107B018F617A30B3ABCF1882D436B1755A96B5CF3A85C97137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244308, "uuid": "d1d6c13d-83f6-42f1-a4f1-89400c00baac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244308, "uuid": "702e1928-0f63-46c1-83a3-34417dd0707c", "value": "24576:NyHtS9hAtuW3mXiT25itgMZkgdqaroNfBWV9u7JzAtOvU2z81yfrW:oHAvAgWaiT2hMZH3oNom7Jc+7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695244308, "uuid": "eb46904b-785e-4462-9e3a-591cb349ed37", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695244308, "uuid": "89f2ae2f-4c01-4f68-9b18-fffe02e0b5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244308, "uuid": "98f6d644-1cce-44e3-a352-b60aba6c688a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18eaf22-5762-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1695179242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179242, "uuid": "4ab26d7b-e92f-49f6-b27b-6b92a5c193c9", "comment": "Malware payload (njrat)", "value": "8ccf0e9fe704669ec176ad4cf61a142b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179242, "uuid": "f34ec5cb-8b9d-4905-af5c-b93f457d1e19", "comment": "Malware payload (njrat)", "value": "1fa639eabee2f78ff66149b47b990f4db00a91d36a3fbc5c087dfe56dfcb825c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179242, "uuid": "8442d102-3072-4080-b0b6-fecf3d7de58c", "comment": "Malware payload (njrat)", "value": "35709883d7061bdf7a141c009776fcf58c095621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179242, "uuid": "c938088f-986b-4cbc-9476-214bc838704f", "comment": "Malware payload (njrat)", "value": "88058231ff7795b1bbb0d3b796b8cffa73f7eb4086b0d507e3633443968efcff8ef799f9a159bc2053d7bb379f66718c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179242, "uuid": "e50630a9-3e85-4d34-971d-22af42390da7", "value": "T1A1E208067BE94225D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179242, "uuid": "c2281f86-e718-4590-9136-0f36e1c0f35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179242, "uuid": "4d570ad4-6bbf-47a7-8050-4298334197e3", "value": "384:I0bUe5XB4e0XaO3fw0Q0mS03AWTxtTUFQqzF1ObbJ:9T9Bupo55dbbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695179242, "uuid": "50619e82-9419-4301-9934-90735db52c5a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695179242, "uuid": "6875856a-fe5d-442a-b3e7-88f8c589487a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179242, "uuid": "0cb6a30d-06e1-4062-9857-32b783d98d0f", "value": "bPVg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1792c147-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695229182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229182, "uuid": "c2912e25-34a4-4542-a6cc-3ae897deed50", "comment": "Malware payload (Loki)", "value": "1237c14b97130e66bf3808f73c21b775", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229182, "uuid": "d01f2ae4-c3e6-473d-b898-41d4a8a7068a", "comment": "Malware payload (Loki)", "value": "2133f0ac020b4a6cb5299e2d4f3d9b019406ac5b4603a99b2cafb71635cda1bc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229182, "uuid": "b5cbe88d-deef-4ef4-a66f-88482f921a37", "comment": "Malware payload (Loki)", "value": "747586893298a758510d2b3ac1444eaaef415b9c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229182, "uuid": "21a3d724-bc54-4d9b-ac93-e053633d09a2", "comment": "Malware payload (Loki)", "value": "6aaaa5540ba5fec263d808ba5e00589d147660727569fca3f438140c00b8ffbdf9ae6829d291df55b59bc91c76d2f916", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229182, "uuid": "188a952e-e2f9-4f44-a2f4-e7013a7c8def", "value": "T180E423C4ED6A525BC3A9D2D36708F660C29777C4250072C9F747AE7EC279F6122A6238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229182, "uuid": "36693579-2d80-4929-bb09-e1b7e52eae61", "value": "12288:8rrza3vUNxlRm6dYEBjFABhvskW/LIABhjUJYA7MoBfga8s7whcqZL:Wrp/m6VjG/lWfUJYuMoBIfTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229182, "uuid": "53446e73-d377-43ee-8429-6d2663f36ad2", "value": 697277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229182, "uuid": "4511a22c-a1bc-450e-b5b7-6b1d3a745bc7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229182, "uuid": "acd8d398-ec1f-44d1-b1ec-5a357236bc8d", "value": "okwuggggg.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efced1fb-57be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695218807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218807, "uuid": "3c36d3df-1f11-4681-a742-cd439cddc635", "comment": "Malware payload (RedLineStealer)", "value": "9bbe11ecef4ebbae95d83ac43feef60c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218807, "uuid": "f651e04c-cd96-4b66-94bf-ef526225526e", "comment": "Malware payload (RedLineStealer)", "value": "2347c5507787d821a41598a79e5624934c6be9060923a86b89e80f4d3df24680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218807, "uuid": "31c9b6a4-51a4-4308-b5cb-c04ae7403ee2", "comment": "Malware payload (RedLineStealer)", "value": "612257a075b78cb63089a44b06c0ea80d2b85d18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218807, "uuid": "6cb228ae-69cd-42c3-8ed6-397825150165", "comment": "Malware payload (RedLineStealer)", "value": "c695e85286f37fe4720f29d099b879346c7b0d7f18ede57ac83221ec4f300c319c8b8e15d84ee8afc2a2ef21092c397f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218807, "uuid": "11a0a5ca-6f18-4f68-937b-f7b39cf7c270", "value": "T1DE652307A9EA5033ECB1177055F3171B1E39BDE04D748B6F32846D6E1873A848A7672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218807, "uuid": "0bb6422b-3ffc-40a0-9af8-d7f82642850c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218807, "uuid": "314eb6ec-0cc1-4cd0-bf18-6389bc4d2c7f", "value": "24576:rys9tsy9BWXD7mmcMMI+wBjEOlwaktMgVgDFek+l1JXT7kiOFNuapA+F8:em0XD7mCX9AamXC6NToiOFYj+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695218807, "uuid": "2986cf5e-cd67-47b4-ab6b-2b208c846a91", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695218807, "uuid": "cbe578d4-61dd-4042-b4d4-a5c8d9aef7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218807, "uuid": "231342e1-1275-4822-b11e-a46f7ee83f9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a568d4a5-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695196348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196348, "uuid": "95e6a4ff-8022-475c-8c9b-9b6b12608ac9", "comment": "Malware payload", "value": "7aca31dff2fc9faa22a8aacb59574f32", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196348, "uuid": "bf8f0d0b-0e28-47cf-8e84-941644f52c83", "comment": "Malware payload", "value": "234e4051da3bcd4075c554c27704db28d945d64b7440b198698a802d83bef9ba", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196348, "uuid": "d3d23537-80a3-466e-b0cc-d7a20b28304d", "comment": "Malware payload", "value": "e05b41aaf63d97b04bf90041990d23cb20137749", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196348, "uuid": "52d30d1c-5ab0-4eda-89bf-9c5a3cbadfa7", "comment": "Malware payload", "value": "eb7a38c2dc75253a69e89faf125d0a28d65d8322ece4c7c5c7980a3c71657f376574df9a29d1f6f969103ba9b5f24403", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196348, "uuid": "7f0f7ead-831b-4004-984e-a523b30ab942", "value": "T1F2243D06FDBB8AB7C248C7354EE65774F335DC458B2A071325D4722A3EF2EA17609688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196348, "uuid": "1b88186e-e6cf-48ee-8083-1e957f0cb2e7", "value": "6144:QXq/NdUrA6jRtguK7QLP5mDF0oQYn4X4i3ZIp7YmH49SE:DUZItYmH4UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196348, "uuid": "368a3648-782a-49d6-9593-ce4b567261a1", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196348, "uuid": "87634bcd-3302-4e93-b61d-6916b067227b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196348, "uuid": "49a42664-554d-40a3-ac1c-c700a8028247", "value": "\u7b2c23\u56de\u5bcc\u5c71\u5927\u4f1a\u7d50\u679c.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e17d8b9-5797-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695201893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201893, "uuid": "98689ce1-7e19-4f74-87a5-3f1801ab0ca8", "comment": "Malware payload (RedLineStealer)", "value": "8f6e2183c13e1821f245db4b3bea2ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201893, "uuid": "5824068e-cdf2-4e14-8530-836257099642", "comment": "Malware payload (RedLineStealer)", "value": "24bc5efacd107d9dcbd5436dc4e4291374c3f36081cdd37b177b104ee47c6e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201893, "uuid": "4f782b15-f5ba-4831-a7b9-f1840e2f7276", "comment": "Malware payload (RedLineStealer)", "value": "e6d0157ba4bf3ec62467156cbbf6fd05b8377fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201893, "uuid": "7314d020-b42d-4ab6-8a53-ea7d25383987", "comment": "Malware payload (RedLineStealer)", "value": "7cf703640fa83ed98c1c3697b9556ee544eec7f727d543189da6862238ca1e9a0a02c5dab72e5a461045220f88363ba1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201893, "uuid": "24b89aa3-dc88-45b9-b11d-8041d8e8cf61", "value": "T17A6523C69BEC0263ECB42F715CF603972A74FDD0AE79676F6601DC8A14E5646283072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201893, "uuid": "cde924d2-e490-4e0c-a204-a3b01ebaa11a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201893, "uuid": "36b783cf-0727-410f-88e0-f6817d17786a", "value": "24576:cyGwrW6boJi7c9XepZ2M4+HVgimYI4wQjZOKjR7izvBpuzBV5aMP5H:Lz6piw9OLO+1gimYIMOKjs73uzBWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695201893, "uuid": "776c6ce3-a34f-43a9-aa36-338f5613795e", "value": 1467904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695201893, "uuid": "8fd2e9b1-5d76-4d6a-b6d0-6612504d301b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201893, "uuid": "9e8dc301-5303-40d9-a730-52beca3a1bd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fade5e-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PurpleFox)", "timestamp": 1695196378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196378, "uuid": "904fdc08-99af-436a-b82a-b3be2aac281a", "comment": "Malware payload (PurpleFox)", "value": "eb9a4cf233789b96f940be0186a26988", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196378, "uuid": "0fb5cf94-7e71-4507-ae26-0205e2d77f05", "comment": "Malware payload (PurpleFox)", "value": "24d40ba4bf19e3cb942918eb8091ab467b11d5d737aef8e37cffc5306d0081d8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196378, "uuid": "a5bd9a7a-6a8d-42c6-b196-8edf0d9c62cc", "comment": "Malware payload (PurpleFox)", "value": "002a1cee740fa212732379d1f00dbcf7c0cccbf2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196378, "uuid": "b759a5c6-c412-40ba-85d2-a9ae3c9d2916", "comment": "Malware payload (PurpleFox)", "value": "c58ce9dba59dc76253dfc9b2285436059ff9de33b19ea64b552d8d251e7fbd850f83408f2c3825ce57b76b87ebb42711", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196378, "uuid": "f6c2e87c-f0c4-4147-9d80-9e427d979fd4", "value": "T1E4E5F22076D6C936E57E15B0266CDB9A40297EB00BB998DB63D81F7F19F09C20235F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196378, "uuid": "fb430b6a-e67c-4a72-8523-38aebba8475d", "value": "49152:irOlrXVVdWi59GUrSLzeaVtFUaQfqZ2jQbfcOQHe1XPVZNA+ta7Knc9vQXBlBKFk:xlFFrEYY7LXPPdHsGBlB8h24BKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196378, "uuid": "2c4f9dd8-2b69-406e-ad3a-2979a4e37374", "value": 3075072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196378, "uuid": "0b2838db-dd72-4b99-87a9-e4708e17a8cb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196378, "uuid": "0694fc01-f47b-4688-8ca0-85d9524ac1ae", "value": "eb9a4cf233789b96f940be0186a26988.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30c2f3b-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695195968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195968, "uuid": "664ec3f4-8224-4de0-84d4-c1a537b42673", "comment": "Malware payload", "value": "833826ea33f4735eed7e5e050d7bba58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195968, "uuid": "59e4210c-d7f9-477a-ad1d-1b653c50b64e", "comment": "Malware payload", "value": "262352476d70cc68f3323e99982cf3825b5f95cf401f5dcee2c5f5261512f8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195968, "uuid": "69e7c97f-eabf-43b9-9078-3cf0dc8fdc2a", "comment": "Malware payload", "value": "6d800d314f4a625ee2529bf0960f10bfeac6e86d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195968, "uuid": "c014ab04-ccb5-4f87-ab84-12391bd2569f", "comment": "Malware payload", "value": "c830e859ef5df403f67bd3dee4fe53097361349fd0b0f1b78299ab788bc80bc08a9cad77180bf0fe4e4d3f1445684a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195968, "uuid": "f2b21238-767b-45f0-a639-3f620d46f7e5", "value": "T143E53334166380E2CCBC5E7A0EB724CF55965EA5007CC47A37089CAF7F15CAA98E6F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195968, "uuid": "68b89feb-885b-41ee-8675-651fba2db059", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195968, "uuid": "25afc921-4510-473f-a51f-ac7706b55a44", "value": "49152:jXMxu8c3IFOmd83ml5hDR8+mPKXg5CFM4z+Op4yF3LMtW6HBOFE9Lk1pIqZmgmJc:jcY3IxgmlL1TlfB4yF7YwMUmgm+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195968, "uuid": "fc0d6eb4-dce9-4b6b-9d3f-eb8eb4f58a79", "value": 3212248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195968, "uuid": "f3d30818-7832-4329-b4a4-d36fac50e467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195968, "uuid": "7e8289e2-7479-488e-8394-fc5d0d0b8a09", "value": "833826ea33f4735eed7e5e050d7bba58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f08e38-580a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695251088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251088, "uuid": "8c516fa4-99e9-47f4-a15d-589dbeba3e0e", "comment": "Malware payload (RedLineStealer)", "value": "d14e353f3926f0673a673de5f436cd77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251088, "uuid": "35f43bd2-a687-4d66-ab16-62ed55a25bd8", "comment": "Malware payload (RedLineStealer)", "value": "27a3062b432b89e7ccab967f0e0d77dfbddd0c837ad65bca573d3545228a2063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251088, "uuid": "02b85e10-d2d7-4e67-bf78-9ad2cae46ebb", "comment": "Malware payload (RedLineStealer)", "value": "1f84d78b6a542c743539773df621aaa3828ef8b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251088, "uuid": "f33224c3-5100-479e-9af6-9ae6e27d6ecd", "comment": "Malware payload (RedLineStealer)", "value": "a07d5a8e99fc58f81cc5c6cc8172dcb48551bbd0ae7acb812407d018daa0a0a842050a11894ba550a6a74ed40ae1e96b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251088, "uuid": "22b7e052-8df1-421d-9452-ce722fdf2126", "value": "T1DE55238765D45413F8B423B049F707A31A32BD228DBDAAD717C9885E0D335A0EA7277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251088, "uuid": "08d6b257-ddfb-4597-bbbe-01af096bba98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251088, "uuid": "854cb611-7399-42dc-9464-c3529d896bc9", "value": "24576:oysPp/C4PvargVQreSsg3Ueqeri5WrYh3bgDD5sgenqvHnY2ZOy7CF74fn7EC:vsPpK46W3Dyqd38359uC42YyQ4f7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695251088, "uuid": "ec58f04b-cdd8-4d83-a783-0b0889cc291d", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695251088, "uuid": "472a88b2-4ffb-41dd-a8e0-3761395958b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251088, "uuid": "70d79efc-360f-4ac2-aab1-6db1747e32a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47618283-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695194472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194472, "uuid": "9a577aac-6508-4fab-b2ee-baaa74b14c8b", "comment": "Malware payload (AgentTesla)", "value": "f5914b0ef6ce9e1bfe68885d5f5089bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194472, "uuid": "9bf35bb5-4711-4a68-aa9d-516347d0faf9", "comment": "Malware payload (AgentTesla)", "value": "28b0099eef5f5d332587f51c404eaf582423c6ff199a4d6f41e7428f92245a41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194472, "uuid": "399057e4-875c-4bbe-8ff4-27d4cd9fc1ca", "comment": "Malware payload (AgentTesla)", "value": "704d1e2d27d1710d8f9b8bda8f6faa67d37a64af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194472, "uuid": "303aed46-74b5-4401-a490-44dd02efacd6", "comment": "Malware payload (AgentTesla)", "value": "faa4a1d83fbd6beb9a173ae83707fe5675a0796a3e62cae143fded7116d1f8283dbf21530f407bf4b55dd15df81fa261", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194472, "uuid": "f9d1b160-5fe0-469a-a13b-589e9fc83048", "value": "T1DCF48C0320EE9DA1C4D397710FC9D9665A86BCE35E5DA32F3B8132431EB9704712E6AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194472, "uuid": "a9869b72-da50-4638-97d8-f2c740508d98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194472, "uuid": "5cfbbb61-4634-43d5-8c7d-e75fcbdd40c3", "value": "12288:6Dc08bolxtBHOQMGK+N39VweLQsWHSQg0REVXKoxvIOs/ATCvq+Fv2+T7Jw1954y:MtcsKwjQFgwO5vIVoTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194472, "uuid": "07025cc7-2038-4de4-a077-684e463bced1", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194472, "uuid": "10b8121c-3f1f-47c9-88e1-eb77d6ea23a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194472, "uuid": "e50c667b-ba21-4414-ba3e-4550e70a1f15", "value": "INV01542.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a49b58-57c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1695219307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219307, "uuid": "3e59f6e9-fa1b-481d-a7a0-f1dfe3958763", "comment": "Malware payload (RustyStealer)", "value": "e8c1cbed5e7568d2649aca5024c4d754", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219307, "uuid": "dcf02767-8f2d-4e2e-83da-a57457003c2b", "comment": "Malware payload (RustyStealer)", "value": "28f79edfc5affb3fa8fbcb94e857577630397ab1b6574ef7813abbdf01c6bb1a", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219307, "uuid": "36eefb6a-40b9-4e54-9e1e-9df15accc9ef", "comment": "Malware payload (RustyStealer)", "value": "185d41c221a2ac38a8190f250a1d2355d12a29d0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219307, "uuid": "09b26166-f441-49bc-ab8e-5759b934fb0d", "comment": "Malware payload (RustyStealer)", "value": "3db4b6b68d1edcc464f3597e839e36983471270c336312771414ebe0f477f8432e299b350607199f4e1efe94dae2b434", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219307, "uuid": "1e20ab4a-5e66-402c-940a-dc7700700a15", "value": "T1B6B51262F1656921D80CCAF402F12EA502FA9EB0037B57D0E2B5B84F6973B7D6F24536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219307, "uuid": "fd6e0935-d068-416e-b8c5-37c41c72fabe", "value": "12288:N0SuaWyh0ojqM7v1SUKm+hGX+SJcWz9Z2kDrFv9A+i:NvvrXv1B+suRWzhlA+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219307, "uuid": "a8296232-219b-494b-8093-c9234bbcb173", "value": 2483742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219307, "uuid": "ec7534db-d871-48f8-8d0c-3c3b65e55cbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219307, "uuid": "06497324-cc4a-4d33-9f2a-4c7f0ff5ca7c", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984d9b70-577b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695189884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189884, "uuid": "2e82b916-0d4f-457a-bff2-cec670836239", "comment": "Malware payload (RedLineStealer)", "value": "c906f0cbeacdc5e49dfdf9cfbd175621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189884, "uuid": "6448c0d6-c29d-40a7-8313-a46fbb0110aa", "comment": "Malware payload (RedLineStealer)", "value": "2b35d2265e0214c08b32b3c3097fe9996a1a8fd96240189bc5f482f56dd1dd27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189884, "uuid": "0a5181a1-e500-4918-84f0-073ecf3ed64f", "comment": "Malware payload (RedLineStealer)", "value": "28586d911aa99bdc10533ce64e4c0197082abb68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695189884, "uuid": "61b8f2af-df58-470b-a2af-644695a8d43d", "comment": "Malware payload (RedLineStealer)", "value": "74f7d0cadb2f0ed13a75cb004ee9b9f025a9129ce16ce37da9bb9f273a458dce5ef4435505dd70bd76615ae9434cb6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189884, "uuid": "0d17b1eb-214f-48ac-ae20-ad0ed15919ba", "value": "T13C652362DBCD9473E5A6077158F293872335BC92AC34826F6B12944F59732F4AB32336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189884, "uuid": "af9d82bb-4886-44de-8a06-7f31204cb901", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189884, "uuid": "0904952e-8502-4451-a40f-1eece8be9849", "value": "24576:cyairoTK4Qyw9apiARvUUCnlWnEm1IrXcXPdRGnXatnFQ4uo:La1vviwZCnlYLPdR+XatnPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695189884, "uuid": "9e01f54a-624a-4dac-9150-ab0e392ef5a9", "value": 1466880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695189884, "uuid": "c919d8a0-1ad1-483a-825e-a675a6394e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695189884, "uuid": "cad6b8bd-468b-4cc8-89b0-749992eb49f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd82d0-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695199248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199248, "uuid": "2a0c39dd-c1b8-4e6f-aedb-d41581bca49f", "comment": "Malware payload (AgentTesla)", "value": "05b47818eb4909e6cf73b6063b4db72a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199248, "uuid": "0d3702ca-31a9-4f4d-ba54-f8b409f5cf1a", "comment": "Malware payload (AgentTesla)", "value": "2ba5d8e1c77dac550fd1b7d19174670a30da616780dbad4d386f6b9dc2121e9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199248, "uuid": "63e98d4e-3d3e-42f5-9cde-ed3aecef1e16", "comment": "Malware payload (AgentTesla)", "value": "04e0649b5501c4c33eff59313fab304861d490fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199248, "uuid": "0ce82f97-65cf-4114-a068-5ddcdf020a33", "comment": "Malware payload (AgentTesla)", "value": "6a1890afc714dcbf400fc1a24c87999aa982ca6d8371047e660686a1c6589b9ce2d7008d6ae9ee20c819ec7c3cbfbcfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199248, "uuid": "3aba992b-c8c7-457d-b4e9-d1f828e227fe", "value": "T1CCD4231837788F53D5AC9BBD2425280057B20A63F962EB9C0EC5F0FA0B72B75C91579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199248, "uuid": "bfedbe7f-0817-4f36-b88b-6c7a4c1d44bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199248, "uuid": "98a334f7-09fc-4775-9751-0c8ed7828aa8", "value": "12288:gGghsd2chHFpVyIw7D4Y/YQ0Ke2NhkP9gNQFvGPpMp3E5B64kzCfu6:g0dHlyI0X2WiqBMpSBRkOfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199248, "uuid": "5737b2cc-c8e7-451d-9813-840851f2fe81", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199248, "uuid": "20b6ab58-d79d-4afe-b56a-60e5614a6b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199248, "uuid": "2d70387a-dfb3-4070-9d21-6010e62d9771", "value": "PO - 753172 00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e9ea80-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229184, "uuid": "53f21e52-43cc-4dce-a701-a626a7f33737", "comment": "Malware payload (AgentTesla)", "value": "38c65979391a679a3778ae19b31ef136", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229184, "uuid": "6538dcce-561f-47e6-bd71-6ae2d5c3fdfa", "comment": "Malware payload (AgentTesla)", "value": "2bb973f392dca90074df33fbdc4cbf893ffe9dd14828e15c6bb2330f43842bef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229184, "uuid": "468be3a3-c396-4a9d-a7d4-ff6c8be1d7e4", "comment": "Malware payload (AgentTesla)", "value": "ba3233790f0bc26447a7ccfe5ebe3b40b11886d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229184, "uuid": "4a88c454-8bec-4acb-9797-d3ff7353969f", "comment": "Malware payload (AgentTesla)", "value": "1c23c72153caeae6fa5732aec95d64533efff903d6362896bd4cb4a85d3e870a1d0c41cfaf3a91064cc288ec9bb15114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229184, "uuid": "e513182d-d598-4ff0-be7f-e78f8f08dc85", "value": "T156D4239D2C6DFB01D6F7A5722BDA3A78062773AF3087D147A01DB2B91072F98A3D1815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229184, "uuid": "61209e0b-165d-457f-9e82-a76f831082aa", "value": "12288:t+2J7r4W2ToTz1dRqVFrw7GP9JAjuxxlA11bEaee+v6C4BysChrCbYXD:t+2hr4HMn1KVFrwKUiibwLv+VChrJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229184, "uuid": "6fbfadd7-d26f-4e47-9789-c9be1fc0d90e", "value": 644864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229184, "uuid": "62182b0d-0f8d-4c59-abdb-f21628b5c668", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229184, "uuid": "df4fddab-1ba9-49a9-b6e3-9d7613457aec", "value": "2lIDEOC2308-088562.pdf.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e89ed0-5794-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695200397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200397, "uuid": "a03ea687-cd8f-4be4-a7be-9642deae5f8e", "comment": "Malware payload (RedLineStealer)", "value": "caa76185dbe9e2e57f685cab45759e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200397, "uuid": "eefd7a11-26f5-4e8c-aa84-e01989d1c699", "comment": "Malware payload (RedLineStealer)", "value": "2c2e16802f2558832ab0c02dc09b5905463b19a8103fc4e5eb694f58ba088fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200397, "uuid": "e9d243a1-716e-4c4b-86d9-99800fea1c00", "comment": "Malware payload (RedLineStealer)", "value": "db13322e595aed53c499fdfa7f5a34d4939707ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200397, "uuid": "68e720dc-298c-4d50-b515-ef8f9614a39f", "comment": "Malware payload (RedLineStealer)", "value": "442551b841e510582c67d39109742b1a70b06e18a352ea75d2fdea1b76b89811919473cb0ce69abe05d2b64d8a4dd9ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200397, "uuid": "e43d1ffa-a889-4a1b-bd49-815892aad6a4", "value": "T185652382E2DC9535CDE017F268E553832B37BDA1E5348357335BE88F69636802562B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200397, "uuid": "0a91d0d7-3226-4b1d-ac43-7271b3429f61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200397, "uuid": "3e68814a-dcc2-49f0-a10d-70e751d57055", "value": "24576:fyzOw9UHp3bUopwVx8GHo88xW4HuLFtY9+lulC0r5Pp7L/a/JtoxaQER:qzMHhoibVupuWCt9Ppvaxto3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695200397, "uuid": "0b490b62-40a7-4de7-a4f9-8ad675487e4f", "value": 1461248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695200397, "uuid": "808729e9-9a82-4605-afb4-8f5e297ab526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200397, "uuid": "8319bb46-4177-4d3d-a520-937ea53a3092", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cae8da-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695195998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195998, "uuid": "2ddccd2d-ea99-411d-b2ce-441a8fa19959", "comment": "Malware payload", "value": "4266ca9ad0db7e8663db5be5c8170928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195998, "uuid": "a6343006-ae65-45a5-a529-63b58680f106", "comment": "Malware payload", "value": "2cab98e957f76ee0b71577440fed15c41318803f5c3e8e9bca9f3f2622ba6493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195998, "uuid": "e72c8a95-5ca7-4527-85ef-4839b784e599", "comment": "Malware payload", "value": "e3e80cc74cc04b096ba2e163322784cc40b1b298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195998, "uuid": "31fd62cf-17e0-4479-b666-d466cad247fd", "comment": "Malware payload", "value": "899ba5afbfaa1e059242531ea8b84993f6d9a56e3bcfd655035b7f3deb9a362dd5b25de0116f1462cbf4004e7de0a251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195998, "uuid": "18210ea2-686f-4fc6-a7bb-09306b2297af", "value": "T1FA95230276C9D9B2D13238734A354B11793C3D316B668EEB6398791EDD332D0A635BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195998, "uuid": "651ef6a1-4b06-4b84-b41f-d10ed799482f", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195998, "uuid": "b8db25a6-8d8a-4e38-870a-4c252c146927", "value": "49152:rLLcrlESak4OPj3p32a+9WC0FlvpL+pQJ3yDS:rkESaktL3p32atLL+WJ3yDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195998, "uuid": "f89e885b-b0c5-457f-869c-b958ebc2df97", "value": 1940547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195998, "uuid": "35d63913-133b-43f4-adbf-bf7ce7070c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195998, "uuid": "1eb889eb-9b19-4bb7-9a87-c6cbf69db48c", "value": "4266ca9ad0db7e8663db5be5c8170928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb2480a-57b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695213089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213089, "uuid": "468862be-efdf-4160-a985-02a28c6287f8", "comment": "Malware payload (AgentTesla)", "value": "e4dfaeb7ee5b3d01dd0ff54126c325eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213089, "uuid": "2618798d-7ded-4300-8bce-46fb27c13a5f", "comment": "Malware payload (AgentTesla)", "value": "2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213089, "uuid": "95291ab5-05ef-4187-ad65-83eea0b4e150", "comment": "Malware payload (AgentTesla)", "value": "e6435975d7435e5f34fbdb0ea131fc79dfd2f303", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213089, "uuid": "b779eb0b-d3b8-4d81-84d4-3aea59dac5ab", "comment": "Malware payload (AgentTesla)", "value": "950041cf224d320fd2d1b92fa9e93f488fc2f4f597c7a1fdb6441b6ab80c49448483c3a853e062e1b3ba903923d064d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213089, "uuid": "21324de6-52f7-462e-8af7-05114d40bb38", "value": "T1AD456A9C361135DFD95BCC7ACA982C64FA60647A471FC24391271AED9A0CAABCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213089, "uuid": "d26a271f-d5de-4ee9-b1e2-5c120e4ae8a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213089, "uuid": "a1e4843c-7b8d-4055-ad2b-7e998e196c6e", "value": "24576:g/1L51LBQ+R9ibYTFqwXpZJsLTnaPkohHm02I3bdP:g/ZDn9IGAMZ6Xem0r3bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695213089, "uuid": "4d59642b-ebdf-43da-9d7c-9a449a7984d8", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695213089, "uuid": "973c16ba-6d4d-45da-9255-8fa074de3110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213089, "uuid": "db22846f-3c02-4196-a298-70cb20469999", "value": "Arrival notice & invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9856d9-57d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1695228277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228277, "uuid": "4716ef17-d769-467a-9d34-ccf87471ade6", "comment": "Malware payload (CoinMiner)", "value": "e726fce32bb643902827af8126f05ad9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228277, "uuid": "e77bd65b-db9c-4d64-b6ef-87d25f8deeb4", "comment": "Malware payload (CoinMiner)", "value": "2da7ec7e791cdfacc5d24164fe9d74fd2123d4790bf64f3378573be4164c3da3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228277, "uuid": "cda8f80c-a38f-44de-bbd8-068fcc6132cf", "comment": "Malware payload (CoinMiner)", "value": "56cd4a1e3c542cf4e4f917d06abcc1db58e5ce79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228277, "uuid": "a1f996c7-d0f8-45e7-8009-c618e2a6c5e6", "comment": "Malware payload (CoinMiner)", "value": "393961d73f3bb66f95b63179be9f19046574e675ddc1b71b2debe801f8a5a53a6dc6d4ca81fd86ba3e2768d0b862c1d1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228277, "uuid": "2691349a-8910-4099-8e81-e5e0ff74bec7", "value": "T1337633FBACF287E1E4741571A635DA4873222B54A9E05D1FA245BC3B8A4C2E307B74F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228277, "uuid": "9060c16e-54dd-4858-a392-0237a1ebc60f", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228277, "uuid": "fcb0828c-26db-4bb0-98fd-91d0a9d458f1", "value": "196608:+oJ6O3UwxtOB0BGeuMieLesKAGUeR+SdYMfj:1JfnPjGelizsRbeZdZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228277, "uuid": "d5e0df16-b3e4-4b38-94fd-031bfd49e84b", "value": 7155728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228277, "uuid": "b987da8a-c5d1-412a-a82c-94803b9d7602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228277, "uuid": "d8b48d22-a4c9-4696-856d-bb32d215372b", "value": "e726fce32bb643902827af8126f05ad9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a396c8e8-57ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695225551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225551, "uuid": "a00bdae0-92b2-48e1-ac02-f9c48a625cfd", "comment": "Malware payload (Gafgyt)", "value": "8c217b9272605a6084d0111cf0e16125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225551, "uuid": "539b2c6b-28ce-4850-85b4-c10f50204189", "comment": "Malware payload (Gafgyt)", "value": "2efff9c33156cae7e2dda7a9dd566a63d82e915b957fc29cd255b8f29938f6bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225551, "uuid": "45fb10dd-50df-48ec-83a8-1aa76ef00600", "comment": "Malware payload (Gafgyt)", "value": "969ef02f57d468244d478841eed467b518ab8505", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225551, "uuid": "c7948cc3-5e27-4a19-a477-0615b2e60ed2", "comment": "Malware payload (Gafgyt)", "value": "1aef4d3fa40258e968e5ddb665ea382e5e839d491c1160df6eae525828c259956fa7c8b6a32c4c7c2fe59015f8eb56b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225551, "uuid": "0c16e859-be5c-4a91-9208-9b088255075b", "value": "T12EB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225551, "uuid": "7d50bd3f-33e2-48d1-8a55-bfeb0d925430", "value": "3072:2d0wKSAewzi+Xn+8Uhw6W+aPqJmDk1c8xF6KjW:bfO8IBLJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695225551, "uuid": "e01dd69f-d4ca-47fd-8df5-cf96187d9691", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695225551, "uuid": "c9693874-c2d1-490b-87cb-a467f095bfc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225551, "uuid": "9ab16938-ded8-4f20-98ba-d90601ce6771", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f3f1c7-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229197, "uuid": "54b8123d-2ebb-4359-8e72-5fdb3c278bcb", "comment": "Malware payload (AgentTesla)", "value": "03afe43c3ea182773181e931f36a2ef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229197, "uuid": "2096394f-5615-4222-871d-309077a61194", "comment": "Malware payload (AgentTesla)", "value": "2fc1b29501e2536956dbb90677c10a6bceb37b4944d39cf94ebf44f6f644baf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229197, "uuid": "531d6105-3ce6-483d-97cc-a5266d09b027", "comment": "Malware payload (AgentTesla)", "value": "3f9392cce4fd803fa767395637409ec8f450e1c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229197, "uuid": "cfcc732a-049f-43ef-afb5-ee8ef215a662", "comment": "Malware payload (AgentTesla)", "value": "5b589cb09f81a3b2eba77c0dea306b699aaf3d51f4fd8b4570d864eeb304e9c7e5683dbd415516b795d2226fa08c5e66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229197, "uuid": "9a55d79c-bd0a-4add-9821-b0217c93b3ea", "value": "T166E4236E848498E7CA7275728BEBBC683E47750860AEF12F5E26456FD7C3FC0405D80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229197, "uuid": "8e982a14-bba9-41a0-a10b-a8a3061f5fea", "value": "12288:vGnWIf8z3Jyx+Ujcha9NSEHNeN7IoqvHPwqEoJRZSeQ2NKk1ZMTQMb3O5H2QtB:ei3JoZjUaGMeNk5vvDzJ2ebXMTSxvtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229197, "uuid": "715a2ad6-f57b-49ff-b353-48e6b6be99e8", "value": 706424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229197, "uuid": "e17c4c87-15ef-4554-a77e-1262a2bb0170", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229197, "uuid": "e1895358-68ab-4adf-9866-736edd7a61ee", "value": "Doc_4982047-69310.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bde8ab1-579a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695203124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203124, "uuid": "6ead8fad-d4d0-4b10-8af8-e05d2874432b", "comment": "Malware payload", "value": "8032a47e4d3563b4f47d84fc63fd05dc", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203124, "uuid": "17aa6438-d154-4a9e-96a8-a776407106c5", "comment": "Malware payload", "value": "30bc286d51ebf70b480295ea9fd6f4df661732b97cc1ac87fbd060cc4132610f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203124, "uuid": "c63a4a16-3eae-4929-a735-742dab125901", "comment": "Malware payload", "value": "403a574785a0cd7bfc129b31cfa41aa588836623", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203124, "uuid": "016f0773-3adc-4bad-98b0-d6df7c97965e", "comment": "Malware payload", "value": "a914a728b5cd6e8a128ef58387e5bc4f0d633fd5048c15dec40844722bc3b678ad8eab17fbd79e5129ede1f8aeb5c25a", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203124, "uuid": "85a51e13-d363-4b77-bf9b-854b0195292a", "value": "T1E864F1DD80C8FD79C4C03A76DFA52527926384B392BB2D09B342F588862C456E87F7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203124, "uuid": "064ec896-3e5b-4cc3-a06b-dc6c279ab021", "value": "6144:QdHzi8BthsEZliEJKmNLZb58r1BjnyRCvvFsJgj3X4Ha5VQ1q:8HziYjPDJ/Zb2xMRMjnW2Qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695203124, "uuid": "5fc0696f-0b54-4904-b863-32d1b55dc61d", "value": 322495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695203124, "uuid": "136d70ee-86bc-4edf-9e7b-b10855c660e3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203124, "uuid": "70c508a6-2e97-416a-8864-a6e652a4035c", "value": "CS-44223 Availabity.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d3f7d2-57ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695238820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238820, "uuid": "44c06d1f-bc03-4f82-b283-b388e77e938c", "comment": "Malware payload", "value": "4de0852d1496c803b17e3990f0411c54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238820, "uuid": "0f9c1b70-d5d5-4e64-a146-333fc166f71a", "comment": "Malware payload", "value": "30dc937be20093d521ee5c56d25c3a822f53df4d98be08cfb40d27ad3966d7f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238820, "uuid": "9830b231-9c29-4935-9bdf-f5a6283b73c9", "comment": "Malware payload", "value": "380ce7f6cf778bc6d09f80b78efd07d34bc47701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238820, "uuid": "2a493fac-e2b9-41bc-92e3-5060bb05229f", "comment": "Malware payload", "value": "7d606f39b9300f2499391da1f3efb53111f9951c46dc07d57ca8ab35057c6431272f245d44382f233acd8a407365614d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238820, "uuid": "27ac40de-281f-43a0-bcab-02bd6bdecd9b", "value": "T1A0940221B6A3D432D0B6C038A834D6E16B3F383359B54A9B37552FAE6F317819F61316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238820, "uuid": "bdf41535-e442-453d-8ed7-aee423b3d82f", "value": "d13f0a4e1c3acd1a644a413a45b35009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238820, "uuid": "bdaf1de7-9297-4287-8a96-e9a57ba41c1a", "value": "12288:3dFqWfRO/xEuFsaEW55YMD9LBTysvXLXv8FVQ6:3dFquDaE8vB3vLEjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695238820, "uuid": "38e127a5-4002-42bf-98ab-aa274b57aee7", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695238820, "uuid": "08ff6ad0-d12d-4b5a-b7c4-d848b42d71f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238820, "uuid": "149fe8b3-912a-423c-be64-cf62d6107fdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775f16da-5795-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695200995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200995, "uuid": "8315dfe5-55b3-4bdf-b619-b96e4c4cceb4", "comment": "Malware payload (RedLineStealer)", "value": "ea05bd2055230899d6bcd306ea9fb700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200995, "uuid": "75ae6c8c-3676-4408-826d-8da139ff6946", "comment": "Malware payload (RedLineStealer)", "value": "31816a58b810162ddafb79da75983cae35195f9301ecaee35b75dba89f64ed1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200995, "uuid": "1a6d8c55-219f-4032-9168-e569ea7de7f8", "comment": "Malware payload (RedLineStealer)", "value": "9d0e7ba3ac031d282fcf8922ee2ef24be7beafe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695200995, "uuid": "e8c2b5ca-6e6c-44de-8f1d-42a3b3225f12", "comment": "Malware payload (RedLineStealer)", "value": "cd502dc1997aa3d0d426fdc25da38148b0621a2625339d3ba40c4cb5e749c82da676fd8f36f6da4c478c3550bffa100f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200995, "uuid": "a396d09d-0cd9-4a82-8b4f-6e6a29364370", "value": "T1BB6523537BEC9172D9B627B008F312672F32BCF28878569B1351C99A1DB28D1493273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200995, "uuid": "3acb3e6e-a70e-45bc-80b3-6414948833c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200995, "uuid": "637ac32f-855e-426e-a202-60ea27c95928", "value": "24576:EymVJEXetaMY9FLfL7k9PF6fnmaejUaXIMzKqrn0XWdkOwHABJdR1t7W:TmVJKetuNfM9P4n7eIBarnaWdkUnP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695200995, "uuid": "3ccec8cb-fe9f-41d5-a1b6-f4d96bdb4c12", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695200995, "uuid": "e95b7866-140c-4fa7-8066-54df3f301df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695200995, "uuid": "52993bfc-21a1-4eda-ab96-962f2f9e22be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1302021f-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229174, "uuid": "37b88800-dd2f-4da8-8589-fa394f329fc1", "comment": "Malware payload", "value": "f69c752cf4cb5794506d4bce7f221267", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229174, "uuid": "0c775bac-b2b4-4ba7-9a9f-4a3fc721d884", "comment": "Malware payload", "value": "31a4e8c09dcef76e44fb85ef8ec96b36d5b780ff7fc53eeec306b60ad0505692", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229174, "uuid": "75150dac-2e51-4e76-b701-fbd68fbeeaf1", "comment": "Malware payload", "value": "a47997fdb1682470324b82a405c45aa3a63a2a8d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229174, "uuid": "6209087d-b80d-4be7-9102-453d24d49384", "comment": "Malware payload", "value": "2dd83cecb35dc33e1c39dda75a4f518808db666f0f3336897f5aeed5f4bfbd43a6c8cfaf2ae41d434f4328d89b4e9090", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229174, "uuid": "77a61acd-6c2f-487b-b841-b507dc3bf768", "value": "T111E423875646F29BC6F13B73E864B378A439FE35CA01C43CBD7088D65858BEC6254E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229174, "uuid": "b5c39236-4735-445b-bbac-8ec74f32844e", "value": "12288:5KnWgPEsUJSZRD/XszvYZJ6LWYhp4i0rY9Nya3kF0tcb1m7MLxduDQBlCSrT:E0stL8zgZJ6LWP3Yn3Hcb1/PuDQWST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229174, "uuid": "cb7a554f-9327-4cd8-a516-71b4af5159dd", "value": 674210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229174, "uuid": "875af2a2-d459-4c4b-b938-d8f887e40f95", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229174, "uuid": "b2770f29-c5e1-4212-adf2-c7ff1fa5ba05", "value": "Ordini_clienti.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3f4761-57ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695237675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237675, "uuid": "eb033ec4-7ed6-4a55-a216-79f28ea5dcbd", "comment": "Malware payload", "value": "80e31cf4b69e4f9ac0769f9a6e0b26ab", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237675, "uuid": "8c95a8ef-cc45-440e-9aca-fa3a022cccb6", "comment": "Malware payload", "value": "3257f287c754b0492d21a185b579fdbe6c5d3ae7cd599a1adae049eff96d350b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237675, "uuid": "435e502a-afa9-4557-bcd9-b9b5cd879905", "comment": "Malware payload", "value": "d21ce34a0cf90805bfe5c878c8410a3ee1900461", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237675, "uuid": "9c44d98c-da5b-47c1-b859-48de799e8a80", "comment": "Malware payload", "value": "e5ffdbe3f460aad6f6ebd9b343a078015620a3369a0ac4d044ce706a964d35298aee592a882ac6b429d17307f3b9b786", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237675, "uuid": "73be4294-5cec-4638-83ce-16b792bf1ac5", "value": "T156D52353F2A6751BC836C13334452A3A22065D19C902BF56392C7BFA2BB7DEC4F846E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237675, "uuid": "7b76d38a-a55c-4252-a461-1fba33c01d55", "value": "49152:Is/ikkp7XQop6qV6u/NkkFl9mzHxVHc98L9DVFk0GCm1TIZZ:1ikkpXF5V6u/GcYL3HcaL9DZGV0ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695237675, "uuid": "3a95b222-c23c-435b-bfb8-61b213b7142a", "value": 2764927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695237675, "uuid": "ebe5572b-04fa-4a70-8d4f-7dac82afd08b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237675, "uuid": "8049d5bc-2f04-42a1-9cde-265ca2ef3ca3", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12de831-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229037, "uuid": "36520338-6db0-4b0e-a35c-44cb79c019ad", "comment": "Malware payload (AgentTesla)", "value": "a20b5ad1e3f78ab76c922c4108ae8729", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229037, "uuid": "f5e41b88-effd-4934-9c41-141ba18fffe9", "comment": "Malware payload (AgentTesla)", "value": "337ce11e758631b9327321060bea40342ee175113d93e8d293a6e6d08d008509", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229037, "uuid": "28651126-5f77-4ac2-955c-856c994bb236", "comment": "Malware payload (AgentTesla)", "value": "7255dff14fae119677ca2976900bdde79316a5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229037, "uuid": "d41e45ea-7ff4-4863-b603-d913b2a96df8", "comment": "Malware payload (AgentTesla)", "value": "9a95d73a8649ef3872ca612a87250333416728b2bf83173064cbc6a3e1e04ca92fc9787a76f62f1ed6b2da5fc0c4136b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229037, "uuid": "8266c783-3a25-4510-a14e-08db3d3fc5b0", "value": "T1A9F4F0203A6CAFE3E67A13F54294884513F6611A603EE7451DC778CF3AA1F908F52B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229037, "uuid": "79359397-1a40-4121-87af-b1c94777dbca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229037, "uuid": "7be6010d-5e9f-4613-bc5e-c894415ac3da", "value": "12288:adEUY2iNtyYpQgBpVlaW/n2KvtHWjX+4mhh8GeZ7qNTHsZsdaNH3vHw5K9iE:JUY1+IPDjOKtWjXuk30pMZs0x3vQ5KME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229037, "uuid": "daa42fe3-0c30-4e5c-a5c2-00b54f8cca90", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229037, "uuid": "6dc794ec-bef7-4f11-8dc5-5938b308acb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229037, "uuid": "ae6e4e3e-328c-4aba-b586-ca53e44e25f0", "value": "DHL AWB # 2343881396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a0957e-57cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695223999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223999, "uuid": "d2abd548-20f3-48c8-bcb9-6902d625c87b", "comment": "Malware payload (AgentTesla)", "value": "f94352fbf5c90bc56a3c16aa9ad99cc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223999, "uuid": "c69fa2e6-2a77-4286-a023-5d3d55c0593f", "comment": "Malware payload (AgentTesla)", "value": "34b9610bec1066c97d3b46b0775013054f6ee258c3400f533078f5c7f6e84c92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223999, "uuid": "fc01de4f-9f55-4a28-b652-0d3c8e7e90df", "comment": "Malware payload (AgentTesla)", "value": "c194d9d31ff2b99a20c05b5aed910d9f5cee2f0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223999, "uuid": "18b02d80-bb20-4ae5-8d84-94a61a4b9ff6", "comment": "Malware payload (AgentTesla)", "value": "c4270d2ea6a423a0724e8f7125de6e8efb0b95dd5b241b78ee457ef821e55231009e185f7b46473a6fa82f5b0f861c94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223999, "uuid": "ae698b6c-bed9-4924-88b9-7378a722c4b5", "value": "T1E8D49F2572DF2686C77AA7B10BD1AC6F83E9F167671BF63B3ED105864621F408912332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223999, "uuid": "da13647c-d43d-4ef1-afbd-d729f65b38a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223999, "uuid": "7d091c7d-93eb-491e-956a-457ae0dbed83", "value": "12288:SUfRebGBg1PmXPw06H296VJeVGihHxKGz59vb//upjRAAzEB:zEzEXPw0y2eeV/txKGz59vb//upjRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695223999, "uuid": "19d1fe09-897d-4767-b0da-f9d916eac3ae", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695223999, "uuid": "28d1c581-747e-4776-b595-654c549abc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223999, "uuid": "5f363c51-62f9-4c3a-82f7-13be6c6ace62", "value": "TiWorker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2fc4e5-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1695229033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229033, "uuid": "ca84cb6a-9f20-4b50-a9ee-00a192c63790", "comment": "Malware payload (AZORult)", "value": "9fbef348c8c0558a2f192df83d0c4437", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229033, "uuid": "45307fcc-2b0c-4083-b556-4d404b476ba3", "comment": "Malware payload (AZORult)", "value": "351db39c3affe720b1666ee7fea828ef85c9801c403f8f1e0e74998450c6d9ad", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229033, "uuid": "14fa6dba-121a-4104-bf71-a67dccd2e40e", "comment": "Malware payload (AZORult)", "value": "05ec32a1d41c3c3e1ee696347749797bac1c9bab", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229033, "uuid": "5b57515a-6719-4e35-9ef1-343d51ecc3a7", "comment": "Malware payload (AZORult)", "value": "2c9e1ffefbfd36c0e675dbdbb064f7eb3daaf07142b7b2af9c6a682c638821364d8c35f89cb7511465b086824c24fe04", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229033, "uuid": "574c866f-93a7-464f-859e-8d4fa26f28ee", "value": "T13B9402617B90C81BE3C1823098B9E399CE75ED2C5D6B4617BABA779DB1343A48C1D302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229033, "uuid": "280846c2-ec68-44ba-a8b2-faf0b5649544", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229033, "uuid": "1b0d28f7-92ce-4871-82a7-04260b842926", "value": "6144:xB+pgUvsgje7ILkbl3XD/wO5V/GqkerBON1VnWjC1aLgPzVdin04tN3p:xgnN+4kZXD/WgLgLVdyNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229033, "uuid": "cd43fc82-e0f1-414a-b018-70a21bf0e7d1", "value": 423748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229033, "uuid": "5b52273a-8b8f-400f-8a33-4392bfc79cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229033, "uuid": "4666867e-e70f-45ec-b98f-9c791e34c9bb", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dc3001-57ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695210891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210891, "uuid": "ea4a501b-82a4-4004-b3a8-c38be9c07652", "comment": "Malware payload (Formbook)", "value": "0c06e2d9bc99eb6f52181947e7cf8402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210891, "uuid": "be18dab1-3a6e-4fb9-ad3e-90697cfeabe2", "comment": "Malware payload (Formbook)", "value": "36efeab6abe9d95c0afcea27c287326c8527cc1a5d413dea1c7a8b33e6911df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210891, "uuid": "40391edb-6d9a-4a14-97e2-d5ec839bc6ab", "comment": "Malware payload (Formbook)", "value": "33ac71949e778fd14f6b3c3abd974e82e7848b6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210891, "uuid": "742760bf-e532-4b78-8c93-0b36e894a4b2", "comment": "Malware payload (Formbook)", "value": "50b81d5f5b839db1ba8d5237f692682659c68365bb25cf4dc8a235b4a88eac8a86bc2baef4b1f7eac3791da7b55298fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210891, "uuid": "53989a6a-e8a7-4c25-ab01-cda9baddbd94", "value": "T15C4533038269E333E7AA41F2DEB61E1ECEC1CF5A11F866531B01F795C4B09F9AA17152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210891, "uuid": "edaca208-7734-4d20-b751-03ea76e12ab3", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210891, "uuid": "38a5d26d-90a9-41ad-9a54-9065805aadd3", "value": "24576:P4FesTvMzSr++qiOKpTnDeSsp1jQW3GwiAtsp1kt4KdAZJO3FqdPH5oUPhay:wFpTJrtsKpTYpyW3GwY6tMqOzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695210891, "uuid": "a6f1de9c-d976-4627-83c3-d4c7ef35b72b", "value": 1238504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695210891, "uuid": "01de831d-7174-4d6d-9f67-9b3087950769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210891, "uuid": "0cc530a9-7c70-44fd-8c25-52b84a781fe1", "value": "Holdnummer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ec5215-57f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1695240648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240648, "uuid": "aa0fb4a5-56b9-4fc8-aa4b-5772e1d32273", "comment": "Malware payload (RustyStealer)", "value": "8c7f9e2e1533bee0c53f494aa84b0d3d", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240648, "uuid": "86f5c9ca-dbf9-4cbd-aeaa-10cbca7483c2", "comment": "Malware payload (RustyStealer)", "value": "37bba90d20e429ce3fd56847e4e7aaf83c62fdd70a7dbdcd35b6f2569d47d533", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240648, "uuid": "8ddacca2-6c1f-4efd-9415-b10a4e347dfd", "comment": "Malware payload (RustyStealer)", "value": "718f0861dfbd06cbac887a6aa9f912797d3aaa78", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240648, "uuid": "2cf94851-0410-42b7-9c8b-2a4a6490c856", "comment": "Malware payload (RustyStealer)", "value": "7219de279454f72bae57dc8eaf9b0875a1a27af74ed03716e12fc4d4fec8bff84a91bc7fa4e13c6249e077861778252c", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240648, "uuid": "a3790de3-bb51-40da-8fb0-21a132bf7d98", "value": "T1DC1712C7A6D941F8C483867065462396F5907C8E8679A52F3ECD3C022B31EB7960EB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240648, "uuid": "72940d44-2ed6-4ea8-9b7f-f215cd5256c1", "value": "de79444535980bb1ec949331a1b89433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240648, "uuid": "963d16af-b2ff-47ec-bc87-81b2f338efad", "value": "393216:IKmLEgApAXnTJS+s1+ujmg8L9lfIkZscsE:IxLEgApAX61jag8L9fZjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695240648, "uuid": "75eccd5a-cd01-484c-8ccd-7bc0427bf8d2", "value": 19564584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695240648, "uuid": "2b2783ad-ab96-45bf-aa5b-dcc652f0bdff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240648, "uuid": "1725e001-3ad0-4476-a463-86cc1167a038", "value": "Chr\u043em\u0435S\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20825e7-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229521, "uuid": "e8931471-087b-4bd0-903d-b83879c1789c", "comment": "Malware payload", "value": "3063922264a20fa659f41f66a1182113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229521, "uuid": "41e6fa27-ec5d-4a67-b562-79d8ffd0ba71", "comment": "Malware payload", "value": "37eb8e4c06649578148463c37e23d610284f8b75d986211b97094a178006ef28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229521, "uuid": "163d8fb2-4fed-44fb-b426-de530b13db0d", "comment": "Malware payload", "value": "b9265bca03fa0c37708737b9966ef2dadacd80e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229521, "uuid": "62be2363-03a8-40d2-a8f3-54366285f135", "comment": "Malware payload", "value": "ba2c43115374f81ded2e490575fbfb87fe124de74f94a0f7315c5e530c2ffea37f5e8beb1de024dc25e4a789818e6436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229521, "uuid": "de0b99f8-159c-49cc-9571-0992c812ee2f", "value": "T150F4BE02DB5A53ECD42AD07063662B367770F895036857EBBE5C46660F61EF0BE3A348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229521, "uuid": "10dce741-1317-4632-a871-671f569466d5", "value": "6144:xrAxu90Iywvzft4KbSINnrKt64ZY0kJWLJA1Rftr8RMk:C09JD7nNnrO64ZY0kALJA1Ftr8Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229521, "uuid": "7b8b2b7e-5456-4392-8dca-4f76b4629d03", "value": 775776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229521, "uuid": "d5b91095-e417-452b-9d4f-7ae7b1e3746e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229521, "uuid": "b63a6f6f-e3de-4bf4-80b0-d787f1af70ca", "value": "Nepal.rtf_Client.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0ddb02-57a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695205966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205966, "uuid": "135a7418-9580-4b4f-af9a-b54887aaf62c", "comment": "Malware payload (RemcosRAT)", "value": "79b7474ded312cda4a0bd477ddf78378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205966, "uuid": "1ce5a931-e613-4489-9217-67394d0e301b", "comment": "Malware payload (RemcosRAT)", "value": "3880c8403a1377ae8bbcc6f782e51839364c9e2e9e29ea9a02d011eeefd51d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205966, "uuid": "25eebd2e-6485-4b68-b127-3eb325d7a6d7", "comment": "Malware payload (RemcosRAT)", "value": "34c845c09dd73bd4bbd5b8ee6ebf9c9b3e6ff846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205966, "uuid": "d75f43f9-7eb1-4cc0-b322-54981a739f73", "comment": "Malware payload (RemcosRAT)", "value": "dbd27401c37f9f98652bc2de713d2dfa92a8913ec1c1b9b5ca1c8a45d40435364cba267e1b1d55db6d6817a2f61653fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205966, "uuid": "0d032f83-6ff8-4536-a23f-ef5b26224795", "value": "T117456CD192144BB1F6160D3E9CC6BAB54C24BEE36E0C5A4942A46CBD19BE7D1FC28C4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205966, "uuid": "96dd2ce9-bf3e-4649-90ab-36cade759687", "value": "48b10491a087916b8cdb741cb4ec7517", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205966, "uuid": "e8917526-b328-4f7b-bd62-8b23abcf7418", "value": "12288:QQGIc/IHeXIZ7dF+Xa4IkmeQ+rp6pBBFKxdLIJuVvFTqlCtop7p7R8H9xvUincHL:Q3Ic+ZzOFcfDcchpd+Y0MSiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205966, "uuid": "55987863-d69d-4284-a5df-d0fa86ba1ba7", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205966, "uuid": "232921ff-13c6-4286-a02f-13e8124b2047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205966, "uuid": "52a47107-0939-4ab1-8d7a-32a7a1cb0dfa", "value": "SecuriteInfo.com.Win32.DropperX-gen.32519.20128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e52ba09-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229193, "uuid": "22b2689f-91c3-44f1-9f97-c081ab7e0126", "comment": "Malware payload (AgentTesla)", "value": "8cd14d38da24b08fd6fbba6c49120146", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229193, "uuid": "1d747c8d-ed09-4f85-ac73-38ba4ca4d171", "comment": "Malware payload (AgentTesla)", "value": "3b1a9c9358e4e0a6106b1176634969d6e3372cfa1e8956bee66ea90c02e2b65d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229193, "uuid": "8d8d9963-0260-4921-bec2-7ea11d15da0f", "comment": "Malware payload (AgentTesla)", "value": "a1022f005018e73eee75ecaac209c1ab6f488763", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229193, "uuid": "5f22ed07-b395-42b7-a211-68453a29fda6", "comment": "Malware payload (AgentTesla)", "value": "e75794370cd0587e4856a7cb989f97e4d6dc7e6879d03fa8e9a621daa31e8b332d70c2a7e1e16d671273b28cec9562e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229193, "uuid": "d9470bc0-73f8-433c-9791-e29963a20a4b", "value": "T1F4D42367F8F8B747D5A1D90AD4B9C00FBD912B843104C44629BB0375AEDEBE825ED24E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229193, "uuid": "061e689f-9ada-45f5-9eca-5a5b7fe85519", "value": "12288:cSyr5u+ZvX3bgpCUuLqBN9PbyGRdFfF0ismqhZYpGmTpz:ZELvneHFRGGfF90isp4Tpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229193, "uuid": "3f23bb87-8f97-4ca4-a6ca-830c3afe452c", "value": 610765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229193, "uuid": "3f5d8f76-d38f-49e7-9fa5-5c611d11c60c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229193, "uuid": "e3272b5c-9bd6-4fce-9804-d833e5c20d88", "value": "IDEOC2308-088562.pdf.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b67bd7-57ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695216834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216834, "uuid": "d8dc5a8e-4e67-4738-be9a-9ee03e842f8e", "comment": "Malware payload (AgentTesla)", "value": "aa8c14edf65d09f549ac88306d2e8610", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216834, "uuid": "49519fbb-f114-4360-9141-8bdd269c6448", "comment": "Malware payload (AgentTesla)", "value": "3b6a3c3e882e95192ca46c020d2651800671e59816eb9aa0cef15cabdbfebfe7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216834, "uuid": "19ea9d30-9bf1-4120-87bb-bf418881cbeb", "comment": "Malware payload (AgentTesla)", "value": "b776503f9b3669b29e825e196005a3689845c823", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216834, "uuid": "17c664bd-a3b3-4090-be7d-cab342318714", "comment": "Malware payload (AgentTesla)", "value": "3259b8c21ac422d989f2eb57c3af5f74b37ab97627a7efe35ef1b25b62ce5932c1e56ead7b6617fbf677502e9cf78f73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216834, "uuid": "10d14630-a90b-4726-a965-6159227008fb", "value": "T121E412527BBC6B1AC5B85FF5B4E1341103BCA21A34A0DBDA2CC670DB0D66B035755EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216834, "uuid": "f225d4b5-9d14-472d-8faf-f5fe0646a61d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216834, "uuid": "617219b7-93e9-4f74-9420-61827fface92", "value": "12288:iI2iNV1Uig+qH/WmGl1Pff2dGV2IGIjknt1cwBLsDz3M+xu:D1bhWHexHn2d62Iz2cvLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216834, "uuid": "59188f06-db8f-49fd-a522-3d88e7de8d92", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216834, "uuid": "e216d6eb-f6a2-4053-ae7a-b3f21f849ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216834, "uuid": "f0c42340-340a-4a66-8eb6-81c888b17891", "value": "wealthzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed8d4d1-57fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1695244817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244817, "uuid": "563cdfdf-9753-415e-9c7f-06481d175e76", "comment": "Malware payload (DCRat)", "value": "00aebfb4057ef1bb7c07d8eaf258762e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244817, "uuid": "8ef0c4b0-879f-4ea0-a27e-931c3597e250", "comment": "Malware payload (DCRat)", "value": "3b72db58e05ca2a0f1041064db06ce0786c33ddc2140b4a16a8866ea7767d89d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244817, "uuid": "6aa9bd73-1b16-4678-8e27-81aae42eb5fe", "comment": "Malware payload (DCRat)", "value": "cbd125e8f5228030997c54a411635b067312a9e9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244817, "uuid": "5f3b325c-03b8-4992-8fd5-81e2b34752b6", "comment": "Malware payload (DCRat)", "value": "6d6b4dc0d0ded06d7d9b7a847a58b72898a93e36c50ed00f7a1b0067b0064bec85d5555cb3497912e3f4190433fdc4ad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244817, "uuid": "a6723e7c-072e-41bf-bc55-f5f71a9949b1", "value": "T15905E6027E84CE11F0091233C6EF455887B4A8526AB6E72B7DBA376E55133A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244817, "uuid": "174c62e7-8e08-46c2-a1da-69f6ab5ff1aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244817, "uuid": "7df91557-556d-4fb0-a13e-8d08db3777cb", "value": "12288:Pry5S+sCrhurGWubLYJ6lx5JONPLknYV9LeWKKC:Pry5WCrhjWuvYEX5JOJkC9LeWKKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695244817, "uuid": "b8643efe-51cc-4c2c-9e70-3b6f7625cc48", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695244817, "uuid": "ca8181cb-bb46-455b-be45-056d45251c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244817, "uuid": "427d2772-bf48-4056-86ed-948530c6ee75", "value": "00aebfb4057ef1bb7c07d8eaf258762e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87709c15-578f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695198445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695198445, "uuid": "82b0016e-4a56-45c5-a417-266f2d8cc3a7", "comment": "Malware payload (RedLineStealer)", "value": "b6cab87e438d584a62ffc6a79e51ba2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695198445, "uuid": "ffb6fc5c-0bb4-41f5-b768-30dbb9adfbcd", "comment": "Malware payload (RedLineStealer)", "value": "3b7870b65227bcbbc9c5d71c50b214b4a5feb324afa62b1f1e75cbb422722666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695198445, "uuid": "4644ef0d-2ddf-4e64-9bc7-26f2bc2856ca", "comment": "Malware payload (RedLineStealer)", "value": "f602fe73458306cf8764fd3516d09265a21d1c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695198445, "uuid": "688eaaaa-07b4-440b-a9a9-d92668b89225", "comment": "Malware payload (RedLineStealer)", "value": "cac642afdfdcc8c137cd7e6d8382e38ddbafe05b7b71ad0e713b7a0958301ac7d79f8de915de6b38f17be960639b1576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695198445, "uuid": "83406bee-5537-4dfd-b5d9-e8bec8321440", "value": "T10625224725E84036D87157F459FB07830A35BDE28F75936B228AD94A0CF29C4B8B17AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695198445, "uuid": "be1984ed-5828-45b6-82fb-0fcb7c8b2f09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695198445, "uuid": "38f4adf5-edf8-4194-a7a0-081bb586b7b1", "value": "12288:gMrxy90nyU9A3JXW1De3saSzOHSCDb7FiElEyunB3FrLuP2zO3jFiRMmgfLzk:ByzUo5/3pb7FimGrrLuP2zOxqXgfLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695198445, "uuid": "38eae421-27de-48ca-89d6-ad4634425ae6", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695198445, "uuid": "d2054543-60d9-41de-8479-bf31be34395f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695198445, "uuid": "7c00ef3d-c441-46ce-9f5f-63687e552471", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23b249b-580b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695251775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251775, "uuid": "3550ddff-8cbe-4aae-97b5-56e8f49be638", "comment": "Malware payload (RedLineStealer)", "value": "c20282e6c697f68cbd28537b954ef0df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251775, "uuid": "504b2065-fe7c-4ae9-af09-1ebaa34d21ee", "comment": "Malware payload (RedLineStealer)", "value": "3c9d50d6791011c6b0c5e8496f6764bafbd43a7a5d7d066339f5d2934b2e92e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251775, "uuid": "2f3f425b-babd-43ca-ab0e-81e2c1758dbb", "comment": "Malware payload (RedLineStealer)", "value": "35ead9652b503f1a1743473720588435a59cb002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695251775, "uuid": "05784b27-2c2a-4438-8bde-f6f4f3b2acc8", "comment": "Malware payload (RedLineStealer)", "value": "11073532a0f27e7c24054494a085e551d3487e046a5cebbbda77c41c570997988d34f519212933a07de11d6a5796ce1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251775, "uuid": "c768f17b-a67a-437c-a152-5c2c77089c0a", "value": "T12E5523426BE88021CDB54B31C8F612D31B3E7D612D78DA1A2B495C490E73FE4A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251775, "uuid": "7f690811-f04d-4f9f-bede-319ce6c31a03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251775, "uuid": "a8906898-632b-4921-9f2e-e33387385545", "value": "24576:hywIlNj5I3yErBIjzzjoHx7FjIz6L6wVpIaEo6b/T9mgS0kJLhS:UwrvBIjyRwS6wuo6tmgS0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695251775, "uuid": "c81eafc9-b28b-4114-98ac-e7f05b413d52", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695251775, "uuid": "1d467979-a646-4dd3-979f-d8bd0996fde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695251775, "uuid": "4c1ead8b-b416-4512-995c-b09f03b2122b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab1fa67-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229187, "uuid": "0cfe705c-0ea6-47d0-950f-426486f63b33", "comment": "Malware payload (AgentTesla)", "value": "ff4afba38fca387b209a6058da8583ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229187, "uuid": "e43f66b6-55fa-45d8-b4ea-e6fdd529e9fb", "comment": "Malware payload (AgentTesla)", "value": "3cb021f727c306bcc8a733554521981f4bfd5e9b3e39d733d601e7a69291d602", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229187, "uuid": "2febfa8c-2e03-49d4-92e7-c2587d93e27e", "comment": "Malware payload (AgentTesla)", "value": "75118d306f18f4574018ad5d24e725ff3bee49b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229187, "uuid": "881bdec6-1b12-46bb-ac54-09b729aa5256", "comment": "Malware payload (AgentTesla)", "value": "f7c4c39f9306ae77ebded014faffbb1fe3f693b6b23e13d274edff7a0ad949d64d8bab7d8e242e547d3081886f490b5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229187, "uuid": "8493ff89-70cd-4dcd-aff0-432269bcc2ee", "value": "T167F433E3F15826FF33DE75272E975989A6A3381456FC34E584EA50C0E3374C63249BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229187, "uuid": "93ba7295-0be6-4a15-be09-98de280563cc", "value": "12288:5XSSaqxNzx5n7SpfzpUdyD9jLRa94nhI540WkaMzJO7njWCDeGT9zQPTL7B:baQNbSqi96eh0Wkb47jWCSY9zQbnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229187, "uuid": "83068f23-1f92-4b35-ba10-84cf4fa2db59", "value": 758650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229187, "uuid": "02eaa4dc-c0ae-425a-a984-8de00ed5714f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229187, "uuid": "749f4dd4-3dd4-41f5-b805-fae1eabad193", "value": "omo.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83de0a7-57d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695227706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227706, "uuid": "b213007f-29d6-46f6-b30f-aa7a2cf3209b", "comment": "Malware payload", "value": "c2ff5f37e9d84165caf721bc742e5f55", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227706, "uuid": "1275ad00-052e-403b-b87d-956aceae9e29", "comment": "Malware payload", "value": "3cb49f46c2a713ddd4e6f9b55a55c6db728c1d69ce3dee89c87a585de01e302d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227706, "uuid": "2e0e2ab0-006b-42b2-9e8e-c72c9f18fa54", "comment": "Malware payload", "value": "efc309b0785e63423124ff5df2bc6de8ff987249", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227706, "uuid": "c6ce30a9-048d-4836-bc36-8d44847dbdf2", "comment": "Malware payload", "value": "e2ec5268eeb8aec7552c93f9fd65b882b09544f768cf08dbdc1b8bb9ee156b9da71afe8a4d3b489ea3741a6ff3ff9aba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227706, "uuid": "1de0167e-4e91-4f20-8036-bf67867df10a", "value": "T13EE5BF44B697DE6BC3D46B3EA01741289A31DA0A7753B76F0F7E15343C923B809923E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227706, "uuid": "316b7802-1a88-48eb-b2d7-d73c8c50db96", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227706, "uuid": "8f75b889-bb12-43ba-b8da-95e02b14535e", "value": "49152:uiwAELCU9I8a3a92iLr7dpzA49otXeOqTcdrN1CxvPc8Qo5j:8jMiL/9ytOOIcpPOBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695227706, "uuid": "4f99d61e-107d-4fcf-a3fb-a046ace471f3", "value": 3251712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695227706, "uuid": "bb91c5ce-be4b-4291-b211-ac5bc5de9a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227706, "uuid": "37097e26-d2c4-452d-b547-62e17cdffc05", "value": "c2ff5f37e9d84165caf721bc742e5f55.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0663aee-5768-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695181764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181764, "uuid": "cd354969-2dac-4183-8ec2-ff8af553347e", "comment": "Malware payload (RedLineStealer)", "value": "9c4b27a5023e7c1a6de8bd35d01772ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181764, "uuid": "3f454e36-642c-4f87-bd25-ec771391f10f", "comment": "Malware payload (RedLineStealer)", "value": "3d78eacaccdeee557859472069adbdfd390e1d40bdd24a0590fae43a3085673c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181764, "uuid": "fff7923c-50d9-4ff6-b8c4-89f6d1e6bb50", "comment": "Malware payload (RedLineStealer)", "value": "8fac05bc53771adc612baae8f57a638b19dba0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695181764, "uuid": "499e50dc-819d-4e79-bc57-293d053a9bcb", "comment": "Malware payload (RedLineStealer)", "value": "35e0764f4eda41862aef4482c4dad5ec788a208081f96b19bdf06146101804623b6d8c8c591382b03e350be5ef4679db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181764, "uuid": "ed4c48bc-9b28-4395-b894-6f9d86ec0f1e", "value": "T133443B10BD87627EE1EF4DB7205475ED9E1AB321B962240DD2490B944B72FB273383DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181764, "uuid": "d786cfc4-0f5f-477c-93d2-3cc8a22fb005", "value": "7d58456b6b15432f9282ed276237c7c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181764, "uuid": "ed9b95f3-2dfa-446d-9048-2e9eb5cb121c", "value": "6144:dd6acHV9YRnPj3BuqrCJPdvkfS4RBMD1IDnmY3CdlWj:doa3NBslvkfS4RBMD1IDnmY36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695181764, "uuid": "525fd4cf-109d-4067-a39a-b34b2925b4a1", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695181764, "uuid": "d4a75429-12d3-42fe-967a-83cafac42530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695181764, "uuid": "96d327a4-43d6-45dd-bbed-4e654040c879", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134e81ee-57f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695243348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243348, "uuid": "2299f01a-eed8-487d-9075-f656d998ecdd", "comment": "Malware payload (Mirai)", "value": "16dfae9d0de28da0743ad795c9c442ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243348, "uuid": "f2079f08-b036-4c97-8387-fbd8a40909bc", "comment": "Malware payload (Mirai)", "value": "3e63d29cab764c48c497e2737f2db5991f908dff05a0ba4f2569b8ca0afb2eb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243348, "uuid": "5aac583e-9e2f-485a-9143-69f3976bad48", "comment": "Malware payload (Mirai)", "value": "709beae1472d23d89ced08f538e6814792e823b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243348, "uuid": "594bf107-c49e-442b-83ac-2460563a79b4", "comment": "Malware payload (Mirai)", "value": "208aa6da8ee89d4b9d07231dc88f5eea9435c2108f259d1a2e8e3c75a77031b08e598a2a92245d062c0a7463565f076a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243348, "uuid": "e101dc80-c622-454d-a722-db4790727faf", "value": "T11BC2F11D535B45E8C00493FE639ECDEE3D803858E155CBD0AB19192A7C1A818DBFA8BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243348, "uuid": "82889902-27b9-4358-acb0-f18e203cb6b0", "value": "384:Mx0b3U3E+WrMeuZhKy0CI/iTlu61/9OyXh5nF2H74KyCTx9lFWdAUhZj4Z+v1Ro:Q0b3UUn4eu/J0CI+XVR5nwb4rWrWuU3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243348, "uuid": "3d929ea9-5f5a-4606-8122-5a6a139b997d", "value": 27276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243348, "uuid": "74e764b7-dc02-442c-a6da-24314f8c70a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243348, "uuid": "20b35a85-c6a3-4e0c-932d-4fbe540ae77e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acadc03f-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695229002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "93d55873-894b-453f-960e-0de83039e14b", "comment": "Malware payload (Loki)", "value": "40a49e119b750ea5f228dbec54993049", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "b93f56d5-31e8-4c58-a22d-2c4193bb4abd", "comment": "Malware payload (Loki)", "value": "3e76776c7d6d505b91cc82d5d135f8c797fc9b3048981091c9102c84a2aedf66", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "ad2f034a-7382-4130-9da1-63ce928316ef", "comment": "Malware payload (Loki)", "value": "1f4643129e658c8150a1c67969cf2923bc3616e9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "11afcd91-d7ec-4676-84c3-96b908d1ef8f", "comment": "Malware payload (Loki)", "value": "e4be08a89fd2f7ff63d4bff4f975868ca835e0cefba9801d52ce221de80dc6b5edc30b9a589949c7f512494ae981dee1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "edb503c1-033c-4cf1-87f7-91b1a1793613", "value": "T1E7456BD25DCCB682C70982B7EB13F9ED067BFE0D948524D63171EA4A2A3319D1C7A439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "bca6091a-c3db-47ac-bf98-875bba049a92", "value": "24576:CWQmmav30xSZy6w6VH6NnqZyew6V26N9+BZ49QUTwhfL/ywMp:HQmmQ306+6VamK6VDe89bTuLqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229002, "uuid": "d561a90a-d7cb-43ab-a622-a4a1132a5f8c", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229002, "uuid": "528e1337-668d-46ce-aade-8ef380b020b4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "b74dd84b-786d-45d8-bc33-de06728ad4ad", "value": "Departamento de RR.HH. rendimiento de los empleados.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e38b93-574a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1695168692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168692, "uuid": "ca94aa82-dca2-478f-9d43-e17b665a61bc", "comment": "Malware payload (MarsStealer)", "value": "abfb46309850473209297227c1d02850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168692, "uuid": "90aa0b57-c4bb-469b-8574-e64e824861b2", "comment": "Malware payload (MarsStealer)", "value": "3f2d5af3b57931be8c05661de3659f4cc9d8bd2d6efbcf38fee848c2f5d8dc43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168692, "uuid": "ae694b20-31e1-4091-ac9f-8283cfc576aa", "comment": "Malware payload (MarsStealer)", "value": "9bc1249502db9a6329d93a2ef97e0796ba1f7cbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168692, "uuid": "228d9e50-5eed-49ef-aeef-c2017a5e2cf4", "comment": "Malware payload (MarsStealer)", "value": "480b6c24baf2067b23137342754988f26a565226fce3dab511c0dc5ce9c5d917c7ebb3928d6a20188421ee5c66d1e90f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168692, "uuid": "70d688ee-4e1a-4370-beba-c39a809e96bc", "value": "T15A9438243DEA5019B173EF6A4BE875EADA6FB7733B03646D1090038A4723A81DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168692, "uuid": "4575cb96-a4b4-4bcc-91b0-5e4ae95a941d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168692, "uuid": "aa8d95aa-ff5b-45bb-8d3b-4fe9d4f7bb92", "value": "12288:aN446F9dJGKYodZ/UbxJA5+dmMOiMhG1cx+WzA2VeF:J4gMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695168692, "uuid": "5afaaa7b-72f0-4799-80a9-c511206ccacf", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695168692, "uuid": "573eb0cc-346f-4748-9cb4-50f49415e19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168692, "uuid": "c7602db6-32c7-4e79-9152-3f2f46508e0b", "value": "Ninite Everything Google Earth KeePass 2 NVDA Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed9274d-576e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695184446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184446, "uuid": "51d0f116-f47e-4bec-a498-a15efa06e9ee", "comment": "Malware payload", "value": "71f73a883696aaa9fd77afb5681c72eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184446, "uuid": "07554eba-36f2-4754-a9ad-0ff070191a9a", "comment": "Malware payload", "value": "3fe814ff1dd66c8b53cb6999207c2a61a57dbd1539f793a72b53cb292a5788a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184446, "uuid": "d1b11c38-4496-4698-b7f9-305ce15c51c1", "comment": "Malware payload", "value": "7788241a508c440d1cc8c7dbc1d89ec9bc54b763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184446, "uuid": "554c93fb-dba4-4fbd-a4c9-347f554d282a", "comment": "Malware payload", "value": "d5a62130b2e424b30527f1b91155f617bdd787ba6d8df03c67717c75a30af02b5c21c8e9ae0480f6260551bf5474b7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184446, "uuid": "c6ce6f87-5258-4c16-8df0-a8606d8d83dd", "value": "T142135D15A7A3D872E452257491788BF21D7F387222F8A0D75BA4183C8FF16C0BA7935B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184446, "uuid": "fcaea295-301a-4d66-a5f9-b46c1997df5e", "value": "768:vEDMAn7SDvFQC7VkrYDVrQhsPAVBzrUIGYFqT2/PbdvJIhtwey+7/6RG1wM:WGQuk0DVrLPA/zrUIGaG2/DdxgtVy+7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695184446, "uuid": "7fa50fc2-484a-44f1-bf2e-05e9e32ce0b7", "value": 42829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695184446, "uuid": "d88c969a-955b-41df-af0a-ee894aeed563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184446, "uuid": "cb7406e8-4e1f-48fe-acf5-23792d4af9b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b50457-5784-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695193877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193877, "uuid": "cd876152-df60-4185-922b-6b6585cb9bda", "comment": "Malware payload (AveMariaRAT)", "value": "d03cbf78ce0b45b6bc7043d8f2529c10", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193877, "uuid": "8b9d8920-6ca5-4f37-ad70-d62f12f87416", "comment": "Malware payload (AveMariaRAT)", "value": "4024a8139dbd3f8899d0f4e8b3b6d27c0b0f075439c4a422798260e919e54a26", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193877, "uuid": "4346ba3e-c7b6-4d94-857a-5eb6b49e622d", "comment": "Malware payload (AveMariaRAT)", "value": "49f1e423019e19b88278fcaba5baabccad83a18d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193877, "uuid": "f5d5e573-5802-415b-9205-aa6ece66bd02", "comment": "Malware payload (AveMariaRAT)", "value": "1cfa23ea063649d39bb08e80b141515885dd970b0f6a57c897776ee20c098243a587d19dd9315fca98423232a56a2390", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193877, "uuid": "e5c43a82-3447-4058-abc5-73711ebfe38e", "value": "T13BD3E823AE10183ED56184F11CA4EAAEBA652E371BD1BD0736A6FB01B536143B1F470F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193877, "uuid": "0fa5f64c-3760-4ab2-9577-01d3a3e08992", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193877, "uuid": "80968403-24fa-45f6-8659-0cb6ce602392", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVCN:UVqoCl/YgjxEufVU0TbTyDDalQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193877, "uuid": "362805bd-67bf-4ab9-ad0a-e9a11ea4e63d", "value": 138504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193877, "uuid": "35251895-0470-4820-b45f-0e4f19c66b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193877, "uuid": "fa536c65-5777-4f1a-8f40-d81c7e8a6172", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4695160-5764-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695180026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180026, "uuid": "cd8591c3-5230-4517-869a-aac229e38dac", "comment": "Malware payload (AveMariaRAT)", "value": "b082e39f8d2c377a424bad195e9d9e1e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180026, "uuid": "4e9f60ef-669d-45cd-8cf1-81ee72570a83", "comment": "Malware payload (AveMariaRAT)", "value": "411763b0b0062ddf7c633c18e282527b82b23c099492af79a9cf22cf95ee0a6d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180026, "uuid": "36bf41c8-88bd-41be-b5b4-a2ac1b5580a9", "comment": "Malware payload (AveMariaRAT)", "value": "49a35e5e1694198d927e92c449c72a6f1ec81dc7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180026, "uuid": "65d99e89-84ec-4ede-ab04-42ce59c63abd", "comment": "Malware payload (AveMariaRAT)", "value": "33b209b3239f9e9157fe1762098f722a305c06a595691a63d5d0bc86a81d7cb209c40ed3ae28f04c01025149319d2b91", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180026, "uuid": "df1f8b0a-272d-4d97-a328-9c4d0216ca36", "value": "T112D38D13BBE64436E6F202B02DB97E7597BCF9341A25C68BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180026, "uuid": "4fada810-1a3f-47e7-9e87-9378d21da32f", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180026, "uuid": "dad93dd2-db3c-487e-9a37-f1ac7e7006eb", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695180026, "uuid": "c0846786-832f-46e3-b363-55657b56b6cf", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695180026, "uuid": "804615b3-c5c6-4101-b286-e2c3ccc84ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180026, "uuid": "08f1d7e0-353d-4dc3-9b59-89bdcfedd3e1", "value": "b082e39f8d2c377a424bad195e9d9e1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76af6ce1-57a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695209155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209155, "uuid": "bdf28311-30bc-413c-9b33-aaf72287f224", "comment": "Malware payload (AgentTesla)", "value": "645d673a63f86e7be291ab3d81bed4e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209155, "uuid": "bbdf910a-c4ad-46d7-a95e-3946c203590b", "comment": "Malware payload (AgentTesla)", "value": "411fc006ebe1724a6bab93d977e183ad283f648960c7dacb3eccfccf689967dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209155, "uuid": "eed9db2a-7037-466d-a1ce-77524987c35c", "comment": "Malware payload (AgentTesla)", "value": "a710ee017588c457216b8b40efd68e87a5c8eb40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209155, "uuid": "6a01fb37-5642-4bdc-bd89-1b0774f766ba", "comment": "Malware payload (AgentTesla)", "value": "38444d11461caad08242a255077adcc8d9dc841835df8966ad0a14ba3e7200ff98b1719c36acebeca478e25e191d5f34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209155, "uuid": "efe2177a-e262-427e-9676-d30df3a3c15d", "value": "T1B325BD80E658ABA1DD29A7F05636CC3453337DADA438D11D1CCE3DEB3BBAB824621553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209155, "uuid": "29c76364-e34d-4fa9-b7a7-31abe658026e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209155, "uuid": "c2039ff1-569c-47d2-aa5c-7f1d3dae08ad", "value": "12288:EdrUl2iNt1NVXjl9TYQgSHA1nM5tw6pSe6G4+py6U19G/s+lP7r9r/+ppppppppV:MUl1rVMp1I5R4Xz+l1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695209155, "uuid": "7cc8fea2-3cd6-413e-be92-44f2eac4dd89", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695209155, "uuid": "a9701bc6-3a12-411f-9845-6f1cb331a460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209155, "uuid": "88825cc5-f234-4de9-a5c0-9b2291d1172a", "value": "Halkbank_Ekstre_20230914_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33eb916-57c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1695220450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220450, "uuid": "195af67c-ec0b-40ae-bf46-dd38872fe7b8", "comment": "Malware payload (LummaStealer)", "value": "7c7bbda1ca87f1fea18e94319a1e9c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220450, "uuid": "83d6edc0-0654-4973-9e13-69fd71be1bae", "comment": "Malware payload (LummaStealer)", "value": "43c0c02903bfce6e1b8fd95e53228823472f85e1a1f9c1312bf980e052a03aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220450, "uuid": "01b89a38-b233-43e6-94cf-692cf47a2dfe", "comment": "Malware payload (LummaStealer)", "value": "9a2e95eb0092434de34ed4045b6ff8cfc1dac0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695220450, "uuid": "fc9f20fb-901e-4a4f-b1e0-5fb1177e9570", "comment": "Malware payload (LummaStealer)", "value": "d3387a8ab10a34ca424651f8be47ebca236790d667bb74d1dd74f446619cb03a169f4b4fa06792bbeec7f3788e9d1816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220450, "uuid": "504c649c-dff0-4918-acbe-1fc17cdd1801", "value": "T1B7940211B993E072C1EB44315930DB612E7FB87369B5864B3F94276F6D313C12BA5706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220450, "uuid": "cfc1fac3-12d9-49f6-9bad-7639b7b193f0", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220450, "uuid": "52eb1abe-343b-4ade-b40e-6e9d10bcc284", "value": "6144:gQv7Slxc/UWE+hm6KmaqzPjXqN93TjcaaWwNaDNErbskQA8b3eEaYlHgeTu:g6ExcJm6K+TLGNQa928T6SlA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695220450, "uuid": "9049f75d-2e52-4092-98b0-2582bc497d54", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695220450, "uuid": "6f810677-de1c-4436-bcc7-bc059775e50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695220450, "uuid": "c6579c28-8989-405d-9f1f-284199e36aef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73999a0-574c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695169722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169722, "uuid": "f4932b8d-b303-4597-a1c9-3104f903ec06", "comment": "Malware payload (MysticStealer)", "value": "d97c6859e4224cb666f2d2734b1fcdbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169722, "uuid": "9b4e4baa-1c9e-4b70-8cce-ae3f6c9388ca", "comment": "Malware payload (MysticStealer)", "value": "45de593239600c60cd6a057e5ef4967308854fd687e00ea3416193a54e3242fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169722, "uuid": "6f7c4412-c6e9-4adc-abcc-367b9a4f9a1f", "comment": "Malware payload (MysticStealer)", "value": "f90d6c60e9afb0bb5b9eb4783f4349909349252e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169722, "uuid": "06bf2368-b969-4663-a37b-8fa16b2a01ff", "comment": "Malware payload (MysticStealer)", "value": "d35dd9565d87b588d39d7913ff8fbb85f933592d4c55e8629f92afc301573eb08fe9e4437e9ffbceb19d253bfc33a706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169722, "uuid": "b93089e8-fe88-4bf6-8f15-e8b10d9e7702", "value": "T12EF39D41F7D28472C477183406F0B3709EBE7AA046E98DAF5FD40F7E4F215A892359AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169722, "uuid": "827f8df3-d4e8-4f91-9fad-7ddec7a9e4a2", "value": "7a83bc8f14d32c8af61627070a00e36a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169722, "uuid": "5fb0e07a-9f65-4284-a247-9a5226925a4c", "value": "3072:B+cCnOhy5t4nI5Qdxl2Wbyl35JL6cTQ+Qrc3JeMp1EP3UvPbZRi8A:+Ohy0xoW+3C+75erwPFRi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695169722, "uuid": "e466e2fb-e48d-4d08-b862-fcae2c35f0f9", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695169722, "uuid": "8389bc9d-64e7-4452-8207-4c246d56fbfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169722, "uuid": "7dbe3660-0ca3-4078-8fa6-994b35fa5499", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf25ead1-574a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LokiRAT)", "timestamp": 1695168904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168904, "uuid": "b0880929-d3a6-41e5-a669-45393aafc23f", "comment": "Malware payload (LokiRAT)", "value": "5e21eba4824a89bcded1412794f75046", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168904, "uuid": "a17270ec-5307-4d1b-ac69-b519d1912be7", "comment": "Malware payload (LokiRAT)", "value": "4662be09fce319b69ed4365e2e4fb3654ae9f597bb060cf2a0cc8b567f445848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168904, "uuid": "fbf84a3a-a3f3-472c-920c-99e86d25130e", "comment": "Malware payload (LokiRAT)", "value": "665b9d7b5c8d1eedb2abf98bfdd74e69d3d82e39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168904, "uuid": "bc0670d7-2a7f-4b56-9277-0f9eadf4e104", "comment": "Malware payload (LokiRAT)", "value": "afb68eb0359420f08b46475895bad525cd5add85f0494fe292a4975344dc626ab4983d98130a7560dd5179a795441097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "LokiRAT", "colour": "#17B4B6", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168904, "uuid": "793e26b8-e821-47e6-b40c-d112fa10be5a", "value": "T14E634A343AEA901AF173EE7A4BD4B596DA6EF3333B0798591091038A4B23E41DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168904, "uuid": "c8dd4881-0547-4ea4-b801-f65dfd9bea8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168904, "uuid": "aa096f73-4635-43d7-b06a-4a9321c67189", "value": "1536:cMEZWr0pJm/W5unaZR108GTBwen1DCWXUqdF9OHIEmm:ck03IWtHqBHdWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695168904, "uuid": "6214fabb-1ceb-4cdc-a23e-669aa32a9beb", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695168904, "uuid": "dc4a2988-7984-435c-8883-4b473fb9e34a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168904, "uuid": "6defbb41-252c-4e40-8dd8-bbbaaab042c2", "value": "Firefox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48638643-57dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695231411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695231411, "uuid": "27ecf908-dd78-4821-b8dc-9844b676582c", "comment": "Malware payload (RedLineStealer)", "value": "ddf3119592313de6b01f6dd10c9f4d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695231411, "uuid": "9fc908ba-e044-4929-89c9-5df6605d436b", "comment": "Malware payload (RedLineStealer)", "value": "472a9c45d7a1ebb0163b1af93c1aea24f2247c17575752d5fede523b97713ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695231411, "uuid": "5dbcdebd-265b-4502-9767-113234d716db", "comment": "Malware payload (RedLineStealer)", "value": "b675bff54ef3bc783826116b5b8e4a1b449ba5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695231411, "uuid": "1a57d8c3-5210-48d8-9951-75a1609fd12a", "comment": "Malware payload (RedLineStealer)", "value": "f8af5bf87638ed84d26f57ea06f0e30a90c25b8646048cfd33710df1108f8434450483aad5cfcb44174fbc94f3e27ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695231411, "uuid": "b640c2ae-0737-4458-88cd-93a6c18b20b4", "value": "T146652322A6ECD032C8BB2B7018F94BC31E357C918A79962B3750851A1C737D69E7572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695231411, "uuid": "239b6f86-e3f2-4993-bb72-cd082dd16e0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695231411, "uuid": "f5885767-c372-478e-8bb0-5f5dc545b04d", "value": "24576:0yIzo77fybf4HlC3qlN5ADO4g5+F2j84BQlEPShLq6D7bsvzY5JmztkLPkYYr:DIqy8HeqlN5AJE+F2Y4BQloShW6orYn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695231411, "uuid": "d3156465-2112-490b-be88-8ad5f6c5e1ca", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695231411, "uuid": "3bf2ffe0-7c95-4672-a99b-db9242c7857e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695231411, "uuid": "200fc43b-578a-4e99-a84b-1ced6bd5dd71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bfa539-57a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695206623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206623, "uuid": "a138d278-d090-4bf7-8668-a8ef88896aaf", "comment": "Malware payload (RedLineStealer)", "value": "e919f97c108e9592d4267e2bbdcc0cdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206623, "uuid": "a34c80b0-b8ac-4585-ac9f-99fbc5d41aa6", "comment": "Malware payload (RedLineStealer)", "value": "492072d033edf6ed617f46060b250de50deac9027c35fa8ed07318d594a30d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206623, "uuid": "d3b1e9c5-e38e-4607-bee5-791052d584bb", "comment": "Malware payload (RedLineStealer)", "value": "fc8a5bf5dfcdad00b228fba38e501d11bf0e3536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206623, "uuid": "00da3ab0-c354-4b5b-94c0-2581cb874192", "comment": "Malware payload (RedLineStealer)", "value": "55328261f7b9d81683ee793879ce61c4e04521c2491db170c2e98e5a1be519e928d45ef119ac3da8ebbdd8711a9a9fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206623, "uuid": "cf080d10-e4ff-405e-9c12-921a68bee4b7", "value": "T149652316FFC950B6C9B2177214F703830E36BC516E74CB5B7291E95A4DE2AE0893632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206623, "uuid": "645d2f7c-d875-4445-83a2-86ce357f1db0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206623, "uuid": "1d951730-f57c-4380-bb47-5b08ab8a5765", "value": "24576:syCCjEh2YZzMTrnwAmmxMboL4ItWvmft/3mpWdkxdhE8WMl+WyQ8F:bCyEwYZzGnnmjboL4Bvq37kxdQw+WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695206623, "uuid": "d8cb4a97-76aa-40d0-b5bd-478fc92713a3", "value": 1435648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695206623, "uuid": "05d1e959-f45f-4ed1-8443-c3d0c8b01f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206623, "uuid": "e2b3164f-0089-4286-8cc3-87cff1e8ad52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff190b3-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695196339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196339, "uuid": "e1325c81-9383-4f69-8429-51ca11ff23e6", "comment": "Malware payload (Formbook)", "value": "b31aa87642a0a56831a63eaf0568556c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196339, "uuid": "39139989-86c5-4b0e-9784-56221d0b6e8d", "comment": "Malware payload (Formbook)", "value": "4c2277627817ef74122f5d2fb38e461330023a34b33be062783ce24634ec66d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196339, "uuid": "1522f337-5b55-4e66-848d-b7637805cc9d", "comment": "Malware payload (Formbook)", "value": "8ec7ee7952f47d3712e8868a5df7d37701bb5e05", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196339, "uuid": "d3d59f45-72c3-4331-81d8-0967c176b501", "comment": "Malware payload (Formbook)", "value": "e1acb01d36f8eba5c5aa0f0f0af3f7997103a131de3d1e3949856759fc67984b22c6d13523aed04c084859c48c379559", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196339, "uuid": "fbfe86f9-1fba-44b6-ad63-eb513842858e", "value": "T10D456BC35CCCBA82C71A82B7EB12F9FD0A2BFE4D948564D63031EA86257765D1C36439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196339, "uuid": "d0cb0499-d03e-45d7-ac5d-45b6405e7763", "value": "24576:jWQmmav30xSZy6w6Va6NTiZyLw6Vw6NYofJjVQsTQZtWD6/awQV:CQmmQ306+6V/iP6V5vVjTD6yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196339, "uuid": "7cb522af-a439-4b49-a1d6-07aac8e08f40", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196339, "uuid": "30f1cf02-6664-438a-b9e4-45d4536b7f6e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196339, "uuid": "10030f02-ff98-4490-816a-d0e8a9bd23d5", "value": "Outstanding Inv 6662.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d6241c-5802-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695247644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695247644, "uuid": "c64252dd-d6a6-4e37-9874-333206d75583", "comment": "Malware payload (RedLineStealer)", "value": "d94a59ea5006a3dd3d5a9fcb25de0994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695247644, "uuid": "c7a7bc29-7950-4f62-8ae3-a3b6381b77b2", "comment": "Malware payload (RedLineStealer)", "value": "4d45d287e2d021e0051e8d081694d3d62b38cfdecfbf3ccec7d966732b2739a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695247644, "uuid": "926cc85e-cba0-4eb7-afa4-069b4c52071d", "comment": "Malware payload (RedLineStealer)", "value": "ea94664a6902049ce55e3956402ecc080078f61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695247644, "uuid": "924a4adb-7bf5-4f3a-9da0-e8144dfa8dd8", "comment": "Malware payload (RedLineStealer)", "value": "913f791a17a3e50e3832ac913ae4ace392430ab9e09374a6159a8f4e5f0f73424ee96a13c93911d47e3721371ed97e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695247644, "uuid": "b977cd73-7194-4031-9b64-64db49dfcb51", "value": "T1B8552313FBE9C171D8B61B7148F743434A34BEA29DBC13A62B9BA5490D718C6B071B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695247644, "uuid": "237dcaad-b206-4699-a148-ae0eb9a4289e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695247644, "uuid": "4a96210b-052b-43fe-af3a-1d54cd4679c4", "value": "24576:ay0ksEbSwD8RWoYTbLYns7D+f2J0PzYHKHY0hntW0k17sZJ:h9SwAR2lCf202BYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695247644, "uuid": "acb1e77f-9c3c-489f-b41e-a109e67bcb95", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695247644, "uuid": "154917ba-5c77-47ea-82cf-850eade4a04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695247644, "uuid": "ae9b52da-c26c-4391-b045-7b33f343ed4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ccbecc-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221531, "uuid": "7d8d259b-a719-4017-a64d-5f437085635f", "comment": "Malware payload (AgentTesla)", "value": "8cd67254f05bce4c1257384ebf6514cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221531, "uuid": "ebae6045-8285-426a-8f21-4208e3eb86e7", "comment": "Malware payload (AgentTesla)", "value": "4d7baaac41068e98e18399597fbd22cc0ee2ae3b2055745c3cd304b697aa12ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221531, "uuid": "b24e2eee-0130-4b05-89fd-cc8c8b0f5dfb", "comment": "Malware payload (AgentTesla)", "value": "60d6a99aa0c48d38528224c5279cc55696915d7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221531, "uuid": "0f0e8217-617b-4a0a-9022-8bd734b52238", "comment": "Malware payload (AgentTesla)", "value": "19a228d04c7b8357120de33ab3053ae0bb75ad49c682d12c104c11e333ad0b6d0e79d7c3ca799af62bacbbf8df383c8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221531, "uuid": "cc7119c8-fefc-47ad-ba32-161c41d9b6c7", "value": "T16AD412593564CF16E06E5BBD086006702774E95A7DE5EB644ECAB0EB4A92F30CB063CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221531, "uuid": "39234825-8ed9-490d-a294-faf0fa294a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221531, "uuid": "14d638b2-740f-43d5-8a0b-6d6620c31782", "value": "12288:6h2lIcV+g1vsBN1JWisZdjLQEFYEKz64kVrSuUuQWrRfrlp:6IDVFsBNS/j3KhkV7/QM7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221531, "uuid": "857340fc-5d4f-429d-929e-0406fb0d5027", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221531, "uuid": "b7a386d0-8892-4d0f-b4e2-ae3d1941d04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221531, "uuid": "953a6a50-37ae-4803-9fdb-c96e11fa0134", "value": "0220829_PEDIDO_22073M_PROTECO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1d4fc5-574a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695169008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169008, "uuid": "d071d21d-2ed3-4883-ad2c-c30c3426ec79", "comment": "Malware payload (MysticStealer)", "value": "ffae2d2c2a017a45a94e86a1d9ee05e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169008, "uuid": "9740151f-5b1a-43ec-a75f-316dfdb1908a", "comment": "Malware payload (MysticStealer)", "value": "4df820be66755d4a58c973554e84a1edc1cfb4a17b0ea75009418a319ed78e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169008, "uuid": "c6675d4b-543f-4274-9faf-8d930ef50552", "comment": "Malware payload (MysticStealer)", "value": "f3770aad2f838b32381e18463aa280bb6515f5fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695169008, "uuid": "cf0844a8-849b-4463-a166-7b722ccca2a0", "comment": "Malware payload (MysticStealer)", "value": "182696ee09a77c661f15bdd207326790071e431d171ac1284f5ba025033c6dbdedbd193f3befd4bb459982d52743bffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169008, "uuid": "bcfdf41e-6149-4f9f-a889-7d8cd0175693", "value": "T15A359D227BD44071EDE220B742ECB636869ED4B4072575CF0ED85AEED7742C26F32586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169008, "uuid": "246c8d49-d8d7-4a97-9f55-1e5feea2fdaf", "value": "f6040bff5e7406bf13febce5512b9888", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169008, "uuid": "c98e7302-fbb7-476c-acad-6fc70aa6241a", "value": "12288:GNsnQN2dA1IY9i4ytPDxZZZVf95Tjz8L2aB4vIubLkU866uydzGTmtc1UdLCAW:Usna2dA1h9i4ytXVX3dhugmtc17AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695169008, "uuid": "73df19dd-d4a9-40c1-8129-3152858d99a6", "value": 1114488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695169008, "uuid": "61e3c508-7fe1-4a08-8fb4-317b22933d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695169008, "uuid": "0212daa6-cf78-4e23-abb0-91ad85172ebf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24425f0c-57e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695235216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235216, "uuid": "b1469453-ee53-4ebd-bc1a-4c20e5e62b2f", "comment": "Malware payload (Loki)", "value": "043e70250aeeec512af0393baf488866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235216, "uuid": "d8ce1ed8-fbf1-4dec-81c0-4ef00c132181", "comment": "Malware payload (Loki)", "value": "5055c28ba9fde6ddfde33000bbfb39deca723bfac56c23029a54dd7bdb748e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235216, "uuid": "63d36966-43f7-4d19-a2b6-f2c4ba8fca61", "comment": "Malware payload (Loki)", "value": "e5d62e24ab01bc092c1a873c4739fbdb17543f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235216, "uuid": "703afc38-a4f9-4f82-bba2-3a1f05bd798a", "comment": "Malware payload (Loki)", "value": "a711d01d7cd6c59077728a8e19a25c8542752a6b96d8699fbb631283dc959f86ea12d02d2501e1a6c010ec9a04cfa223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235216, "uuid": "44f7387c-f74f-47ad-8bd4-38001112e6f0", "value": "T1E6A4025437988F96E46E0FF8183111452BB2E9ABB963E77819C9E0DD0A53BB4C60335F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235216, "uuid": "ec42c4a8-1f5e-4dd7-8bd1-11e562d309e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235216, "uuid": "fd9fc3dc-bc34-459d-baec-471b9f1fb355", "value": "12288:Z6xVbj2kpoWql/z5n7jqi8cypyJglxOY2IdwOc:Z0RDydlLJi/crJg7OkaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695235216, "uuid": "c70f04c5-dd6d-461f-b0ae-212bbbb43d9e", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695235216, "uuid": "6870ec83-2a57-4333-b402-e5870f15d9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235216, "uuid": "302b4857-b66d-4ee9-bd23-7a7b89ba3187", "value": "043e70250aeeec512af0393baf488866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4349137f-57db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695230973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230973, "uuid": "ada5e0bd-1d70-4a27-8d42-2aafa51155d4", "comment": "Malware payload (Formbook)", "value": "0bb376187cf8242293fcb8578e369fb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230973, "uuid": "7e601cf2-cee2-43e8-81e7-80650a0415b7", "comment": "Malware payload (Formbook)", "value": "50b7c22b62b792c34ad69ec219ee468803d070257b57902a33248f953444caf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230973, "uuid": "6b159802-0623-4ae1-8613-c87c99fc5f81", "comment": "Malware payload (Formbook)", "value": "9bde167acf3f4146c339c62d212280d7c2b96391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230973, "uuid": "1c24a18d-5608-4f7c-8061-7f406b466149", "comment": "Malware payload (Formbook)", "value": "b7af49e357933acf8e508bfcf0f46184d74c1dd7ed6bd9c1eefa6dbf68e113bcf3845ebb34b47f7346faecd51f02c03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230973, "uuid": "205e0699-e2a0-4224-babb-5c071b91fae0", "value": "T11CC423172694CD91E2AA977914726AC73B3BBDD7793AF3A84C9A50C70E01E018343BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230973, "uuid": "4933262d-a06f-464a-b446-5f2da2dc08ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230973, "uuid": "027ad289-e5a6-40d7-8b41-8b8ebc882be6", "value": "12288:6ZUEkSVn/1nKAjj7N14+l8QvbV5yu1Dm30IsQ456V614sAAk08:2UqVjjPl8m5ZTKSAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695230973, "uuid": "abb1788e-f3b5-4232-88c6-c2c7727389e2", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695230973, "uuid": "5d1b6245-7b34-41c0-9719-0019ce8fe6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230973, "uuid": "9b94a7c0-eeb9-46ae-97d6-90f762c6ae44", "value": "97E76B9110FF4A56835C3827725D04C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07364cd8-5772-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695185775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695185775, "uuid": "d965ce17-4daf-4dc4-91c4-7740c4255268", "comment": "Malware payload (MysticStealer)", "value": "1596079ee6489157e31a8d5e9d9c2650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695185775, "uuid": "2cbfb559-b379-40c0-8455-63eecf923a75", "comment": "Malware payload (MysticStealer)", "value": "50d85e294f861c400ba689cda3e85ec5471c97ef3a5b93cf7dc40e58e41fddff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695185775, "uuid": "e33e307a-266b-4153-823f-fededdaaf5bf", "comment": "Malware payload (MysticStealer)", "value": "e4cd53b32ad46d67b41ec4b6b1c34346eaa6dc80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695185775, "uuid": "9717d334-c6b5-4fdf-b5d0-9aaa23123291", "comment": "Malware payload (MysticStealer)", "value": "cbbc605a88d96ac8b8f28d6d954a101061f04f07ed0e69d0cff1980d10db94714043ff79fe1e3a0943a817c9d78a127f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695185775, "uuid": "c8df7ecb-a0cd-449c-aaaf-4d4fe92c752e", "value": "T1776523127BDC4476F5722B70ADF305C30B367E555AB6D36B3261A90A18B34D0F87A3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695185775, "uuid": "965cf9e2-0984-45dc-ab2c-1e365d9e3a2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695185775, "uuid": "c6e72c1c-62ff-4992-afaa-aff0914ee7fa", "value": "24576:Syp50iW5K2APfW4iDcvoTS/6bjTfPVpukPPBtQ1We6O2w:5p5zWkZWx4o+/6b3nFrQ1W22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695185775, "uuid": "4da44aa0-b3ca-404c-99d1-22d40539614c", "value": 1505792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695185775, "uuid": "8adddf6b-287f-4ffd-9edd-36526b88affc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695185775, "uuid": "278b7380-ab70-4dfb-bf79-4fbd2486b184", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98d8987-57bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1695217830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217830, "uuid": "498c51a8-2b1c-43ef-b7eb-50bf0cdaa02a", "comment": "Malware payload (PrivateLoader)", "value": "4a62a863daffe988e9a1fe126234dbbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217830, "uuid": "f14f43df-ada0-4f04-af80-b5610bbbcec5", "comment": "Malware payload (PrivateLoader)", "value": "531b98c17443cbcf4e821e91f5b84cae088f30f7c1157c63bcf7f90f105e6c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217830, "uuid": "f920f13a-1e01-41c0-975d-9aff337e7fd0", "comment": "Malware payload (PrivateLoader)", "value": "6e9c2ca97366ce733e4f88ccb4e6d6411efaa208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217830, "uuid": "2ea23a45-e5a3-489b-86e3-ee553eb45df6", "comment": "Malware payload (PrivateLoader)", "value": "88f082d2fd068898f37f033dcb5a34ace31607c6e787c78208c87d77eadd11fbcd5c0f4808cbba84b9c76999ca117be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217830, "uuid": "f843faa0-1189-4713-9ba3-9bbe6cff2e74", "value": "T11DE533F15BB53D2BC604AF384D46660EB7222B60A8902B54F72F250B27F5C5E7B42F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217830, "uuid": "82fcca63-8fae-4913-8a3c-b0518a990660", "value": "83a16448cb90e20899e2697682f235ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217830, "uuid": "24b4d004-959f-4f6f-9198-c00f8d74b28c", "value": "49152:hN94VVApj6nT2eMYmM4i6haea0GNG7f+Mj1zP/zEv8m7kRDxP/SpMTCnzK8ZTXfi:JUaj6CD0maxzNGPjhzEloxbMZ7re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695217830, "uuid": "508568fd-a8fe-4dfb-b915-b49df156aab8", "value": 3160960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695217830, "uuid": "68f90dc6-7b76-4d12-9c59-3db0c52029c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217830, "uuid": "2f6394c3-98da-458f-9df4-943fda45ddbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687c2698-5810-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695253799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253799, "uuid": "67516977-f66a-44c8-9440-2dc00b4cd200", "comment": "Malware payload", "value": "e4ad2a00722aec0dbb03600112d83fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253799, "uuid": "6fcd49de-6a80-4071-802d-09251a5ed2a2", "comment": "Malware payload", "value": "53342334f028724133216a9727a4e6f7a5460d326d2b777393d34a04128f2cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253799, "uuid": "f2cb3533-bb3f-4dcd-943c-fdaeb5ba3d2b", "comment": "Malware payload", "value": "b891a9ececab48ff7bd2568329e00a0553d60cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253799, "uuid": "ca856d86-68ad-430d-a410-773266d77e82", "comment": "Malware payload", "value": "6d8e6896f0e55751cfb40d291262c715bcbddd4b43c15a92e89b601ddccd7c5494289640c20bbd290da15cae5cc72398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253799, "uuid": "cd80eb3c-ce09-425e-8abb-6f2dbdf553b0", "value": "T12574F11179A2D436D9A780355C70FBA5663FB8326479C58F33502A7E6E303D28B693CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253799, "uuid": "bae0ea3a-768f-42b1-9dde-edbed3447fef", "value": "8a5878408e89d1fd5731f7a33cc8a29b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253799, "uuid": "7919dc1f-638b-4d38-8468-e80378e6fe02", "value": "6144:QpKxntRYxr4//0/1AXpaEZvLtGlDDfAeA2ry9C0EgdtwXy:QYZtRi430/1F+aryQ9Ytb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695253799, "uuid": "2cbe57c3-0484-4d8e-afa5-3b4867ad27a1", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695253799, "uuid": "3f15305a-100b-43fe-a36a-3ef7efc49297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253799, "uuid": "86432f78-1403-466a-98e2-66ffbf26ec07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53c1e2a-57ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695223916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223916, "uuid": "a6f1bc0f-d7b2-4ee5-950b-bbf1a4aed048", "comment": "Malware payload (AgentTesla)", "value": "56c1ce0abca46b11e1f904b3d2655e62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223916, "uuid": "88f3d043-f9e1-40e1-8af0-3d4fd7e88a5e", "comment": "Malware payload (AgentTesla)", "value": "53711b3fccd1dc51dc4a602723dd55db9a87be759691105944afd21ffb8bcc6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223916, "uuid": "4649f74f-5ec2-414f-9998-303161c9829a", "comment": "Malware payload (AgentTesla)", "value": "c4f786ea9ffb700b50dd74faf7dce1711b139b8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223916, "uuid": "d227ded9-c68f-4d45-a71b-509bf032bb98", "comment": "Malware payload (AgentTesla)", "value": "52f2f1d28ec1f5a7bf91997d0e0b778e1e253ee7f0c268da0c79b7020e860fef3be1d6dda541b272dbbc03731fc3f4bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223916, "uuid": "aae32b75-4db5-4aa0-85a4-bc9a6ea173e0", "value": "T181B4237CE98B0E45F353824A1B9AD673549626013C6CAFB37D113A8973E583B8E394F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223916, "uuid": "1ce826fa-115a-460b-adac-1f3fff2d72b1", "value": "12288:8traZapVCRcUecF1Q/YLR4zRXDAtTe196AMbB7RLWQ9SY:0ah1VRiRXDAtqCfjSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695223916, "uuid": "1aaa8e33-adfc-4006-bce0-1314fa834c1f", "value": 515679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695223916, "uuid": "4485507d-20de-4565-84ed-058002060d21", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223916, "uuid": "6dfaadbc-5464-4515-a0bc-94b4fb9564f6", "value": "COMMERCIAL INVOICE.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81316d68-5795-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695201012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201012, "uuid": "2de38604-8bff-42be-bb90-4551d15cf22d", "comment": "Malware payload (RedLineStealer)", "value": "3d738359c71ad6b24964a471b8355e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201012, "uuid": "1549d385-464a-4705-9a71-5c6fab41b0c2", "comment": "Malware payload (RedLineStealer)", "value": "53746744b5f43d51db44aedd46b836b253593e99e88e409116a28f58f4208e61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201012, "uuid": "fac407ca-44f7-421a-9f0e-8af57e6756e9", "comment": "Malware payload (RedLineStealer)", "value": "9325341513eff4e8d72d8227786d1ae74063a787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201012, "uuid": "2af34a8c-da46-4cf5-89eb-51dc18a4c5ff", "comment": "Malware payload (RedLineStealer)", "value": "c8bca51977bd858e09bbe2e7b503883f29d9dbaf69e5de870842798007a13dbb61d6f418876402b087629d4b42ef0d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201012, "uuid": "a0fe7590-523c-41c7-9c53-9f4e1fae3e04", "value": "T19244CF217580C0B3D8BB153005EACB794E7974714B6692CBB3D967BA5F213D1A33A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201012, "uuid": "74bf7dfe-1655-4396-ae0e-8e8ebbff612b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201012, "uuid": "bd28480d-cf96-4ec8-99f4-ef2b08b139a9", "value": "6144:ODKW1Lgbdl0TBBvjc/nnl6wKF6vAyXI/Euvj5:Ih1Lk70TnvjcfnlGKrXI/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695201012, "uuid": "dfacb615-ab12-4b06-b910-76c3682eb3bf", "value": 272960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695201012, "uuid": "51772adf-26d8-4c89-9aaa-47f120890ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201012, "uuid": "e4d57b24-35fe-4b79-a60e-3e10ea34b284", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6974fc5-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1695196833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196833, "uuid": "2072ec3c-f22d-479b-b388-f1f855139823", "comment": "Malware payload (AsyncRAT)", "value": "ff85d6ad09c3c392fec8747b6d6a6c51", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196833, "uuid": "d19a7b58-ce3f-4f4e-af52-23a9b53c6bd5", "comment": "Malware payload (AsyncRAT)", "value": "53fa90567280684ea1d22c0cb0514c25fd6b272623f3efff09d892e7b7f829a0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196833, "uuid": "70caef58-be5f-4aff-9626-eb23d29d0642", "comment": "Malware payload (AsyncRAT)", "value": "8d6700a3669c7118426ca9d816f18adf4d2a604d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196833, "uuid": "6a52a80d-74ec-4bac-bc7d-602834d06c90", "comment": "Malware payload (AsyncRAT)", "value": "2b2088f328772d8e0d851996ec6559ad06e19b3c7a14b20254ad9085efe28c2a2ca1176527be0cf6b1cbd2a95dbb7c41", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196833, "uuid": "01c9d5a3-80db-45ef-969f-e14417736980", "value": "T130648AC17A953F9F04F60793A750EE527B7310284A426648A83FBE67ED781325378C9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196833, "uuid": "e8a49d4d-4565-4108-8d57-cc1f8669cec8", "value": "6144:Juuuuuuuuuuu4uuuuuuuuuuuGuuuuuuuuuuuduuuuuuuuuuuMuuuuuuuuuuuwuuI:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196833, "uuid": "38ec70b4-7c28-404a-88aa-cf201f58b214", "value": 334255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196833, "uuid": "5ce3a242-6fa6-4cc5-83f7-a1523cd5a880", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196833, "uuid": "796ed87c-c24f-4b1e-a189-369d97a8bb8e", "value": "ahtenSYqXJ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646ead1f-57ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695239618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239618, "uuid": "888e6db8-cfb8-4e9e-81de-c560458870a5", "comment": "Malware payload (RedLineStealer)", "value": "fb57a20939736a611756ba776dc4841d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239618, "uuid": "c45a7f1a-84de-465a-92ae-62531d671ffa", "comment": "Malware payload (RedLineStealer)", "value": "54bfeb4570208f9a43ff093ee83180dcdf7badfb75977b3c16068d0c9a51e358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239618, "uuid": "04e75d02-ba85-4e5e-b0cc-d37cb8a11a1d", "comment": "Malware payload (RedLineStealer)", "value": "ec09f3039fa2d16a62329af5fb35f76ede874bd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239618, "uuid": "28b4d1a2-3f5c-4998-b137-842fa1959cba", "comment": "Malware payload (RedLineStealer)", "value": "454f132834f852a30acb3c6384ecab7f99e4b167d16706374d7220d4ae0f37204b24092b77700903e2b38a49be321d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239618, "uuid": "67330200-d003-47ac-9202-ca98da2a43f4", "value": "T185552387E6E99C32E632677018FE03C2073DFD614D76831A539AED9C04F2462A77572A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239618, "uuid": "bb2491a1-d7f6-4095-acb6-f396fb93a453", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239618, "uuid": "78419a96-6d06-499f-9b12-e28e70ad52ce", "value": "24576:0y24X9H5rLbpZFZYPiywu6+e8Wrv75+jn7CymvAd4a3I:DVXr/pZPxMe8WrT5An7mYd4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695239618, "uuid": "246807b7-8d2e-44be-8d79-c9b2a8badcf3", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695239618, "uuid": "6e7cf70d-f734-457d-912a-1ccbc8374989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239618, "uuid": "3c2425ec-f0ac-45ef-a7b2-1789247a0841", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd136927-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695229083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229083, "uuid": "41fdecfc-a4b6-46d2-a2f0-d968e2193894", "comment": "Malware payload (GuLoader)", "value": "59f0d77ca9bbb0400c80f750522510e0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229083, "uuid": "4242c8e5-a102-43b9-8ffb-c50ffbbfa77d", "comment": "Malware payload (GuLoader)", "value": "550b92b2c4d6647af57446b48b0a799a3ab39a2778d8393d8172c987123b2de8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229083, "uuid": "7a3e55de-5c98-46ac-8692-d0fae32037a7", "comment": "Malware payload (GuLoader)", "value": "e44d5ecc4c989000c90a9f78b8f9593c5fe6d42b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229083, "uuid": "d515c294-b25a-4542-92e9-7d1b8f8b2602", "comment": "Malware payload (GuLoader)", "value": "e6e5e3bb2902bd310d77a3b72cdce306c8faf671186667eb6cf0f272a225cea48d3e3f19655bd6b62bead60777bc8e26", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229083, "uuid": "d0170642-8ec3-4965-8d8a-8ceb9b73a6f3", "value": "T120133961C6C61A384A470BDEBF019512C9FE813E832A802DF29D176E211796CC73EF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229083, "uuid": "07876b73-7a4f-47c4-95b5-85dca0f98779", "value": "768:corMtwTVlHPwlR5EQi/Go9ACqg8/XR9mQTpWzAiPh6SR0GCG8x:coQqPwN6Go9ABxjmEWkioO7Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229083, "uuid": "3a2336ea-1d90-43e8-bed7-bd31e3d649f9", "value": 41490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229083, "uuid": "578b71e7-8d07-428a-86d5-4dcdcdde828c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229083, "uuid": "26051e35-a293-441e-8cda-06cb33ba52fc", "value": "1x20LY073649574.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0726c480-57c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695222282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695222282, "uuid": "113a7751-7c14-40ac-8f33-8392a5c7a142", "comment": "Malware payload (MysticStealer)", "value": "a19115515e03a976ffde9ce403f729ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695222282, "uuid": "2ab830f7-1fa8-4043-9821-4ce6cda18179", "comment": "Malware payload (MysticStealer)", "value": "555ee22eb8c059f1e759ebedd1dc4c0012631f6befc0dca42e728fac6cd95ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695222282, "uuid": "ef9747df-d6a9-4a31-94fc-a1bc02b96380", "comment": "Malware payload (MysticStealer)", "value": "e036bbe586251ddffe9e9d2a4b7dc2f77d8b6087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695222282, "uuid": "05c441a9-247d-4838-9592-58b52e8bd710", "comment": "Malware payload (MysticStealer)", "value": "f88d8e1b7a374e50cf5927ad8ced554e651281aac93f2a655334890cda6533ab165f311b0e9d3194bfd5330f0bdc1341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695222282, "uuid": "d896cff9-a70d-4531-804b-bdc024353b2d", "value": "T16D252302B7E44163DC7523B429FF02931A3ABDA54A78C61B2394A81F4D729D4B53A73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695222282, "uuid": "062a0252-703b-4e0b-94ac-8cde2f6c53c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695222282, "uuid": "79af82c8-781a-4d93-abb4-e8e3e0f45263", "value": "24576:+ykECpL/z6qevXrs6AIWcQBvzTffOZCmj:NFEz6qsrsncQBXvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695222282, "uuid": "44293b3b-d3da-498c-9982-e2d602fa59a4", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695222282, "uuid": "43f6bca1-23d2-45d5-af06-95c69c010e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695222282, "uuid": "349de4e6-9399-409c-a34e-d9c9eed6aa53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6b2fb1-57df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695232792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232792, "uuid": "cd85fdc6-d8a2-4812-8bf9-d5cc179d2d2b", "comment": "Malware payload", "value": "ee1f83b2cdc5f75a852adf54b8de4d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232792, "uuid": "656db5e8-045b-470c-9e50-d938f8696c5a", "comment": "Malware payload", "value": "563307cb0415d3767f1c0ab2ffc13194be9503fc5505ac97b4f02aff53b13c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232792, "uuid": "f0547ee1-f26c-428b-ba24-ebd333a64a8d", "comment": "Malware payload", "value": "adce3adf22d459a02e976331827f625686f399f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232792, "uuid": "f8682f1f-2bfc-47cb-9997-1b9447330b46", "comment": "Malware payload", "value": "45d4890debc925fb263da2f9ce316cbea65a1cffbf21b84561b7e66d9339908609011081e71b837cbeeb9dcf3e3ee2be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232792, "uuid": "eb858595-83d5-48ef-837b-89b9126cd020", "value": "T14F24D02139A3D671C4A784309834CBA0667FBC7396B5854B37B83B7FAE313819762356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232792, "uuid": "0b128044-e095-4ba2-97cb-2c5293ae1063", "value": "f441e1f89e815eda74d641cd1f758949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232792, "uuid": "5121f832-65ed-425f-bd34-457654c20eda", "value": "3072:IX28rRmnYRmmzstxy2hy89UQOX4H75J7qJzTfEif3:cVFJRmSWxynX4b7YzTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695232792, "uuid": "ec660e5a-a871-4a38-93f5-949e29a31e58", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695232792, "uuid": "5ddf1697-7097-4411-9b87-8a7a63f6add0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232792, "uuid": "44ee3dcd-c150-49a5-abb3-2769c360a1f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96a28b1-5784-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695193912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193912, "uuid": "5c90b727-6558-4737-b70e-0c50bdff5e56", "comment": "Malware payload (AveMariaRAT)", "value": "fb1e324893a7ef721b81683f0f12754b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193912, "uuid": "59dceb2e-25e4-4e1e-846f-cbcc41bddf68", "comment": "Malware payload (AveMariaRAT)", "value": "563efba3fab5d351ac8cd252cb5dadb86b6fb2b0a28d0abd64de73636921c870", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193912, "uuid": "5eb48664-860c-4b17-b036-1dbb737237d7", "comment": "Malware payload (AveMariaRAT)", "value": "497b27fa56e7e33ee84e1e7d42f7512bbd477384", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193912, "uuid": "279b95aa-9723-4619-ba2c-0ad6c77c1188", "comment": "Malware payload (AveMariaRAT)", "value": "2e4567768f7058078dfa82af6ed46e4c4e879ae30598a3dbe339a124bd69c6841ba0011fa3cbbc3f5b4d8f8f7dd1cf03", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193912, "uuid": "e5d13f59-ccd8-4644-93a2-a825513a9b6f", "value": "T148D318237D60947AD82285F13865DB79BAB62F361BE0AD076362BB05353125772F230F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193912, "uuid": "dc1ca292-1dda-4b21-baeb-c0e6aabbefb6", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193912, "uuid": "a1f157ec-edc8-4289-9f91-9cabff1bf786", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVCa:UVqoCl/YgjxEufVU0TbTyDDalQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193912, "uuid": "95952e1b-820f-43fb-ae26-9264d37cb603", "value": 138367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193912, "uuid": "d984b801-c001-4a8e-9acb-e83c92be6974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193912, "uuid": "fd241e8f-4f13-40ec-9740-d68abe553148", "value": "icsys.icn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c8629b-57e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695235478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235478, "uuid": "b743f0cd-b24b-4cbb-85ff-d7ea18617842", "comment": "Malware payload (IRATA)", "value": "8b737cf822012ad0ae9595362df7f6e6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235478, "uuid": "237e35c8-a398-453d-aa2d-a26512ab0e8e", "comment": "Malware payload (IRATA)", "value": "567126e6b01a54465c5df745f78e30d8f6685732b457ed6d41936908cde48514", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235478, "uuid": "1e0ff8c7-d665-429a-b612-0ecef517e515", "comment": "Malware payload (IRATA)", "value": "48bc9d310a17b361052fd720393030fb2a3ebdeb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235478, "uuid": "5cf7b966-9348-4966-9365-a5ceed46db8a", "comment": "Malware payload (IRATA)", "value": "adcee9c94e3fd8fc6ebf10690a81714939f0636fce89dc74c89b6ec822ae684b851224fc141834b30db2495630dd16cd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235478, "uuid": "44e9825f-052b-4099-b84f-4655ad95db0e", "value": "T167851203F26AA517D831C03220412B36651B1D19CA42F74A795D3BBA3FB7EE84FC96D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235478, "uuid": "784cb6d3-986f-4fc6-81c6-944c668dc715", "value": "49152:7s/ikkp7XQoUdv9FldJKZ4bBeYP+loyTk9TaHXuRIf:0ikkpXYdPldJl7P+loyTkZaDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695235478, "uuid": "bc354d1e-b36b-4729-8acd-3d079708f0e4", "value": 1858813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695235478, "uuid": "3a58e564-59a9-480d-9c9c-5dd84320362b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235478, "uuid": "eddd0bce-bc28-47df-9c62-552118fe1688", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1975e0ee-57c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695223172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223172, "uuid": "cc65c57a-4e26-412f-80a5-8383ae87fc10", "comment": "Malware payload", "value": "f0cc22282e600a2a3c29d37c576e4fc9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Keylogger Test", "colour": "#137620", "exportable": true, "hide_tag": false }, { "name": "Test File", "colour": "#29393B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223172, "uuid": "9a186733-1e76-4041-8a58-52cf94c2f5fb", "comment": "Malware payload", "value": "56fc395f52d3448629112d9dcd5c6d238125006abbef501f9dbedf052fe81ec2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Keylogger Test", "colour": "#137620", "exportable": true, "hide_tag": false }, { "name": "Test File", "colour": "#29393B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223172, "uuid": "382bdb27-786f-4d2f-b2cd-3180330f5cc9", "comment": "Malware payload", "value": "3773b7ed23243388c5ce6d7c5f550782e69e66c5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Keylogger Test", "colour": "#137620", "exportable": true, "hide_tag": false }, { "name": "Test File", "colour": "#29393B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223172, "uuid": "7fceceb6-8dba-404a-a149-322d29dd8939", "comment": "Malware payload", "value": "295dd497ea7762218bac4529c498ce19e95cb336e4193c065e524a337cea61546b12ded6d7bb07b0163331a39c5b93e9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Keylogger Test", "colour": "#137620", "exportable": true, "hide_tag": false }, { "name": "Test File", "colour": "#29393B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223172, "uuid": "640813e5-7ea6-4a85-96ef-a23bdc0101e4", "value": "T114C469704ED30BCFB008C49EA2D788326D4BF83FA8BA758F95E5BE784DD5258A107159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223172, "uuid": "4d95cbe6-5329-4478-9f23-7d5f33c532cc", "value": "6144:11j8yX6w/Osm5NL96iTIZJH5m1QWGZSlnJPZBI6ob3TwP3ws5M4caTtUw9bflEWJ:HuQX2xv3oer9CrtweLBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695223172, "uuid": "3fda55e9-467c-4454-bd19-4f2343f8c07d", "value": 576491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695223172, "uuid": "eedba6ad-5954-45a7-bb82-d9c250b93ae9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223172, "uuid": "11160aca-2761-449a-ba33-11cdff6e505e", "value": "Tedsyy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcaff776-57d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695228653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228653, "uuid": "92cdf289-cb9a-43d4-8330-684f82c678cb", "comment": "Malware payload (AgentTesla)", "value": "8c3b03137c108a4803a5530fd9285c17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228653, "uuid": "332d23ca-fb41-464b-808f-a7ae69dea53f", "comment": "Malware payload (AgentTesla)", "value": "58185723351f7bd9e47b77fe7727f3040677187135e735f9edb943f2ab93ee74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228653, "uuid": "5b98dbbc-e35a-4756-a9ad-7c97f1472ac6", "comment": "Malware payload (AgentTesla)", "value": "24f8f3dfe74dd8196f1e51a53f9c88ee2d0ac291", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228653, "uuid": "77549bab-5b0e-4150-982c-4467f092bc71", "comment": "Malware payload (AgentTesla)", "value": "0b6a7070864ddaa7594a911ef6fde6e96495193e25c8dfccf1238be563b1f02cde404b53c34914b2dc83481c9ad3029c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228653, "uuid": "e46e2e1a-fb8f-4ae3-bf47-ba688c220a26", "value": "T1A633F907B5EB85F2C24857FAEA57D0C453A8D7C2B263D71EB88E135616837EDC40168B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228653, "uuid": "88fd56c7-db4e-4003-92e7-c0b75fc0f2e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228653, "uuid": "3a8f1aaf-0669-4a87-90fe-ef887aa5c900", "value": "1536:GdTU28JNrWnVp3Qp6RE6dD7Ux1qnsK19TAOJGlX4ti9h8Vh8XmCLBG4ubV1vUSox:Gh6om0Ii+MXjnvc1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228653, "uuid": "ac785bdf-72cf-42db-8547-6868c3e538a6", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228653, "uuid": "39c5434e-4523-42a2-a3bf-a4c819ed1074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228653, "uuid": "051086f4-a2a9-42c5-a7f1-917220c2ad03", "value": "EBUKA FILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5219966-57d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1695228265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228265, "uuid": "10c53ebb-8027-448c-8fea-ad08166325ab", "comment": "Malware payload (CoinMiner)", "value": "f999ff8898e03aa45f0bd9deb5652a7e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f999ff8898e03aa45f0bd9deb5652a7e", "colour": "#BE6F18", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228265, "uuid": "2f744f7a-eb43-4031-8603-e88b46327fee", "comment": "Malware payload (CoinMiner)", "value": "597b4d64fc95e5c2178a08140e349190a0eab7eeca2d311e60df8e9a5937f5ae", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f999ff8898e03aa45f0bd9deb5652a7e", "colour": "#BE6F18", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228265, "uuid": "88bdf4d8-fc7f-49f4-8da9-32baddfc7863", "comment": "Malware payload (CoinMiner)", "value": "09363a18fe3657d0dee939000eaa93d9efd6c444", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f999ff8898e03aa45f0bd9deb5652a7e", "colour": "#BE6F18", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228265, "uuid": "9993231b-9ffc-421e-a4b1-7c6c02117434", "comment": "Malware payload (CoinMiner)", "value": "68b9ec2e427ec6c2513dd65c2845a3b3af62f4c1c113a9bccd28cff28b75ab23ec58cfad38968f8476e673f9da16457d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f999ff8898e03aa45f0bd9deb5652a7e", "colour": "#BE6F18", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228265, "uuid": "90abac23-e33e-4798-b4bc-88cc31d8195f", "value": "T13E46E06E0D1D47EEAD1067250C9FD4BB02C9A8313F8A6E76AB405D848BF049D5B6373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228265, "uuid": "21bde7b3-5f2a-4c6f-a594-e8b025e8aa7e", "value": "0fdd3d21d2193b717f076a70dfaa659c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228265, "uuid": "0065425a-5f66-4c7f-b3d9-21a30fbe144a", "value": "98304:71vCOjaFe5eEHroN2kqcX4DVm+tLhrDLonYgKABR:71vvjQCeEHroN25imV/lXUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228265, "uuid": "b893bc82-f53f-4249-a193-5e2e24fa8a6d", "value": 5448704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228265, "uuid": "5933e0cc-3289-4ded-b124-c53101095ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228265, "uuid": "a152aec1-03f7-48b3-923e-46c1452f6e7a", "value": "f999ff8898e03aa45f0bd9deb5652a7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903a9ade-57b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695216070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216070, "uuid": "199530f6-e2df-4a78-91d9-9f01868b733d", "comment": "Malware payload (AgentTesla)", "value": "3ea92181f542d6c5932081e7aa21282a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216070, "uuid": "66000b40-27d6-44f1-bab1-4bdc5ab37b2a", "comment": "Malware payload (AgentTesla)", "value": "59a21410a7c7902a8f1f1b7114699d2ebbf63f2793ff30caae74fd214fc3e91f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216070, "uuid": "18f82ba8-db44-436a-9903-69ba0b1d777c", "comment": "Malware payload (AgentTesla)", "value": "a6a5a6edf380697fcabad21ee30f4c7279f164ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216070, "uuid": "bcefdeb6-6d27-4570-9e85-012076e7804e", "comment": "Malware payload (AgentTesla)", "value": "7e7acfefe9a99b255eb2b77c42ad5af8f7a608a161ddc93f50ae219fa64f1680fdb62069491bb13880c997333cc7bbaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216070, "uuid": "2d1457d3-8496-4d59-abc8-35bbe31ac821", "value": "T1E8548A2035EB544CB1737F532BEDF6FA8FAFBBA1570A916D2500030B9652E84CDA9631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216070, "uuid": "a7893d86-56ec-4029-87b3-29769e8ab4fb", "value": "768:ALEHEHEHEHEHEQoZRi2EHEHEHEHEHEmEHEHEHEHEHEsEHEHEHEHEHEvOKEHEHEHt:kZRhOzIASO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216070, "uuid": "844c7c2c-5cb9-4d8d-aef9-ea3b37c452cd", "value": 300716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216070, "uuid": "1a6de778-1a1f-4480-9cb0-8d7df1ea4391", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216070, "uuid": "03083705-b9a6-4422-90fe-dcfd730e4190", "value": "HVD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365c3538-5764-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695179841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179841, "uuid": "2a9e5159-b287-40c4-87bd-4720c17f960e", "comment": "Malware payload (Stealc)", "value": "2c40cd1531e24eb518122d824e1c09ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179841, "uuid": "8281d9bf-675b-4af1-9d13-5e2ba9c4a013", "comment": "Malware payload (Stealc)", "value": "5a1769f623c6ee8b7b7c488ab030752a1234070b0cc2463540de93e9c40eab33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179841, "uuid": "290cec40-6709-498a-bab9-7503add37f9a", "comment": "Malware payload (Stealc)", "value": "4210f366d9726b99bd226f981f702e343b57b30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179841, "uuid": "a1947b2c-41a3-42c5-bad7-657bfa93074f", "comment": "Malware payload (Stealc)", "value": "873347bfb1e3dd9f2cf13f76db9072b0925cac4a90054cd04be3040fb8f35515093f8287dd74bb4e901e0b95949c732b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179841, "uuid": "7135f51f-0de1-44a7-8e75-74c0f63a5211", "value": "T1F244D022B7E2C472E1A316395470C7A02A7BB8721675C1CB37D42F3E6EB13C19A79352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179841, "uuid": "d5b86d1e-0f9e-470e-9cfe-089ac80dcfa1", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179841, "uuid": "2a4e5c0a-b12d-49a0-a3e9-b95677358124", "value": "6144:iCrdrExv7LlpubmVvfLy3fi4lOFkv6Ta8:iCrFEJ7Hv2q4lOFkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695179841, "uuid": "a321643a-60ea-4caf-be80-1871b7c4d4f1", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695179841, "uuid": "225b9ddc-d813-424d-94b2-a91372b747c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179841, "uuid": "731be78a-0bf1-4ccc-9f4d-6f89e9fb17e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1aefcb-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1695195957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195957, "uuid": "df53a251-6139-4658-a68f-8b3a869be07e", "comment": "Malware payload (DCRat)", "value": "509ffdea13dbc4475d98622c9341cd5c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195957, "uuid": "7c2397d9-bcbe-45d5-bc1c-8876dd080283", "comment": "Malware payload (DCRat)", "value": "5b30f4ac144f54f78fb4697c835581fc47f6a801bf9e3a15a94d1e7ca7ff3f03", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195957, "uuid": "8b22473a-fa75-4d54-912b-45de6706964c", "comment": "Malware payload (DCRat)", "value": "ae1b7e6793ed28ca495e8d6b0222e4e3cdd019a0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195957, "uuid": "1f1e15b7-45bc-4f74-b908-e63c68a8adde", "comment": "Malware payload (DCRat)", "value": "eee2bcfc15fd78f2e25dad1d94fe62b675098f134d6a920244def55b3079fcfeb6e3caaff0c994e00c3afb7cd84c4d65", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195957, "uuid": "c1120811-9eef-43e9-bca9-350dbec82ab2", "value": "T176F533A3BDC5D8B2E01119710AA63711247FBE6527BACDEF67841E1ED6701C0AB31B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195957, "uuid": "34dad04b-f94b-4322-8696-f2d7886691f5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195957, "uuid": "8e42911e-9c47-4657-af6d-456c4c9ea185", "value": "98304:yqZ2V6jpzxO9Z3N/DJwUS9fhYcv31LTuIY+xF2fxaJg:x2ABxk/OUIfhv5xVxmmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195957, "uuid": "49887be2-75c9-42b5-9b6f-a8b134da7118", "value": 3623563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195957, "uuid": "53302610-7d3b-4a05-acb2-94a0908f4c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195957, "uuid": "01569950-5a06-4f48-96b2-eeb2c92f817a", "value": "509ffdea13dbc4475d98622c9341cd5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd46eba5-57d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695227768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227768, "uuid": "efe2a870-8c0d-402f-9e0d-e37f3b67459c", "comment": "Malware payload (Mirai)", "value": "b53864d482242d19a2fe8bd71c364a37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227768, "uuid": "7cc08bb0-8d0e-4735-a24f-cbbd809deb6a", "comment": "Malware payload (Mirai)", "value": "5c080c9fb3bf9fc82230c5e2c54170643285e9db17d7bc31841b65c26b26cd80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227768, "uuid": "e4d70753-d71c-4fb1-9d0e-402731723573", "comment": "Malware payload (Mirai)", "value": "4a827d0c4c1954647071b0eef31fb84113dfd40a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227768, "uuid": "a6f4f628-0919-4aac-8c76-4ef8b772ca4b", "comment": "Malware payload (Mirai)", "value": "1d22e8d46c68ab9255de12a3cce537e8a95a0ac99e277d0a80b3dfe62641ddecc05fddabe9f8ca9c71664abb22084cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227768, "uuid": "98781e7f-ac73-46b2-980f-d0d0ce9f1a20", "value": "T173332807758285FDC099C23887BBB63AC523387E123971EE77C4BE266D86E601E2D494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227768, "uuid": "ddc3b92f-fe8a-426c-8588-1814d79465a2", "value": "768:hdgk/igO5Fwd/OMmseJ4MoWs9dJpmJawHzUU4U0xmQ4hhvgxty:wk/jd/OVseJf89duLJ4U0ehhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695227768, "uuid": "51b47ed1-15bc-47d3-b678-9efad5649349", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695227768, "uuid": "7980566c-f591-47c5-975a-3bbc73141704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227768, "uuid": "3bc996d6-80d6-436c-840c-9c7ea574974a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2f94c7-5795-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695201005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201005, "uuid": "b395999b-4c79-42cf-9c1e-9672272d50d2", "comment": "Malware payload (RedLineStealer)", "value": "4aeecc6f35bdfd778d9b6fcd7deb9177", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201005, "uuid": "5148da64-8440-42e4-bf1a-9a913d21e159", "comment": "Malware payload (RedLineStealer)", "value": "5c21c7802d8c7d49a953c72e54dbfebfd451b6ccf2352fddc8b24d23f8591831", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201005, "uuid": "5a2fd1ff-ef7a-43ed-8a84-504b5929e2fd", "comment": "Malware payload (RedLineStealer)", "value": "65589103423cb045bba63d40267bd00308b34f16", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695201005, "uuid": "6a505ac2-9087-4311-96b8-4ba18893d088", "comment": "Malware payload (RedLineStealer)", "value": "7709c4cb64313db32e94c9bb30b5fe927b17aa694554babc3e2559f828cd7162ee150313fe9299b62823ed0c7840fe8d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201005, "uuid": "c014edc4-8916-4edb-aecf-9cad650be608", "value": "T1EB1422333BC3FC11D62E8A8744D7BC0621ED2E9C6ABF5873C15B4491C64BA6A40E56A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201005, "uuid": "96f064aa-ec63-4cc8-8753-d6775a4dff1b", "value": "3072:uJnwsLc90LX9OP4MAmfSAabriITl/a9x1KqfR+YmZVxutMzFS:0wB9gX9OKm6LHTl/argqfLmZqtkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695201005, "uuid": "9adfcd3d-8b0d-40d4-8afa-d27755f9e541", "value": 194359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695201005, "uuid": "a7f84fc5-3dcf-4a94-9d4a-7a5045a50211", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695201005, "uuid": "f1ab3f08-0309-4034-a11a-447327ef65d0", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dcec35-57c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695219460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219460, "uuid": "09d7209d-c3bb-4e52-9381-be052d15f72d", "comment": "Malware payload", "value": "3e04fa57bc1837dd6eb1ddfaaa0c8fb3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219460, "uuid": "f575fa0a-8748-4c05-a381-6f3b95eb2638", "comment": "Malware payload", "value": "5d5bdbb6eb2ec87262819ae52795e945fd43efe00f47ec28be2f070ef091f8f4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219460, "uuid": "7d9cbea5-6469-4a27-a682-5c0030dc8f3b", "comment": "Malware payload", "value": "52c4646dd2796cb4da7a50f6777e3a18f9d48179", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219460, "uuid": "92ff8f83-4583-42e5-9af2-abc1e5f0240f", "comment": "Malware payload", "value": "c4a1c160e01f301f43e0634ca378490c9ec13b698d17f04a83c14496de3856316b003441d0e4ce5642de739890f3a23b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219460, "uuid": "de29494a-e03c-4ec8-9f54-dfa027725885", "value": "T1A541E367A0CFA2310C769A0879197C53F20B907B252B1959339C50A47F2E1DED5ED1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219460, "uuid": "7e89db90-d281-432b-b6ba-bdc5f32993d5", "value": "48:PkEdlwESPhbEoV2cHfcB7xeMJE3wKFf6dqFK:c0cP9bHfcB7xeMJE3NFSdqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219460, "uuid": "41f06a83-7ba1-4348-9f21-bc51eb9f129e", "value": 1948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219460, "uuid": "2cf2e80e-1c83-40df-808a-650fd0060837", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219460, "uuid": "3ebbdd2a-f154-47ab-939f-504316d4172f", "value": "bat.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7c376b-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229168, "uuid": "5d527fb9-b857-45e7-86e0-427c15341174", "comment": "Malware payload", "value": "56899109fb2dbe3ae168f97fa3db449e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229168, "uuid": "9a3ae9c9-d891-456b-ab77-f665316a4ba8", "comment": "Malware payload", "value": "5dc7110094e6e31b2cdc10fbdf11238115b8a9b52354eb292d30038799f1c93a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229168, "uuid": "7185df63-c48f-440d-8aff-e11109e2e7be", "comment": "Malware payload", "value": "e9d24b9dc82d8f6fd8924cec9e81a35aa7c06c71", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229168, "uuid": "2de3970d-f32f-4b0c-8ed5-6cf2af0613cc", "comment": "Malware payload", "value": "90ac9704f28e24bdec0e939dacd124aef47a943c1d599f005d2ecd84eee24fe7de29f56b3c444438c4c8b08011ace222", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229168, "uuid": "33db0d69-e831-4586-b159-9e5a238a3637", "value": "T178D42381924E4067F1924FF6F11CF7B4D9453EBCD34BA1486A28DC1C08BA6A3DABE459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229168, "uuid": "4dff5ce2-ede0-4437-97d4-c9c725efc162", "value": "12288:PpnWXwE9VfPoK/BUkjC+c+eR7xeM6ISjX6TdN/lQgIOWb+nhs3i5X0:xWp/B9j1KVRaj2jNQgFWYhii5X0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229168, "uuid": "7e967233-7034-40ad-957f-2b6cca7963f2", "value": 651129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229168, "uuid": "b90a0d2b-b469-4a9c-aa71-bcfbcec25e0e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229168, "uuid": "5573a129-3c69-421d-ae18-72362d18626c", "value": "MT-RFQ.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6867ed5-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241877, "uuid": "7daca6be-1fcb-4dd9-b23d-a3f6eaa9732c", "comment": "Malware payload", "value": "a01f920bf9d2fd367bce46b10a89ef7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241877, "uuid": "cd73139c-35bf-4381-b5d1-70221c52612b", "comment": "Malware payload", "value": "5ec7d6fbef976bae1996c12242a96a2f6a1f50a0d1346f3015a8e1673bddb8ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241877, "uuid": "d76425f4-0c78-4048-925d-a1f5cb18ecbc", "comment": "Malware payload", "value": "e0ff11bd79be394eb2715da724d3660b5a6a459c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241877, "uuid": "259ce7d1-4b08-4546-b476-4977b8a1b3eb", "comment": "Malware payload", "value": "83937e89f311bf9a1c50b5818b21f76c04a3419afbd143d76c7d49160b15a5db79fe9aecfeff1bb909e26eebc3d9959b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241877, "uuid": "d13a5be0-90fe-447f-ac64-038b97b1185d", "value": "T1D0F11B93EDA288B6C55DC9BD5D498934E5322A3176E2E2D36FAF580DCC251804BFC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241877, "uuid": "de5adb88-597b-4ee0-8741-064a046c408e", "value": "192:n2xfRq8HebguuREnZXbzNbotbFtZKN8lryIlq:q3HqsREnZX3Qt02g2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241877, "uuid": "416be0f1-d91d-417b-9f41-8af2410be646", "value": 7776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241877, "uuid": "460552fb-4da3-4089-bea8-139dbd6333ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241877, "uuid": "a40d8cfc-0bf8-4fc5-b0d7-2e7c6ed1b7ac", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.21019.14011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa348c1d-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695196356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196356, "uuid": "04b7846e-6709-4cde-8226-dcabd7a4236a", "comment": "Malware payload", "value": "ae5a7b57c75f211fdccffc36998cd600", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196356, "uuid": "921562bc-f654-426e-99e0-46f8a0bf62e6", "comment": "Malware payload", "value": "5f5c2ede26d2d354f2f3edeb1c814bccd78ec6dd2bc74cca672a4b5b83069703", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196356, "uuid": "1ce37749-ca60-48aa-9e21-a2f821669c0a", "comment": "Malware payload", "value": "3d26fc60bca3f9bc4b9d52ca5ddffb77edb14bfb", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196356, "uuid": "e2870baa-96cb-47c5-bb9b-92fc3374e804", "comment": "Malware payload", "value": "cfb9478abb9b19b371bb786f83668774ae23646bd6e6623699899bc116fa42190366c28db526710fbeb05f9b159e4271", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196356, "uuid": "d46d737c-3307-416d-83c3-78c9312a4225", "value": "T1ADA39DE2FB5AEC25C89D43390DF6C1915A17BC512A37938B3259F31E2BB3A908D43752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196356, "uuid": "9d2d5e6f-c78c-450f-a5fc-3e43ba6c3e6b", "value": "3072:NrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnASqtJE2zuxq+fr9wBLa71ba2ryLTHeYp:FxEtjPOtioVjDGUU1qfDlavx+W2QnA5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196356, "uuid": "8dcfc9d7-019a-4bf3-a4fa-832d2d03528f", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196356, "uuid": "bec986ba-fdc1-4d98-b97f-e2802c8b4692", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196356, "uuid": "b90d2584-51a2-4dc1-b4b8-f2c77abd9d86", "value": "Romania_Request_Imun_SRL_09_2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d925b38-57b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695212441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212441, "uuid": "bd196fdf-4fb6-4fd6-a196-bcf2d740d8e6", "comment": "Malware payload", "value": "4afcd8e7269b8f8e3947373f2c48654d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212441, "uuid": "e2eb796e-9b13-40aa-9635-a2100a767d09", "comment": "Malware payload", "value": "5f5c3ca52798683fff573ff73853953dea02cb6c6d9d6fb76570b0a0c19f8202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212441, "uuid": "83604adf-2ccf-48d0-a3df-3bbbada05bfd", "comment": "Malware payload", "value": "427c46d4cbbd1eb2bf406a5c0d4ed550ecb4c094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212441, "uuid": "3f9164ed-a77e-4db4-b471-85efe92945d6", "comment": "Malware payload", "value": "dd3d2254b699da910b3019811e4a24d2000394ec5f9bbf553ada498d4512fa3404a1bd840249cad53e2f096acbc5c23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212441, "uuid": "468af426-d502-47e7-886b-7b541d0da548", "value": "T1DB75120288EA40C7D0BECE73856ADB165F7BB9242938D61BAF584DF91F7A590C438347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212441, "uuid": "571d1e40-3a04-45a8-af32-a37101bfeee2", "value": "432ad2511bfe7273c7f761e11ce33afd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212441, "uuid": "4b731f1f-e208-4fbf-be4b-69ee5b4e95cd", "value": "49152:tJt2LGgHZNlLi+wiW+CqeSb5VFI7xtDCzcQ38h:tn2LNZNl0l9rSbMh4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695212441, "uuid": "192483e4-9cd1-4f95-af8b-9d782af2f9f9", "value": 1600000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695212441, "uuid": "b4d13d12-5ca8-4a17-91e5-4682486d064e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212441, "uuid": "e9df2b55-eb87-44f5-8eb1-0695f4c66012", "value": "5f5c3ca52798683fff573ff73853953dea02cb6c6d9d6fb76570b0a0c19f8202.dll.000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dccaa6-57af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695212207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212207, "uuid": "2535603d-3687-413b-bb3d-b51bbb57990f", "comment": "Malware payload (RedLineStealer)", "value": "f30f8eb4d4f6f2e07185122d3b8c84b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212207, "uuid": "4dc88e37-dd45-442a-94ae-adc9d2cb865a", "comment": "Malware payload (RedLineStealer)", "value": "5f65c3d0edd547dafcfaa60837ad5f5e6b14d253915b954c1f21c26304f7ba76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212207, "uuid": "7defd66d-a650-4fae-bb0c-a4a78faa7ea4", "comment": "Malware payload (RedLineStealer)", "value": "a61ac3ab3099eadc55e655cd3df4a822b684b5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212207, "uuid": "73066cbe-b660-4fab-b4ec-e9d49e459d66", "comment": "Malware payload (RedLineStealer)", "value": "73af60bde7387f63c4ddfa6c0de0b5eca22be88b9184b6d09df8c62ebafa210c0bf654627e4902400a306baecd6feffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212207, "uuid": "3d1fcaa9-e748-4d14-a958-41a991d5ca4f", "value": "T1F0652343EBD182B3DCF1177099FA52D30A34BEA86DB552AF3B462E5659B24C040317BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212207, "uuid": "6c156dc6-deb0-4535-8eaa-1172b18a1879", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212207, "uuid": "01bf8b78-5b32-49f4-9e10-2c4c86b0f02b", "value": "24576:3yylLvovkR6eVXbw05sGiYMYQTdZEBo+nWaBE4yASz2FNXYMvO1P8as/g:C0LOY6eVLw05ZqTdiBo+WaBvyDz2TVOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695212207, "uuid": "d641a045-122e-4d67-ab89-c3c3450af991", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695212207, "uuid": "e53a6420-b072-487c-bd24-14d28f5c819f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212207, "uuid": "f1868644-93c5-459d-989e-121497d2d542", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944cbdf7-5803-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695248289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248289, "uuid": "d996daba-3c08-4f14-8336-d042981cff02", "comment": "Malware payload (RedLineStealer)", "value": "9f7fec4fca955df95be2729e0245cbf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248289, "uuid": "2d724159-112c-4d6a-879d-bc9ca72b08a6", "comment": "Malware payload (RedLineStealer)", "value": "5f7a493b62d573b0559fca032defa29287c77280217ba21a5d5c20c9a4d798fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248289, "uuid": "d2867d39-fdf5-4c4b-8aa1-c275e794a7cd", "comment": "Malware payload (RedLineStealer)", "value": "795b6c76e2a7a2fad1fdf5535c53146f5b22d5ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248289, "uuid": "c67fe07c-b39f-48ef-a3ff-a0679d611f45", "comment": "Malware payload (RedLineStealer)", "value": "5a2e4755d164c33477b2b7d3849ecdd75fccff9e40d102c35f04f4a3246037ce62368ffc7e83a9318552c7326ed685f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248289, "uuid": "aba76f3b-9230-43f9-ba96-e2dfc6b11d43", "value": "T142552347AFE44532C9756B701EFF13930726B6E10C78872A2398984A5CB17C0E6B5F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248289, "uuid": "1f34bd02-b45c-43c0-9b62-9c55e08a20df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248289, "uuid": "bb77627c-5769-4efd-9855-f7c1fd755d68", "value": "24576:lyR1LGwO+UNaK1D0bHgbYCROFUQxoFRsM/:Au7oOQHIYCRKUQxoFKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695248289, "uuid": "8a688772-299e-4ba3-b162-1cebe7da2ad7", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695248289, "uuid": "20b922b8-bee2-431b-b3f3-a7e39e983f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248289, "uuid": "a29d098f-cd2e-4749-8816-ab47133ccb9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bda892e-57e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1695234316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234316, "uuid": "21a9fab6-b742-42bf-a156-bfc58bdec30e", "comment": "Malware payload (NanoCore)", "value": "09768ed665365838e5f15dff9c5b3e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234316, "uuid": "aa46b1b8-0125-4645-a840-ea9a2b7e27c0", "comment": "Malware payload (NanoCore)", "value": "6056ddf4fd5f58f421883da0176a32cbad5458c80d33e1e0d4f1ddcf28f6d21d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234316, "uuid": "9f33c941-b531-4b7e-bae4-8c9bbc4a788c", "comment": "Malware payload (NanoCore)", "value": "385a907d5646ef30bf470784b89867b1ef1737d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234316, "uuid": "39a3c3ec-48e3-4510-b909-66a7f59f8370", "comment": "Malware payload (NanoCore)", "value": "6ce0255b57f1eeccf575526f6944e216d5d76fc61f9725b1faf353cb19ce082aa4bc8bd30ed654e99cfe4d93ff12ab32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234316, "uuid": "f00cab54-0605-483b-bdb7-5244572f4b66", "value": "T15DA402657B69452FF29E817CB0120256977CC2E3D9C3F3EE6DC864B25B626E24A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234316, "uuid": "0762c762-a40f-476c-bbe9-874a8c1b7167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234316, "uuid": "794c590c-2da1-4720-99da-937c798a216e", "value": "6144:MLV6Bta6dtJmakIM5fBnRhWiJ8bEQj3MrRFW6V475A1X90g2l5TwBrEYFNHz9QC5:MLV6BtpmkoblRcKYg2l5TwSY72C1zvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695234316, "uuid": "ca8d3da3-ce1a-49ad-9cfd-ff61a0d818e4", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695234316, "uuid": "ea9eb83c-365e-48b3-9712-d1d11a6538e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234316, "uuid": "aac6fa7d-c487-482a-b8c6-d4f9e6fe8c1f", "value": "09768ed665365838e5f15dff9c5b3e74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217c98bb-57f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695239936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239936, "uuid": "95923232-6836-403f-9640-cb3f521d894c", "comment": "Malware payload (RedLineStealer)", "value": "0cce35556ebd5499fb3d44bd16226789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239936, "uuid": "6f72e6ba-e784-4e10-be78-011518bc3f28", "comment": "Malware payload (RedLineStealer)", "value": "6104cac68842b79873455acb5842ede8be312d02f6e8dc4386e0d274b202a87d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239936, "uuid": "796524d8-869c-49f3-9807-2ad710f239d5", "comment": "Malware payload (RedLineStealer)", "value": "27f8e2d2159c4af2193e284a30be2c0510309838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695239936, "uuid": "9260f2ef-eda0-4832-9a7a-e1f30dbd34ad", "comment": "Malware payload (RedLineStealer)", "value": "3e68156e5eea3c43b09217639510a6eeb9d0647a7d5f9373a0508faf8e7e8ce8e30a5fc4c53b97a36dbeea5cd9433516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239936, "uuid": "a4dccf3f-a42f-496b-a3bd-fc25826ddb66", "value": "T19D7402123992D472C2A785B05474C7E4693F7C336AB9484B3B543FAE7E313C1ABA6316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239936, "uuid": "9697c808-04ec-41cf-ad0c-ecba4c3f76b7", "value": "d13f0a4e1c3acd1a644a413a45b35009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239936, "uuid": "1637e2cc-b7e4-435a-99e8-50af2bb467d6", "value": "6144:tADhNMJzxJiYkTfj3zCGniTyhgSw3Z5FbTIs4YvIhccdWWHwtpG/6h6nTCL6:tAUJnTqb3zCyjdQdT74YcccdakTQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695239936, "uuid": "a3c2d422-9501-48dd-85fa-0af1dbbe64c5", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695239936, "uuid": "6f030978-7779-48de-9b8a-c067c4e48f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695239936, "uuid": "39e8043d-727d-4b7f-9310-7ea137bcf950", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5125c34b-5804-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695248605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248605, "uuid": "de8d3ccc-4af2-4101-87a6-044f1e504b0c", "comment": "Malware payload (RedLineStealer)", "value": "5bdce2b4f3585867d80ea57176099d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248605, "uuid": "c2fb7956-696f-46fc-b93a-1bd6141772ef", "comment": "Malware payload (RedLineStealer)", "value": "6169d38d316103abd5188a09776debf8359458efa345e540d22c11a6406e5353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248605, "uuid": "6673f2a4-a024-43bc-92d5-548ac1d85756", "comment": "Malware payload (RedLineStealer)", "value": "6bc79e52ef23372b337da53ac3d5177494c58158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695248605, "uuid": "c50e810f-9e64-4d68-8d84-8c7d969694a9", "comment": "Malware payload (RedLineStealer)", "value": "7e43b7122d04834fc01239118b6b94c4d2cda9fb04870c61a92f0d1e4f238319121ac6ab6343b387f4c1d0e67f4fb83f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248605, "uuid": "581bfa96-6a7b-4a86-a105-b77e4303af60", "value": "T17F7401327592D032D65680319830EBE1767FBC23596C894B37A43BBF7D313A1A76634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248605, "uuid": "a7737a4e-9cb8-4637-be66-8b815486ba7f", "value": "d13f0a4e1c3acd1a644a413a45b35009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248605, "uuid": "1ec005c0-5782-4e87-98e6-2e8ede45be43", "value": "6144:21DNrkJSJSPf/L9E7aBcXbXA6CvIfCZWTdJqdOy9d3mTCL6:216JNPfz9EOE/CvIfcGvqUyPeQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695248605, "uuid": "95712e43-cc20-4ea5-9aa9-c654739eec28", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695248605, "uuid": "df40c35f-68e8-4ea6-ac83-dd3996897d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695248605, "uuid": "8cd8a846-f677-4ee3-8f9e-38117b02e06d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4779b8-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1695229055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229055, "uuid": "796f346c-0aab-467c-a895-db9bd0cef9c0", "comment": "Malware payload (STRRAT)", "value": "fb3653b1e95cc1ec2ff33e3534c2e425", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229055, "uuid": "e3e4f415-9e5b-4ebe-8e8e-35c276b6bcc8", "comment": "Malware payload (STRRAT)", "value": "61eee816b2189456d6cdaa92ad067fbb23753dcdb969c7adbbf315d8e59cff87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229055, "uuid": "7b884722-926e-461f-8d81-10f0aa29aa8b", "comment": "Malware payload (STRRAT)", "value": "b2d5623efc547458a619d5904536d23638b4e29d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229055, "uuid": "1181637b-3429-4d80-b8ed-8ec808fdb384", "comment": "Malware payload (STRRAT)", "value": "342aadf9975c530faf3450775b52e97d312fc91ce48e562687d002b95d755f94ae82766bbd3c0e2bb35e0437149d6ae2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229055, "uuid": "5bf84a92-043d-4953-aa7b-d1de3354af44", "value": "T1C055CA8626787A06D3F3EA24C311E522AC75EC232DD711D27DC47E4AAEB6C505DBDA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229055, "uuid": "b315193e-6407-41e1-8e1f-668546a23f15", "value": "6144:MQ7th6IvkW7p8YwVr9k74AVw8OyGhhd16PsKayC+wGUeGer9gACWxaK4KsZMibjN:Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229055, "uuid": "03d5198a-856c-4339-b85d-1f3ca39c71ba", "value": 1292132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229055, "uuid": "11f1b35c-9fde-4aec-889d-16fcc3caa826", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229055, "uuid": "57290058-4ad4-44c4-87d2-0f7383eb098d", "value": "swift copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27a9fe4-57e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695235857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235857, "uuid": "30edf4dc-7c33-45a7-ba50-79ca789e37f2", "comment": "Malware payload (RedLineStealer)", "value": "57403da8678652e86c1322aae3b5d952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235857, "uuid": "157bf544-8ad2-4978-ab6e-e088318e6040", "comment": "Malware payload (RedLineStealer)", "value": "6257e770acee53aeddd2f5fc4d0891bf592d58ac8b97d3648be66761360749e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235857, "uuid": "294d3431-bda2-4d27-88c7-6fb1ce6ea599", "comment": "Malware payload (RedLineStealer)", "value": "380787112a68d9892e022bba206ac68ed71a967a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235857, "uuid": "8cfb2611-7f79-4499-b2d6-edf8d98e16c7", "comment": "Malware payload (RedLineStealer)", "value": "2af90803aa1ac8caa927b5079bff4cbc21b638a3eb47fe2786031498f96029abcf43950325a2d2172503558751b60e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235857, "uuid": "66e12ca3-b348-440e-808d-9d93a623b6ea", "value": "T1E074021179A2F031D1A785304874DBA23A7FBC73A5B9C90B3758276D2F307929F6A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235857, "uuid": "b41b738a-370d-4a32-9b5a-548578a5af0d", "value": "f441e1f89e815eda74d641cd1f758949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235857, "uuid": "322e0419-7d64-4ce9-9146-33e1e192820f", "value": "6144:QUkC7uqKYn13RMvBor+kfZujlgzZeYJCZHdGl5n48YkT/:QU2qKUDkQfAgMYJUdGvn4jM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695235857, "uuid": "64f2758b-5180-4ce2-a79b-daac23be046b", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695235857, "uuid": "61830f27-1548-4ee0-853d-426420287b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235857, "uuid": "fdd7ab86-3b3e-480d-aad7-a0dc43414d61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d633bfd2-577f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695191706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191706, "uuid": "46276ee9-bca0-44e2-90d0-315a23d6f0f6", "comment": "Malware payload", "value": "56b10e8e82c577aab03f7d8aa2994026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191706, "uuid": "df4b949a-32e2-441e-be25-0cf38b13b62f", "comment": "Malware payload", "value": "6269d2430c9fedcff63eb9cc3f9f9d29f5cd179e58cbd67508e91836c2a6f6ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191706, "uuid": "f8240f7e-9101-44f1-8312-b163e355093c", "comment": "Malware payload", "value": "2c6e3d3017e85c9d324b84e3abc406f49763367d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191706, "uuid": "639be8f9-2d4a-453d-a1c2-268e4c645c9f", "comment": "Malware payload", "value": "41763e452a2fc8ddc941f9ff2e171be5b33daf0415d8f5d159c9ef5bc719bb078eb1ea730d4c8953db48f12fbdc01561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191706, "uuid": "a7e3d82c-b91b-436e-bfc3-bc21f42229f1", "value": "T11352D0D9B80D8950E8441D3AAD8AE3B15F7660DBC227D1039F35DA123E567F78C8960C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191706, "uuid": "26b23a03-0af7-4ceb-ba61-022072d4559e", "value": "384:E0Z/0gTrCbvNcoIhtLCkAgEbGn+Ar5foUnBxo28x:D/TYCoIxdEk+AxoTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695191706, "uuid": "6aad336a-2d69-48b6-b174-7e314d5342c1", "value": 14274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695191706, "uuid": "d6f1a66f-9441-4274-96e6-aacd6cb0fade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191706, "uuid": "573e608e-0c42-4a7b-aa44-6e852cc03dc2", "value": "SecuriteInfo.com.ELF.Mirai-GH.23949.6882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7ce8d4-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695221543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221543, "uuid": "9e87abf3-b0e7-4440-98aa-78a974a70a8a", "comment": "Malware payload (SnakeKeylogger)", "value": "fd729caac6bb713b2142079eda41f0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221543, "uuid": "d2367e25-036e-46d4-8f9a-cb44655829c8", "comment": "Malware payload (SnakeKeylogger)", "value": "627dc37a4c486ebedd53d20f173b884014f2a662bb82afcfc105ecd10fe3aed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221543, "uuid": "013602ca-1d0a-4c4a-8714-b6c19b8601d2", "comment": "Malware payload (SnakeKeylogger)", "value": "718c64817292ccf60e5087293b1c3fef01df802b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221543, "uuid": "a1149876-859a-4748-9f54-a69a5aa85249", "comment": "Malware payload (SnakeKeylogger)", "value": "30d4faff95cb5cd22f1620cc12b5d2c2fbacae3412f5d72562d43ddb427098dd1d8e3f3d5bedca178edca3b30a77b052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221543, "uuid": "1789fd55-9fa6-42a7-ad8e-0a5bd3ad9a29", "value": "T192B4121836648E41E41A0BBD2C7104416772EA57F4A7E7395EC9B0D94FA3B7CC724A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221543, "uuid": "3adbd73d-1489-475a-bcf4-6e38b4dd4be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221543, "uuid": "b9515312-a3be-4eed-a707-e13fb02b0a01", "value": "6144:Xf4NOk8oV/BR1z/8XIZwmlq/0efN0Ktl7ck1XSOiMulCnnJjH5y09Wh1amMwhTHp:qq/DfNWk1zduim0Y+wTHVKoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221543, "uuid": "166f69c1-43f5-4884-bb57-471efe820963", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221543, "uuid": "0010ea7a-6143-4588-984f-853ccc967982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221543, "uuid": "3f753594-7e6a-430b-9528-0b579fceb526", "value": "PO 908534243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fadf5d-57f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695243109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243109, "uuid": "51dbedb9-2838-4f39-94e9-10d0a157614d", "comment": "Malware payload", "value": "0f318fce3e6aa0e4a5dd760aa554b78a", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243109, "uuid": "7ea0b95f-17a7-4383-bb2f-f90ec9819d99", "comment": "Malware payload", "value": "62b01d20ce512905a2bcb7cc399eb5b0ba6510c6dafc0311a6f93ed5f0b35978", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243109, "uuid": "83dc4b84-4989-4977-ab18-dfb2bbda522b", "comment": "Malware payload", "value": "87af193cb52c4ae3cf0c22f8fb5e4267b3008bce", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243109, "uuid": "660a144b-12ed-45de-b556-e332d9062ea7", "comment": "Malware payload", "value": "c4cc431f953ca1844a77d12f52a7196cdfeda92bc4d9e794a4942963acd8f51653b35794e7df6f53fe2d7b88a6c2533e", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243109, "uuid": "e9b4c98b-163e-43ce-84a3-22b53447f9f2", "value": "T1EA41CB1567E9932AE2F60F3A987723618D37BE65D971CB0D02A0988D9854B00DC38F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243109, "uuid": "e01a11c2-9b40-4143-8716-2c3c6787889d", "value": "24:8atWJCn+Oma8RA8Pe4+/oaHO1i85+5aHKqm:8ar+Tw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243109, "uuid": "8d6c418b-ff20-4440-8916-346677064c79", "value": 2137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243109, "uuid": "e5ed0600-b02a-4156-bffe-18a505567fb0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243109, "uuid": "a0489426-9a2c-4d95-84df-fd87448d53ed", "value": "XK.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5975b5c3-5798-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695202234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202234, "uuid": "97d88b65-3bcb-40a4-bee6-5e1cd8ef4593", "comment": "Malware payload (RedLineStealer)", "value": "08655933694ff2f4c25fafff8f1fdd2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202234, "uuid": "1ab9fc9e-90ca-4a7a-bc14-fb5c155054fe", "comment": "Malware payload (RedLineStealer)", "value": "62eee5d0dd1271e7e25097550a41f94896b61ce64bde5bbd4c5dec9ed0d697d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202234, "uuid": "9316cd99-b2d9-41f4-9b57-a257a1c3b750", "comment": "Malware payload (RedLineStealer)", "value": "5b73e5daddf6f7410a017490939e155d80ac24ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202234, "uuid": "905e4aa6-5734-46d9-9f0a-73e26a539a9b", "comment": "Malware payload (RedLineStealer)", "value": "e8669d4ec0ab777648ef911ee9d93369e70fd084a7125e4f844b35292a9c3606336de65ac98ee9930e53d57a04feabab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202234, "uuid": "318a65be-6795-4e12-8aff-8c18d5e7ceba", "value": "T122B5E0426A31CE5ADBD93F799187803D4F60D122B327B75F1F2D66A97D822B24E013C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202234, "uuid": "4cfe40fb-85f4-4eed-bf75-15a6d04f8db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202234, "uuid": "60e0bcbd-1440-4478-9999-421ba69ab79a", "value": "49152:ybU16V86Hhc8X9ihVRqpNFrLs2XHY7zwfnCVxGfkY1HlQw:wU1kFc9qLFPtXYHHVcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695202234, "uuid": "45388956-447f-428b-b622-bb01b8db54d7", "value": 2452480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695202234, "uuid": "ecd1665c-0c7a-433a-9bab-d026e548f086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202234, "uuid": "42b05669-e91e-4610-b16a-44d0f116ba8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc755c9e-57b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695212761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212761, "uuid": "0b43b728-8b40-4c03-b321-ae20337c716e", "comment": "Malware payload", "value": "c0cc136904bd0de0abd2c3135babf0df", "object_relation": "md5", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212761, "uuid": "f802a4f8-2203-456e-ad8e-354e2fa0cbc1", "comment": "Malware payload", "value": "63a753e31cc8a164cc4fca0d18ac92332b603cdfa3c00074cf4a42bcc72d230d", "object_relation": "sha256", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212761, "uuid": "cf70d86c-6668-4521-83cd-68b06000b73a", "comment": "Malware payload", "value": "a39ced21ff3e482be800db4666359a1763e00df2", "object_relation": "sha1", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212761, "uuid": "6a42a406-55e4-458c-b327-664f81172908", "comment": "Malware payload", "value": "111e88a225fe0e22b290f3270ca5ac5516d02adc0cc3a28c71af5c50eeba1b934f2489518aae8fd2b73e8a6358b941aa", "object_relation": "sha3-384", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212761, "uuid": "16191dac-ce5e-43ee-8a1a-6699671a8ddf", "value": "T1E2749C76B4B0ECF27B1D353DD6266328D95EC86B1711206DB9144AC2B3F274A1B890FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212761, "uuid": "dabb1793-c5e5-4849-9a77-80dce23ef82b", "value": "6144:knaIOjo7QzYN1zSweCWkBf2VGKQmrHcaK1LgEhf9MPr26goMvz913XnZWsVA:UIo7OY1zfeCWkxTLaPKFgK9srwPXVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695212761, "uuid": "14d02712-1e50-442e-975e-bd037d07bd6b", "value": 369708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695212761, "uuid": "dc14fc51-221e-496f-a696-6240cb5aa33a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212761, "uuid": "74842bdc-a294-4de7-a62f-a457c25d1d27", "value": "Respiringf.aaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0eea8c-57a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695206939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206939, "uuid": "8fc27c5c-6335-4111-8263-c2441bbd76b5", "comment": "Malware payload (RedLineStealer)", "value": "c44085d4f410b0335bfd853629159a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206939, "uuid": "da180c01-2710-4fa8-8c1b-e38758a1eefb", "comment": "Malware payload (RedLineStealer)", "value": "63cebbe380cf99272e0d8eb7a3ed9b84633a3eaa048484ab83019b570e711383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206939, "uuid": "20b93bd2-c785-451b-85e4-23b2477fc069", "comment": "Malware payload (RedLineStealer)", "value": "6de766aca6eea98ddd1ac940c8110ef83c6df94b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695206939, "uuid": "f4f32043-13d2-4af4-b6ba-380472e9214a", "comment": "Malware payload (RedLineStealer)", "value": "0b10312fab14c05e49b371cebe9801fe0882752710de5f684754ad269f81e6a4c5b24a19f3505bf6a8ea84918ce8666f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206939, "uuid": "2e6432af-0830-4a78-808a-b9f5872c96e8", "value": "T10E359E20388050E6DDE211B74EACF725D6FDA8F4071916CB16DC26EFD7296C16B36A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206939, "uuid": "a369bca4-9df2-4528-a5dd-fc07914864ee", "value": "275c1ac8a0a90e452d90c6b023f705b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206939, "uuid": "fb15d28f-31ab-41c9-9565-922c61f00ca4", "value": "12288:AsDd2dAHOvLBwvJ5ykrqJd0YSFYvtZ4tGxHXm0luGwGKblxzxDBA4Aa5ou:1J2dAHOvLBwvjYSIYkX4lfd75B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695206939, "uuid": "76e1f216-5e13-4ffa-ab9a-abec6aea0818", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695206939, "uuid": "68ca434d-9ab2-4278-9cfd-1a45c49703f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695206939, "uuid": "f7fa27d5-6289-4b71-ae47-76ef20d7ce6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e71a10-578d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695197424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197424, "uuid": "6e92d330-ce2c-4d53-9111-7153c551c1b1", "comment": "Malware payload", "value": "e45f50c4464176306db106be730af3a0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Scammer Resi JNT", "colour": "#91558F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197424, "uuid": "785ce9d0-9240-4162-911d-7a205642e681", "comment": "Malware payload", "value": "63efa868ab905bad64bf22f3396f6100a228c47e14c662b1bc6860757ae95c55", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Scammer Resi JNT", "colour": "#91558F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197424, "uuid": "e7386d55-cc96-43a7-bed4-551761ba6ec5", "comment": "Malware payload", "value": "16de7f1ac09f3667627d5330ca14b0ddc45b68c2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Scammer Resi JNT", "colour": "#91558F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197424, "uuid": "55638f2b-f75f-4873-8fb0-59bde042dea3", "comment": "Malware payload", "value": "924359d30a00e48611397d903a58bbd576725b6fa526b112f1622c5e751e81689f7ab52cb0a59de212083094911006ca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Scammer Resi JNT", "colour": "#91558F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197424, "uuid": "eb0447ac-5f81-4308-86ff-707ab7a6cf8f", "value": "T11A26DF8AFB48A96BC4F7473345F6523211074C668B83D6839985F63C5CB76E04F9ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197424, "uuid": "96b234db-dd92-428f-a0d0-067565236f29", "value": "98304:9lac3pnsSFi7Z6WAhIzr8xEw9/3Z7A5Tn8NzTjpJ3ocst1d2ZrY7G:ic3Znit6zlvA5Tn8zTjpJ4LrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197424, "uuid": "31c2b7f8-d3f5-4a6d-833b-11e72b1845ae", "value": 4493055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197424, "uuid": "84193b21-3a0b-48c8-b8d7-b70286e5a14d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197424, "uuid": "33fb72bb-d641-4218-9128-1cb528984473", "value": "Cek Resi J&T.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429df431-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221523, "uuid": "53ad1ddd-80e8-4959-9216-490f365c921f", "comment": "Malware payload (AgentTesla)", "value": "a07885e82521c4b950b11cdf29d7d5d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221523, "uuid": "67ebd69d-e23f-420f-84b6-15b92b634e2a", "comment": "Malware payload (AgentTesla)", "value": "643a79ec31ac0c11b09c046b07ba57a6e36f50260da516b980815d3fda0de0b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221523, "uuid": "7368a91c-f9d0-409d-aeb2-7e0630925e18", "comment": "Malware payload (AgentTesla)", "value": "7ca9b59b0af45f9310bbd1e11f228e740d6eb244", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221523, "uuid": "4e8bdda8-0fc8-41f4-9bb1-55448c6100a5", "comment": "Malware payload (AgentTesla)", "value": "4f792264a85d42978c424685c73e00a3ca43bf11fbc5f49ca494e52ac62e7ec3e438d1e2bca46d52a66554c962568545", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221523, "uuid": "d53ec563-f8c6-42ad-885e-cfba232dbbc5", "value": "T112D4221436B08F96D8AE07B918B00412A3B0AB13F972D7696DC6F0DA17E7F954641BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221523, "uuid": "3d1978d2-c3e8-4dff-8546-294f4e343ddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221523, "uuid": "78130562-4841-4d93-84bc-c373e32068c8", "value": "12288:nSPjK6hF0FbstyC5kyzXJJM5oP/vNjMsFn6H+5B:SPjpMFQykkUJJoo3tPFn6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221523, "uuid": "34fe213d-f1f8-4949-bb1c-e932cfc56525", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221523, "uuid": "55756dfa-cce0-48b2-940f-a0130f077c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221523, "uuid": "7001829c-04f8-4289-aafb-082b1382d61f", "value": "H01534377567 DEAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e1d643-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695196582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196582, "uuid": "a3fd18dc-e292-40c0-b60a-209ca1634f92", "comment": "Malware payload (GuLoader)", "value": "29b35d094dbe61118bb5056182ad1330", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196582, "uuid": "dd312441-77dd-4bec-8627-85d9416aa402", "comment": "Malware payload (GuLoader)", "value": "6464e551fdb40e3e53094ab35dab3aae0c5485886061520c7ef05b96a74fa8f9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196582, "uuid": "e4bb2dea-a56c-4fd2-8bbf-0143c6c86c71", "comment": "Malware payload (GuLoader)", "value": "b90ab87316fa2f97bc06b3d886579a2f743114c5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196582, "uuid": "1884362c-7d3c-4fdc-b9c0-b44548dd2ec0", "comment": "Malware payload (GuLoader)", "value": "ebd0d2a47acf71c61e7ff174b2adb5bb273e3b2e435dcfe1d015d23decdeff3d0f5cf42ae127a2a2589c175e593c033b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196582, "uuid": "eac5655c-0028-402b-aa59-9d0050f6ef26", "value": "T1DB033860CAC216384A571BEEFF01954289FE813A821AC01DF69C177E611786CC77EFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196582, "uuid": "c7a4cd01-7c0b-4149-b260-811d645d84ef", "value": "768:corMtwTVlHPwlR5EQi/Go0tMyCpgmOmDvpMpzAiPhGSg0GCG8x:coQqPwN6GoX+m9MkiUH7Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196582, "uuid": "176ec55f-397f-4f29-8ccf-67ec46b8faba", "value": 41233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196582, "uuid": "89ea9e5f-ba84-483f-9c91-8f5ee3ca10c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196582, "uuid": "68202c6b-abd7-43f7-ad33-fdc2db97f47e", "value": "P209943.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0995299-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695196850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196850, "uuid": "059929e9-cbda-463a-ab17-9cdf5d175631", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5d4a910933634247d8805f20a42b44be", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196850, "uuid": "693e031f-a5eb-428e-941f-09be4f5ccc71", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "65acdb52aa2c499e800fa4ea34154c2a18038e1f8ac27c200d9230141a8996e1", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196850, "uuid": "c31898d4-3858-4ef6-a977-cc8b755779a1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a13533452ddeea2aa3b465f736909b7165e629b1", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196850, "uuid": "f47248d1-24c6-4d90-b0ad-790a0dbcfba3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "300a0fd39c000eae1ba63874f6fb8d3e8bea908a639b13374a01e6dbc2014b24861327b338452addaa67ffa800b36aca", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196850, "uuid": "1dd1fa23-c1b7-4136-9b5b-5b5346527501", "value": "T10234BF123491C073E1A345354865CBB46E7FBC735E2586CB3B942B6EAE322D2AF25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196850, "uuid": "282d78d9-4204-44ed-82a7-e2c26967b6f7", "value": "ebb1ad55f48b70b0a48dee8a767738f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196850, "uuid": "2a72ffaf-6d2a-464d-9651-a0d470286bbf", "value": "3072:HKDS09UshU3V/dVqWMbV7iItkV2lrkKbMXioNh5gKbfVUoUM85/BZWT1aT:IrjU3V1Vkp7imkwlrJBoX5PzzZuBZWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196850, "uuid": "f576f668-297f-40a9-86d4-6c9292d35676", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196850, "uuid": "d248703f-2b87-403e-8c2d-d0d7c14985a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196850, "uuid": "ece6c02a-8423-4c4c-b802-97a3faf89409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ea5e51-575c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695176723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695176723, "uuid": "e6bf7cd5-927c-4302-b16b-04627d870c1a", "comment": "Malware payload (RedLineStealer)", "value": "8795153539ba9f125be42a9c79de9709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695176723, "uuid": "b60fed0e-a03c-47c8-a8ce-ad38edd5cf04", "comment": "Malware payload (RedLineStealer)", "value": "6686b454705525097896848e22f277bbde2255d166479495db22d7d38437b6fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695176723, "uuid": "7d1bcfaf-4c7f-440d-8822-0653b66e25ac", "comment": "Malware payload (RedLineStealer)", "value": "082377ba86da3ffac635f4dd600d14076e82ee10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695176723, "uuid": "326c8d49-012c-42e4-b3df-c0494a33b34b", "comment": "Malware payload (RedLineStealer)", "value": "e34526a88c3917faa08b00155d01a36bd4858270fe0035dfb5b241115c3a0c8dc2c9949147cf765427fa17a03c19a6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695176723, "uuid": "26465a32-cf01-4450-88e6-7eca3232d42b", "value": "T1EC65231B56F08165DDBA37B08AF703570F32B8B78970834B3B95A50A4D632493A3936F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695176723, "uuid": "0b27f762-1f2c-41c7-8147-2dd67acf6991", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695176723, "uuid": "f52664f4-4f33-44ae-99e7-31afa8b33b48", "value": "24576:Syss7Yzlk6OVfhpe7zkG52hSkFIoZyyRWe6fx+fubh3CmUlcIiaeRfhkaRI10eOi:5J7YzObVPe/5ISkFI7tfsUh3slcIwRpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695176723, "uuid": "cb01a3d8-ddc2-4ce3-ae7b-e2e50d3d4500", "value": 1469440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695176723, "uuid": "dbe02092-7349-464c-9865-375a7fd823ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695176723, "uuid": "680bc074-52e9-4662-9a2c-523482a21890", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819f0832-57f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695243103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243103, "uuid": "1ba78994-1dcb-4545-b2dc-5de5ac3ac6e0", "comment": "Malware payload", "value": "3b9e3ec73aa1ebd4133a1bbc6a26e023", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243103, "uuid": "e64d4410-3cbb-4dd2-8cae-b895c9f6ffe0", "comment": "Malware payload", "value": "66e3be9ed2f0e4b2e04753fe1b0a0c6090e984fb0a5128804fa369ed2a4a03b8", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243103, "uuid": "32b1fde5-eb51-4680-afa3-5a8790bcf26e", "comment": "Malware payload", "value": "d3ca550c756f999abbdb149679bdf13bca2bd242", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243103, "uuid": "cabd2189-131f-4788-8e91-6dc2d7ab9781", "comment": "Malware payload", "value": "f035e18d2d5a07cc7087a6feaceea495dfb3c35f6afaf7735285e2ce251ca09e473edd5cc26d6f505ecd123429283e94", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243103, "uuid": "d39056da-2905-4c61-89b7-b05ba2bc1598", "value": "T13741CD1517EA4729E6F11E36C8F76371CD7BBC15E9724B1901945188AA94A04EC74F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243103, "uuid": "394aabbb-4cd1-4b27-801e-2d3e9ce214c4", "value": "24:8amWJCn+Oma8RA8Pe4+/ppA6frxi85kIUL:8aE+TwFA6fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243103, "uuid": "e102674a-1bb2-40e4-a370-277c2cbe5a19", "value": 2125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243103, "uuid": "885fee2c-7112-4b70-83c0-5f358fb17d55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243103, "uuid": "af2b9351-1579-42f2-b261-d633cc27b83f", "value": "IFXV.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5646f9ea-578e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695197933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197933, "uuid": "cbd1faa7-f0f3-4f7c-8d65-3c552817fe6e", "comment": "Malware payload (AgentTesla)", "value": "73251dd7cff82a8affe4b1b27027a722", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197933, "uuid": "45eac030-315b-4b40-8394-e2db16b2369f", "comment": "Malware payload (AgentTesla)", "value": "67a7f1bdedc7a30d879c3de1ba91be800515632509972050749ca80db5657d2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197933, "uuid": "364aa0cd-ea64-47d9-abb2-68d5b0c9556c", "comment": "Malware payload (AgentTesla)", "value": "674869cf9301e2781eae74fd90476c377a28c592", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197933, "uuid": "7101ec6c-703b-4070-aa69-e54c45367170", "comment": "Malware payload (AgentTesla)", "value": "fdd962cc7b83d0bfb918ed50fd4e0f3af33801c45c382df4e4504df3dc5bba19e53cf19ee3e73a5eac107dc90c83b96e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197933, "uuid": "7ad2757d-1188-4249-a2ed-b2dad1d36d90", "value": "T16F45235E9837EFA2F09A81BD41C018B2CE5CC877D0F8A7764A359092B57F1124FABD61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197933, "uuid": "c0ae921c-9bc2-46d0-bb71-9962cc4f4c4e", "value": "12288:gz2gb6b5Q9ZIoZhyoOYYK3W1Ik2weervg13flBdK/RRYlg1J0ZyIaUB3xA:2v62+KKYBGkurYiUU0n7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197933, "uuid": "d2bd235c-d9b1-446c-b0e2-dc5ccc04dcfe", "value": 1228422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197933, "uuid": "d29bbcdb-c39f-4168-8531-c549f29eb4d9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197933, "uuid": "6983487b-d2f1-4886-b980-a331f9eed1d5", "value": "67a7f1bdedc7a30d879c3de1ba91be800515632509972050749ca80db5657d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0507791-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695195964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195964, "uuid": "7158b65a-56dc-4811-bcdc-550e848f18cf", "comment": "Malware payload (Smoke Loader)", "value": "aab1c99defcffca84d563a0c20d1ab07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195964, "uuid": "a32bf270-430e-4091-9a98-b470186d1985", "comment": "Malware payload (Smoke Loader)", "value": "688f1ace96bb0327c76e92afaf731fb90831c6fc9ec887768d7b7111891cc93e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195964, "uuid": "fb3634d0-399c-4872-a386-55299530bcd2", "comment": "Malware payload (Smoke Loader)", "value": "529e4f4433f836f3f040db6f47b97760e826ce21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195964, "uuid": "78b93ab7-69e2-4c1a-bf61-d07187bee57e", "comment": "Malware payload (Smoke Loader)", "value": "e4dd29a268c50d99297a41615edd87384500a6a37da82d6601f1289424bfcac73699e68a547bda6cb1444e28ade0698c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195964, "uuid": "6180f457-c967-4a14-9c39-0ffbcef314c4", "value": "T18E34C0123490C033D5A706354925C7B46E7FBC72596D4A8BBB802B6EAE313F2AF65347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195964, "uuid": "22641a4a-5009-43ac-b487-fd1e5c808a98", "value": "ebb1ad55f48b70b0a48dee8a767738f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195964, "uuid": "49dafabb-2867-4136-a696-3fc33421ee10", "value": "3072:hBil0pogRCuymIidDygnfIcoiGuKvo3pD4MZ8bCslU9OOGp5/o9T1a:++XCuynidRJ5G4pUKwqCo9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195964, "uuid": "569691ce-ca2b-4826-98c7-3c4562e401aa", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195964, "uuid": "3e198dcf-2d62-479d-a364-6f5f99e62909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195964, "uuid": "5d7adf80-4059-41ad-a315-03884b994e19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab8359b-5782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695192787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192787, "uuid": "c48a8b6b-958e-4f63-ab1c-d3e6e62443bb", "comment": "Malware payload (RedLineStealer)", "value": "39adeaec65ef38c5dcbc38b6f94d40d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192787, "uuid": "bc098db0-aaed-4e52-929a-af4233d38b1b", "comment": "Malware payload (RedLineStealer)", "value": "6911e424ee641fbdb8828eb5fce3c1465a5d72b603f1267910fb65c81ba5838c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192787, "uuid": "15c49612-18cf-4c88-a037-28eae43e314a", "comment": "Malware payload (RedLineStealer)", "value": "103124a46108e4d53b7edc765e8c13176c9dd1bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192787, "uuid": "cd3322e4-1a9b-467a-bdfd-286bfdd060c3", "comment": "Malware payload (RedLineStealer)", "value": "bc1678d6e249c5ed0a485c9638029374212ca784ecb5d2d7e37e477ddedc87ac8f47d2b27b5a47c64554c7338aa0e31f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192787, "uuid": "12625d3b-c068-4133-b51e-1e3ccc09d950", "value": "T1CA652302B3DB8071EC644F7151F743C30E267DB29E3A977A2782649E4EB3A809975336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192787, "uuid": "06525857-d3c5-4b43-b9cc-782789b7327c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192787, "uuid": "1b22bce6-8957-4eff-bb9c-3df4188ce5a6", "value": "24576:kyh7Ob7hCk+ejzweOiGNOY6AMxDUElfI4ClE1/kDAgb4oLV2MgB4a0AL15kc6vEZ:z1OHhjjzwKGeAMZB/WR9LV2VB4a0APkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695192787, "uuid": "4f8db07a-d949-40c2-867a-2eb065f76b57", "value": 1468416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695192787, "uuid": "64a71e01-937c-44ca-9baa-2ce7ea5bf7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192787, "uuid": "7a28639f-64aa-4731-a470-a64adbfe4647", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9169fdb7-57f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695243130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243130, "uuid": "d00624e9-3f0c-436a-afd0-91e8fc8fbad6", "comment": "Malware payload", "value": "711725b6ab7e7a011e67a360203b5eb4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243130, "uuid": "184b13b7-42c7-4fa2-9dbf-431906a9c8b7", "comment": "Malware payload", "value": "6ba4cbc0372ba15487d6074f7a38d5b15ec9eb37ad7b5faada957ed365cab59b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243130, "uuid": "08f7347e-c9ac-45b2-976f-b248e8e5f68e", "comment": "Malware payload", "value": "46a6f4958cda04a7577538b0f83ca6e3cb12a488", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243130, "uuid": "303716a6-e0d1-4755-a583-f79da77e340b", "comment": "Malware payload", "value": "b4c998b9a0c423ce97643cb5e51927aef4938e4cffa3e24a2b4468d6631360a262955a1956cfe4d0f966a67a792810c1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243130, "uuid": "dad8a7a4-121e-4769-8508-b52755b70c71", "value": "T1D0A53343E72650A8C59FBA76472C42903EBB3D911E53AD077E29733D0AF62F8C7A4109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243130, "uuid": "36778996-fe50-4184-bcfa-1f4d032f0a73", "value": "49152:AEVidSW0FTXtHYN8cGpf6FURNXRSuYJJH/xziCZko8Qq+Y:AAcG7tHg0f6FUXhSuYJ7PkoBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243130, "uuid": "f17c3db8-e3d4-4330-b050-7314eefc441b", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243130, "uuid": "4b4d9f4c-dbae-4579-b5de-8f367e52fe96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243130, "uuid": "e547ec5e-cc58-4643-8d3f-1eb09ff9d875", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4483442-57b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695214412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214412, "uuid": "61cc36e4-b3d4-48a6-be10-b52bb2433847", "comment": "Malware payload (Smoke Loader)", "value": "2866ecb3ee333986c725ab6953a69f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214412, "uuid": "66e60fa0-7bf8-4a40-8814-531f486bec6a", "comment": "Malware payload (Smoke Loader)", "value": "6bb5d35d916e6187757044dda7d235cb8a78777de95d51420f42c52395c40a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214412, "uuid": "e3d36e53-57e2-4477-9784-9b21268659dd", "comment": "Malware payload (Smoke Loader)", "value": "c295c166c29146022d49bd51ed846af4daa43472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214412, "uuid": "131c9ef7-f666-4de6-ac18-ec658e90e2ae", "comment": "Malware payload (Smoke Loader)", "value": "5da69b0cb1e072160c55944120130c2d66b53e9eb7916320d745731b1a9e3cc90d8c3e43f0d555e9871a3298ff8cd549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214412, "uuid": "c6051a4a-fbc8-4e55-a6be-5733a6f3524f", "value": "T135652303AAC81073D9722770BCFE42835731BD515C799E2B638A8D5A1CB36E5B43A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214412, "uuid": "c55d924f-72f8-4110-8517-d13c8f048cfc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214412, "uuid": "1f3d864b-1a78-452f-84d4-c95c91b09d86", "value": "24576:vy3SDLPKW0lnnEkmp7pelhKSN7bAbQeDPBwd4v4VVRP4K85EMF/qAK5A:639W0lndgpq38bY4vAC5EoiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695214412, "uuid": "c2bd0c07-3776-4209-9702-471074528136", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695214412, "uuid": "a1ee1eab-bd68-44c8-afd9-03a95ac82061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214412, "uuid": "92e7dc0f-d7f4-413a-8f2a-7e53b71d4f8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9febb38-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241883, "uuid": "c93d4d17-574b-4af1-9ee8-cb5ffbd20cd6", "comment": "Malware payload", "value": "16983690ac7a75f230c148de80017878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241883, "uuid": "0d6fe36b-f608-4b03-abab-589dc2974b44", "comment": "Malware payload", "value": "6c79c7aeff6b6bf1803dfa88ab8f157e2b559985d4868f825810673b665fdd03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241883, "uuid": "81f59a63-3100-43bd-b891-c400d7321a65", "comment": "Malware payload", "value": "fad4e878ddeb6c517dcb0348db0ae279984465f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241883, "uuid": "4f60ef0e-05ed-42cb-bbdc-d759f7a6db94", "comment": "Malware payload", "value": "82533c4dcbc45e4d863388390d0328f1700a9bc09122660e3ccc6831f8b93ef2abb0a37e82c81a8edf142c468e157ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241883, "uuid": "5aece362-c568-4053-b3ca-dea437ee3428", "value": "T112359D32B2DAD272D6A225B0D5765F36097DBD200731AACBB3D43C2EF9522D1B938315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241883, "uuid": "2eac347f-819a-4e67-93a0-80e13add6b90", "value": "5569c6c02788c0e39c4fb8bd516f09b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241883, "uuid": "e44c0ef9-d41f-4e16-bcbe-aa73c9fd52f4", "value": "24576:vi3jMktyafwc0jNM/LRXdBBWlmTxOnkZBG/KVQU08o:OWaGNK6aOnaBGUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241883, "uuid": "a02decb9-dc6d-4d8a-b4ea-8bc640ad1a10", "value": 1113450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241883, "uuid": "5dd464c5-0a14-433f-9c4d-09f7770a314d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241883, "uuid": "ac9964d9-a247-4c9b-aad1-96f60b7cb2d0", "value": "SecuriteInfo.com.Trojan.Agent.17339.12868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55733d61-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695194496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194496, "uuid": "7fc4effa-2e0d-465e-be07-3300aec9b417", "comment": "Malware payload (AgentTesla)", "value": "68903a58dc8c61f5b9c13ddf753be9d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194496, "uuid": "67abff3a-521c-4a1c-912a-f8a9ad0abcb3", "comment": "Malware payload (AgentTesla)", "value": "6d033582691fbfed1308554793024626bcc07d07e904aca0d26f93f2a083893d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194496, "uuid": "19a13fa6-c7f7-4a9f-9290-8de6272de069", "comment": "Malware payload (AgentTesla)", "value": "1f91c9345407ec20fe08243ffea1db32c8d7fb27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194496, "uuid": "8e402f6b-e3ce-4244-91d9-3ebc76212e38", "comment": "Malware payload (AgentTesla)", "value": "3552cb3d9e4780ca3426393033502553387a0dd06a6668958dd1d71091cf6ade1f74eecf5ae28c125cc855662fe79a9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194496, "uuid": "598b3d9f-a339-49c6-89f6-4f99da606fcb", "value": "T11325E6BBB9EB49BBE0E959F53B88C85632B9F4F1D00E361723C01191D1EE4E0991E91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194496, "uuid": "153ea9f7-c0a0-4d29-bc19-e31c1223a249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194496, "uuid": "c10c082f-cbb6-412a-8049-e5f6cad38824", "value": "12288:ADZ08bolxtBHkQMGKx58qTt5MpfMBARLd5h15sHogdEkBPbQpqJ/d2TU0:TtmsKxgpfMCRR5h15sIg6kBPYQP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194496, "uuid": "c07f53ed-0f39-43c0-baa4-1a519685e2cc", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194496, "uuid": "cd6289bb-b9cd-448f-8f43-6184f7b70025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194496, "uuid": "6ccc796e-6859-4ba6-86ef-06d3e848ab1e", "value": "INV01562.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf54941-57bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1695219153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219153, "uuid": "d6975ed9-1c8b-4041-aa20-d4892946bd10", "comment": "Malware payload (Stop)", "value": "31527ffe31cedfbd0db03c0fb829d02b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219153, "uuid": "12b4b642-5657-408d-87ed-fb56822eb8b8", "comment": "Malware payload (Stop)", "value": "6eaf2623442beeec8def2536d88d4c6cec7ba914e6794d783855eb88c4f45be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219153, "uuid": "b261862a-460e-4bb5-8506-4b70ac48fef3", "comment": "Malware payload (Stop)", "value": "1eb38684eab7019f2a8c04ff43fee10f94aea87a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219153, "uuid": "0739bd38-8f4a-495f-b33b-95ed56b56119", "comment": "Malware payload (Stop)", "value": "cd1c8bc03a38f1191029d6277a32198a5af36b762415ccb29cf395aae91a7211996ab4846f468d8e4807612036001c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219153, "uuid": "0bebb158-2962-471a-8bbb-03d8aea87558", "value": "T158F412213495C877E99A05310821CBB0293FBC764D798A0B3B945BBF2E313D7EE5974A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219153, "uuid": "2659cf80-e78d-416f-bfd7-f3a988d1d4db", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219153, "uuid": "47fced19-58da-4582-b2e8-73329a96f71e", "value": "12288:nshxdOUh1zOuMBTqN7aL8uyI81pCEuGhMURgvuXX7XJBe8XjDFZGh/iA8/HxhlAy:ns7dOUh15MBRLPKCEqggGn7v5nAr5n4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219153, "uuid": "7fc88ba5-01fa-4902-a680-9dbfad8d745d", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219153, "uuid": "4fa3e5ae-c43c-4c75-8cbf-7a0664e2b693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219153, "uuid": "bcb24f54-7a34-49ed-a664-0d26b4fbc685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9fb2b8-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221536, "uuid": "e6054798-c20e-417b-8fac-ded5b4d153b5", "comment": "Malware payload (AgentTesla)", "value": "f62fef7a5faaa40ffcd14cb0baabf6a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221536, "uuid": "7acb97b2-7a96-4d31-a1e3-f06b49cc1f4a", "comment": "Malware payload (AgentTesla)", "value": "6eb9bf8d508146e42b2911abeda9fb71a1d810ef9347c3d7a2ba5370973534a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221536, "uuid": "838213fb-bab9-4a66-9a94-f15b0e6f1dd5", "comment": "Malware payload (AgentTesla)", "value": "d20f03d6e18a99eae5f5d157aa2c763c3f2a490d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221536, "uuid": "17db208f-c386-4c21-beb2-6f3dc8ff6ed8", "comment": "Malware payload (AgentTesla)", "value": "677d2dce339714a7d5117be84c058f8393a95f01f6ed11c74bb0ce86ee954b74c8f05988a543ab834febe707ddb95d50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221536, "uuid": "9d163f0d-ee96-4071-86fe-31b9fedac909", "value": "T1EED4222436BC8E63D2EA4F7C0870056213B199977A61E3986DCAF1D50B77B32C7172A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221536, "uuid": "e1f95a66-47b0-4284-954f-b07c2f06035f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221536, "uuid": "275f7b36-ea9c-4f78-b9a1-813c3d716e1d", "value": "12288:yPGB9kOE5fRenYAnABDEjO6bg7a0wRrcVCHQKrVz7aG/dAO8Bvd:ye2fonYAYqOF7a0yr6CwEVXaqP0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221536, "uuid": "e72f40f7-852d-46db-bc35-b17bd6447c12", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221536, "uuid": "41c83f9d-73db-4ffb-a33d-7d3e76ae4ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221536, "uuid": "4a5a3c01-c49d-4e07-8cf5-c26a311b68ff", "value": "Order _ Confirmation_ No-1191244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb1841c-57d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DUCKTAIL)", "timestamp": 1695226720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226720, "uuid": "707edc53-bac7-43de-90fb-00237f0e46dd", "comment": "Malware payload (DUCKTAIL)", "value": "d6892b563e26fac43ef8ebec24e04509", "object_relation": "md5", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226720, "uuid": "e7e89e11-63a2-4686-b176-414389da5051", "comment": "Malware payload (DUCKTAIL)", "value": "6fa92749a9798450d7f7a7cd8cf7b5132ac9b90f0e0095185d8884393af45cc6", "object_relation": "sha256", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226720, "uuid": "3ecbbf5f-a291-45bf-b7c9-92113d228d46", "comment": "Malware payload (DUCKTAIL)", "value": "3d3e4412be48ea8b5ed5ca94e5239228841261bb", "object_relation": "sha1", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226720, "uuid": "70291cee-faeb-4da5-9e36-63c9ae50550a", "comment": "Malware payload (DUCKTAIL)", "value": "e9a58bb5dce21abbd73f5009c4ebb7a39764ec9527eb9f77210cbf9a71ef068f0569d120b1ad4aec3a890eb38cf1a871", "object_relation": "sha3-384", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226720, "uuid": "f8f49fe0-91ae-42c5-bb03-c08d0f6dd094", "value": "T105969E06B3D10AE1E52FC730C62EDB32D7B1F9950735A35B1814E24A1E736A24F9B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226720, "uuid": "7eb71940-2bef-4365-b741-aa451779c25b", "value": "98df3a9c77e7d0d666bafb13187a242b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226720, "uuid": "afdefb74-69a3-40c4-b9c9-124682506630", "value": "49152:CzGtZ+6bfV1BvyWukHDopYe2d+oRQnphT/nLlletIj+h1GzJpDmr/UZTlYRCSXtY:3Mapd+WIj+ueoZ+RCSdWQb7GcpTv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695226720, "uuid": "ac82fa34-1ffa-4849-9e91-d0fdb2393cc0", "value": 8838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695226720, "uuid": "52cab25c-c0ab-490c-9644-752b182560e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226720, "uuid": "d941fee6-9506-4929-9379-3a51f591ba74", "value": "svczHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed027c80-5782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695193032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193032, "uuid": "7b995271-7479-46d0-a50c-7156f10731df", "comment": "Malware payload (AgentTesla)", "value": "06d3da11ca3b6f3f80a13dcc60efa4bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193032, "uuid": "168429e5-873e-4720-86c3-fe1556b960e7", "comment": "Malware payload (AgentTesla)", "value": "7172c4814c237c46dc2826e1da826134d431421dac0cf24539a96bf48307ab18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193032, "uuid": "f2a17566-1841-45e2-a865-9762772d20cc", "comment": "Malware payload (AgentTesla)", "value": "7843e599dc2483cfccaa0709f74ebfc3df1c6c2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193032, "uuid": "dbb2426e-34eb-4137-b0e9-4f93a3304f96", "comment": "Malware payload (AgentTesla)", "value": "a906f51442dd5d7d23696053faec650323f6934111aab83bbe8b43ebd4f77c58d62fa4b10f4e9cadcee154576ac4a958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193032, "uuid": "cdc28969-183e-4b45-b257-9db599a0dc65", "value": "T12AC43385B5A0B59E66EB30A08A8C16DF49F7F9023430E9CC2FFFA58D95444F1C9893C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193032, "uuid": "0a7da390-da1e-44ab-98b4-ab3669f3d1ff", "value": "12288:zWvPNUgPJ5s6EDfxBzGEM4Qd3lk4nxT0glkMlD0nNAgiOCps3QF+1YSa5:zWvPNUgPJC6ENJGT4Q1lk4xT0HM5qN6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193032, "uuid": "bc3b2591-46a2-43af-b2de-ee99753be25a", "value": 560017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193032, "uuid": "48b74221-b8d0-4a2f-83d6-be37a2581479", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193032, "uuid": "d8ff2e86-a32e-4d26-a45e-3c6c2b37a1c3", "value": "Swift Copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334c93c9-57fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695244260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244260, "uuid": "68f40ef3-a52c-4819-9fb0-17dd1a272507", "comment": "Malware payload (Mirai)", "value": "8b66a3d2bb9c81e1be5f882684dc093a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244260, "uuid": "81b242c7-924f-4b9e-8951-c75bea2e564f", "comment": "Malware payload (Mirai)", "value": "719e17673769d3fafd343d3dcf2b96a8dcdfc36a29288c043632f397ab9fcb52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244260, "uuid": "3dd3d372-98fb-4253-bcc8-7a2151266be8", "comment": "Malware payload (Mirai)", "value": "c99593d0a92b67c414f8a896c35c186df3d88307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244260, "uuid": "3839ab97-f276-4c38-9ffa-2d6006a80bb2", "comment": "Malware payload (Mirai)", "value": "1322ef4c44946d72cf3f99ba98daeda02887e98533bb88a0cf9d986bbd156e4f9758d3c412e8048d2b3346f8c48af57e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244260, "uuid": "9536dd4e-2d79-49a0-af4e-66b80f45d934", "value": "T14803F786F903CEB7D80315B012F6EF325E31F8FA1965D583E3A4EAA158924C2B503E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244260, "uuid": "e738d12b-ef90-4737-b147-caf88e74dbaf", "value": "768:XqBiY+cgYnUOXv8dU36Cy2QZUqeA9DsvKQLD9vZ:XqBiY+crUOf8q369pZU9A9o3LRvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695244260, "uuid": "4df897d7-5c2e-4c62-befc-e3402b072e86", "value": 39696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695244260, "uuid": "03fca7bb-526c-469b-bfe4-de01d4015eea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244260, "uuid": "4ebc48ec-2434-4369-89f2-ae0b3abf85cd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bb83e3-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229116, "uuid": "34a75e9b-6e20-4255-981c-ff1d619aedf3", "comment": "Malware payload (AgentTesla)", "value": "a157b63ea2ee36307883349a18ad1cda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229116, "uuid": "f115538c-797d-4f16-afa8-b9215d52a3bd", "comment": "Malware payload (AgentTesla)", "value": "720e2cec862dd3e25f771316a18d903c78b4dc1394b53ad48e93f54f6231a92b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229116, "uuid": "f0d2aa9e-81f9-4c83-8ad7-c09eb109ab16", "comment": "Malware payload (AgentTesla)", "value": "000634c03ec6f565e49cf6f25bb07941b4de692e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229116, "uuid": "adb02a64-d2c1-4b6f-95ce-ab091d97dc38", "comment": "Malware payload (AgentTesla)", "value": "772a6b99ba8ed837636549f54d1b2970f990daf0c0d4fb1c4354aace342ee6d17298593c3394b42905a2a397483703e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229116, "uuid": "033baa0c-af79-428c-abbf-cd1e79e2f67b", "value": "T13BE423E39D6AF99F97A191A76D43C8B68163738B8E0452F850CC403E0747AB7499F39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229116, "uuid": "04e92e9b-53db-4ab1-bf72-4f61c39d52d0", "value": "12288:VcbTqdFi9qUuJf50tCbCmZ4nXuQ86koL3e8w6Qtf9VIgoSgDeuz+R6Zx3QR:VYKiYf5mcXSnXynobrwztf92gXuzjZxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229116, "uuid": "e162131e-f33b-411f-97a5-19fb66663cd2", "value": 702408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229116, "uuid": "d699b12c-eae5-4b9a-a35b-8996f60c8039", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229116, "uuid": "e6d35f71-784b-4f5e-8812-be4bba60c91d", "value": "IDEOC2308-088562.pdf.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65ff6a0-57cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695224321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224321, "uuid": "23e3ad38-8ed6-4abf-b247-b3b9a4836b49", "comment": "Malware payload (AgentTesla)", "value": "e9d5c407dff7f063ef4ae78562e2da9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224321, "uuid": "83972f93-d9be-4460-8f3c-0b6daae254dc", "comment": "Malware payload (AgentTesla)", "value": "725d44e77922332d23018ee4a5a5982ed0856c87d84c86a578c671726776ab48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224321, "uuid": "372161a4-7fe1-4288-9302-17f6de634343", "comment": "Malware payload (AgentTesla)", "value": "1c573c5a165e171f013aac3ccf21816125d156aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224321, "uuid": "a0432bea-cfec-4dee-a1c4-523f83f8ed60", "comment": "Malware payload (AgentTesla)", "value": "d15b5451880c941bc99bdb167e27aff346176dd5c80443070cf0399690a20c5563a52c979b6b5543cf08c826bb7407a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224321, "uuid": "c695c902-8fc3-460b-b068-3dd9d3f05b58", "value": "T1C7456B20F8CCC975DDE624FA4BACF9A4428D9860075C47CFDB840ED9A2241DD9AFD8B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224321, "uuid": "785fcea9-e257-4d81-8f82-b8036204371b", "value": "f6040bff5e7406bf13febce5512b9888", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224321, "uuid": "c5acce4f-4908-45a5-ba8a-ed62f5350086", "value": "12288:5ws77R2dAV6K9i4ytfh5tSZVfn5TjzsrjlU40IubL0YgcxhXibzkYCAr/1EN0i9p:+s7t2dAVd9i4ytWVl3rtazKQ1ENh3A+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695224321, "uuid": "f2717340-7d51-4cb0-902f-aadd673f7aca", "value": 1197312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695224321, "uuid": "103b4b59-5bf4-4666-a708-f78fbe1b0e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224321, "uuid": "5a4fe7e2-c9b8-4530-8f8b-d79c687c72d7", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903089ec-57b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695216069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216069, "uuid": "2f6de829-7a86-407c-876f-e5de09aa17f9", "comment": "Malware payload (GuLoader)", "value": "c01b83a4efc31c0799fa3c5bf8af53ab", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216069, "uuid": "684a910f-2d53-472b-aa3d-75da8d2c8e04", "comment": "Malware payload (GuLoader)", "value": "725df92fbec95b07f63fbce8f8a555675402b875b040e78ad5f11804f9030956", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216069, "uuid": "9e9ed1a8-ce16-4227-85ea-60d385034ab6", "comment": "Malware payload (GuLoader)", "value": "351600853f0fbc219c002ca821e1ca6b45d03546", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216069, "uuid": "118ae754-0083-48eb-9170-299b0b057560", "comment": "Malware payload (GuLoader)", "value": "ec2990ac52518efc31af9cd3fe47a1f946742fdb555684bbf5c961f9b52dbbdcb4c920e2bf53b3f3c7147da7a7c56281", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216069, "uuid": "984c93d7-3528-4116-93dd-0da116be405c", "value": "T1714533D85D843B2934DC65BD92350064E97CAA3ABCF1BDCE1412643FDA81B3121E6DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216069, "uuid": "84ff559d-2056-47e9-a9a7-e12f2f082acd", "value": "24576:um2vdsjxds+pJYuiM6+4e8rH4XvmOVgVlA023uVRji7x+hr:WdsjEsP6rCOOVg402eVRUxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216069, "uuid": "d15d2970-b509-474b-8325-e4d50d6046cc", "value": 1215443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216069, "uuid": "eaef419c-6e05-487b-b7e4-f6ba41e16075", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216069, "uuid": "19107620-8d31-400d-aace-996e940a0fca", "value": "JUSTIFICANTE DE PAGO-pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa5bc9b-57a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695205967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205967, "uuid": "b4c4965a-8eaa-4f61-9505-f4d046cc6f9c", "comment": "Malware payload (Formbook)", "value": "cd47b64e420b472464001891ff312ff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205967, "uuid": "5a7a235d-14ec-4e36-8662-4b705eb88c0c", "comment": "Malware payload (Formbook)", "value": "732ba957311e662ad12d7a11cfb649842eb17098a7ba83d31a315fc0d53460df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205967, "uuid": "a81ead78-4fa0-48db-9ba6-7a1f5e41a6d1", "comment": "Malware payload (Formbook)", "value": "e39162573378dd9233495ff0a6ac0542de039efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205967, "uuid": "2498d5f4-f4d5-4511-8c1e-22274b1ec236", "comment": "Malware payload (Formbook)", "value": "aa99fb7882744278bd81715cf5f1eb35819a1dc885b5ebca987736d6193e34d190fcf37c4c0a303ccd01eb26076d87b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205967, "uuid": "f706c0e0-0b5f-4a3e-83bc-a0aaffeca90b", "value": "T1075307C7B65AC5F5C3845B3BC19B84041364E782B6A3D70AB5CF2356180FBFA984678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205967, "uuid": "7f179ef9-7675-4d3a-a734-c4a42afda854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205967, "uuid": "36699f5f-9076-4408-aecc-d3a852ed942f", "value": "768:UCEWXVsHowBr6/ulopYqfAvMeRMxhtiG/joxvxkOVvw3kJ28eG5x5+8ZiHwkgcGJ:UCfOH8GlSK4ZigjonNJ42ZiQkVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205967, "uuid": "7dfd8e2f-22ca-4da1-ac7b-eb7c111e8d4e", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205967, "uuid": "1cb16cf9-5e0f-4291-a541-43e32cd998aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205967, "uuid": "50516672-17c9-4a23-8619-e22459327f2e", "value": "SecuriteInfo.com.Win32.DropperX-gen.16843.25908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68016a4f-575e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695177347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695177347, "uuid": "dc3a6666-6e4c-4d1c-b638-e1eb6629bfba", "comment": "Malware payload (Smoke Loader)", "value": "a25c8bcd78bfffff86e911122d610ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695177347, "uuid": "a9f4a398-0acb-4ac9-b6a4-d7bd75dba903", "comment": "Malware payload (Smoke Loader)", "value": "739c8d45ca4059f0b591bd553bdab486519b663fb092ad11868a8c6c3d9ec022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695177347, "uuid": "912f3d14-8c1a-4a2f-9829-d66a6e3f6d62", "comment": "Malware payload (Smoke Loader)", "value": "a262560b7b021156a27f2f298d48e5dcb08d9506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695177347, "uuid": "b36cf42a-4ebd-4eb1-97d4-1bb9931b5c05", "comment": "Malware payload (Smoke Loader)", "value": "db90a13158903a17f45cf183cc8bccaaec5568de47507bd84bf8aa31e1c8c82d9c622b053fc59687a1a3c12466f59f09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695177347, "uuid": "4bb2fac6-b0d1-4f43-8d90-aaedfd0024e5", "value": "T11044DF2277A3D832E56305349570CBA12E7B7CB31A7881CF37D45B3E1DB16C19AAA352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695177347, "uuid": "9caa7f60-c252-44a8-853c-3cf676c1714e", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695177347, "uuid": "f50d560a-b265-461d-9999-6e475415263b", "value": "3072:jWXHhrbPgrVGZotfogCbfMv9m3+fe+vTUgryv2ldDzPV:yBrErEZoRdqUv4Om+vTrm2ldDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695177347, "uuid": "7b2ed85c-a4f5-4c0a-bf19-20721993123b", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695177347, "uuid": "0f00bb66-1ff8-43e3-aaef-a5c6d7e8dd09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695177347, "uuid": "e6ff94f8-cdc2-446c-91ab-8036e23bc94a", "value": "SecuriteInfo.com.Win32.BotX-gen.1476.23690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e015b8c4-5782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695193011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193011, "uuid": "827fd246-b132-4570-9c51-62db1c6cb4a7", "comment": "Malware payload (AgentTesla)", "value": "655991a0429bd5e8746397ae81e03530", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193011, "uuid": "cc73d97e-5b98-4284-8b4b-49656a7a6a2c", "comment": "Malware payload (AgentTesla)", "value": "74bf3564545c65cab6955d06751280f42d1c884a70edc89768753c36e56aaf61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193011, "uuid": "e2003971-9e7e-4064-bc54-38ff0bba6627", "comment": "Malware payload (AgentTesla)", "value": "8045d3e6471b394a704fd62f74c4467d8e5fbbbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193011, "uuid": "6438d43d-dc7f-49c0-984a-00735a7bbf12", "comment": "Malware payload (AgentTesla)", "value": "925e00c7b72e4b6c3bfb4682caecc9c8020649ab8f53ffaddf213ca53858ac1d574ba8591888b3f4086ccd7679005c4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193011, "uuid": "01e9e413-ace2-4a55-b4fe-3ca48934a5b2", "value": "T1F7C423F0562BEDBF2D8B849D3E6F63709645D5D6D57A9998373BF0308AC0C2B429260C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193011, "uuid": "c487d2ef-4305-4bda-bcc5-122437a84d82", "value": "12288:Rbub9gaFvzhnGIwsACXKCNtn/ubepD0WQ8FALcIWeNf5:RKuaFvzhcsjXXn/QeHFiAuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193011, "uuid": "25bc41fc-117e-40c2-8565-dcb2343c8b77", "value": 565863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193011, "uuid": "b0ddf2dd-1e5c-4f8d-bb65-68f082d807a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193011, "uuid": "bdbe341c-7af5-4356-b6ce-372f8396a391", "value": "SOA.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c4a7b0-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695199245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199245, "uuid": "9d7c7d7e-4ea0-43e4-adb1-c202138d8faf", "comment": "Malware payload (AgentTesla)", "value": "abf88f88508f3380048ceeb55cc1fe19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199245, "uuid": "31a07840-7abe-4686-9e14-f919b83b92e6", "comment": "Malware payload (AgentTesla)", "value": "75928078ee7371de911070ffee3d0eb2abe327490006ae659534672827a19681", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199245, "uuid": "bae715c7-0dd5-4cc5-b871-d0b968e88c08", "comment": "Malware payload (AgentTesla)", "value": "53de36548bddd54b52dedd5dfc45427b85818cf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199245, "uuid": "80abbe2e-02ac-4f25-ab39-95f507824132", "comment": "Malware payload (AgentTesla)", "value": "fc0d7bb65b2c176f624621bbc9252648e82d45a280e4a6b2d0c2fa10869eb99f4c71938e94b97d895b1b7df574154af3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199245, "uuid": "9d3a56b7-7361-41bd-a5a9-45a424467076", "value": "T178D4232837609F11E0CB2BFD243035446B704D36BD6ADBE04ECAF1E546A7FA58513B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199245, "uuid": "4ef4701b-af52-4f27-92cd-f12df8e82715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199245, "uuid": "0bd2a306-b623-439e-a1d9-100780facf9b", "value": "12288:v87cGsp/Y5ZHKH53rwd2FiHRmiQ6G1By4nMep0GDl4M1v4UOnUD/C:v7GsuHKBwd20EiSVKCOn+/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199245, "uuid": "f8182d3c-8bd7-4165-9da1-4435190e80b2", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199245, "uuid": "a160b154-a113-44a6-a866-0a4e0d52fbeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199245, "uuid": "2bb7d2b5-25fe-45fa-89f7-f6653f57ad8a", "value": "0001111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73ff302-580e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695253179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253179, "uuid": "25683c6b-506c-4a90-8b4d-78dc2cc1d549", "comment": "Malware payload", "value": "9061e64d817eff7d5e37e78a13ff4d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253179, "uuid": "b3b89821-0dd5-4745-abe0-7230401554e5", "comment": "Malware payload", "value": "75e8a555d859838437e5d1311961116ccd7b1feea4643fd760477bdc4ded1c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253179, "uuid": "9299df2e-fb7a-49a1-acb9-548a5397139a", "comment": "Malware payload", "value": "839eb19263afa9000dbb7b88e04981125b7aa438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253179, "uuid": "84c58a13-c746-44f8-80bd-8936d33c5825", "comment": "Malware payload", "value": "9a963eb1d13300a63ae012a490025a679647db5be5e12f462915af7984c9d8de52b639978c1c599b7b1ab3baef039222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253179, "uuid": "7b52b776-0af6-4ba2-a0cc-89d051453e7c", "value": "T10024D11135E3D872C5A785304834CBA06EBFB8735BB8855B37942B7F6E30391A7A6316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253179, "uuid": "27696dba-09d6-42a1-9681-e31fb513819b", "value": "d13f0a4e1c3acd1a644a413a45b35009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253179, "uuid": "8375d63c-e402-414f-b4ad-762776a8fb6e", "value": "3072:0XtqSLyCtxCS5ZKCbzmUzv9SIIO+J043ZhbFJp9V5BpiT/uL6:wA0rtx3bpGBl7piTmL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695253179, "uuid": "e671a408-8b50-4cb5-8c70-96fe2bb36f15", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695253179, "uuid": "7092336f-b851-4201-a87a-05e8f5c4c83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253179, "uuid": "502d69c7-71e5-42c3-aba0-f1e8d1c213af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afe2054-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695199176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199176, "uuid": "49bd53b2-3797-4b19-a765-ca9f4fefd92f", "comment": "Malware payload (AgentTesla)", "value": "64e8128b6deb0a263fc1c123043cae4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199176, "uuid": "de294e61-1a28-46fc-90ba-053ead329e52", "comment": "Malware payload (AgentTesla)", "value": "76c0e4a0502324db78e70bd3b307ecb20405ee15c7321b1d6175b7d5b0701b1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199176, "uuid": "4a8bebcd-97c5-496d-9a74-7799346d39fd", "comment": "Malware payload (AgentTesla)", "value": "5d5833fd3a415a02237f9ff2b7d6960d379d4806", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199176, "uuid": "74089778-812c-45e2-999f-5618a2188438", "comment": "Malware payload (AgentTesla)", "value": "05dc0abb85757c6da5f048bd62698fee58f35700c61983b16285ef9f4da23f4c9bb71a6efa20123f30a0b40117d96eb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199176, "uuid": "f78343b1-d2e2-4f9f-bba3-5aeddc5c9a73", "value": "T161D412583625CFA2E05D0BBC14B029A167B0886BF4E5D3B45EC9F0D64B7A761CB1339B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199176, "uuid": "c91bb3a6-b338-4582-94b9-f9cb8f5862e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199176, "uuid": "a71b8837-7248-478f-8f13-10f4726eb0f8", "value": "12288:6n+BJIsZ8XkoosYg3kpIk6QeerHgp3DlBLKPRpRqlA1l0Z7thUEioN:6EOPXSs90wOrAifQy0LaELN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199176, "uuid": "e88ed6dc-96a6-4a0f-9b4b-5f2010938531", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199176, "uuid": "ef79d0dd-3852-4aca-8dee-397c7f33cda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199176, "uuid": "d744c0d5-c2f4-4413-9cf4-0bdbe5d7a9ca", "value": "smT6uSEJB15fktZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52418b6-57a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695207971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207971, "uuid": "5d28df85-0b59-46ca-bf52-8cf48be8bc63", "comment": "Malware payload", "value": "4314c1def1abf5863fbb2e9f5ce2d762", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207971, "uuid": "e9b7f4eb-3189-4524-886a-7caef114fb5b", "comment": "Malware payload", "value": "76e749320ac6fc256a0ea110110337ef282c290b68ced24b3d09c9d25abd9eca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207971, "uuid": "ddaa08fb-674f-426b-b9c3-115eee223008", "comment": "Malware payload", "value": "56b5985fa073b7e846b1ddad6c93d0e8aace58b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207971, "uuid": "73c1c97b-dbdb-44da-998c-26d3eb5dbff5", "comment": "Malware payload", "value": "c25e450df4c800c0eb43ef7bec4e99dd09ded82948f67907615a358ba38d900ca2d3a31e3f83b7990aa9ba6f7c5adf33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207971, "uuid": "c33592bf-3a7e-413b-8589-4e6dfaab5d99", "value": "T1CA148D11B2D0C072C4AF017A891BD76963F6BD909DBF96872FD83B8F5E315528A39702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207971, "uuid": "518f0e72-3e15-43af-b0e9-7ef901212bc9", "value": "16f786cb039fbee15706181c5416edf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207971, "uuid": "47b7a3ff-f2d3-471d-8d70-a14986395495", "value": "3072:RcM3mPgZMGt60Ri/QoB9zruy8FhfxjNnhBfwr73IzB4tGCsq:R33ZZMGtXRiF93u7hZVfXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695207971, "uuid": "612a1b4d-89e9-4a55-b866-56be2450fcde", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695207971, "uuid": "37f0cfae-174f-4e30-bd83-a3e6fb862c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207971, "uuid": "7c055814-8109-4760-a678-a9541f4bc13b", "value": "ppcnv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417693ce-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695194463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194463, "uuid": "fe91926d-954b-4f73-b528-722f5cbacf19", "comment": "Malware payload (AgentTesla)", "value": "2354d43f6484ba7af1156833560235f3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194463, "uuid": "948823c7-d96e-48c6-b103-e43e8ebb023d", "comment": "Malware payload (AgentTesla)", "value": "76f038beaf753ffbfdccebbf1a00980f4d3cbb9688f27413c458bb915ff8e78d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194463, "uuid": "cbbbc539-2720-4524-9e98-5e9e89c17b09", "comment": "Malware payload (AgentTesla)", "value": "26227517f3038745fdafb4d83a7cba76e0ac1c8f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194463, "uuid": "1cc09cdc-5eea-4f85-83f1-6936fc1b6151", "comment": "Malware payload (AgentTesla)", "value": "05524b48776b03230da5f5182d916a6d6e7c4a43ca800b2dc9bd144aabec938201a79793f5ed97d7bfcb58820ba4e5ee", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194463, "uuid": "87399dc8-98b5-4937-8ffb-376aefbad4de", "value": "T1DEC42357331896F32788984127A34A0C1E89B1957E8F498E47CC6EB6CF6F3AE247915C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194463, "uuid": "e0d431c8-a0e8-4520-a77b-213126e925ac", "value": "12288:AWD2CHFSNwgJQGOjLO9OKeLQsTHNn30RbVXZ6xyIfs/xrvLMlbx7C:AWDtgJQGOGeQ23wRcyIU5jLMJ1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194463, "uuid": "891e3227-e185-431c-9701-03e6bda139d9", "value": 551374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194463, "uuid": "7f3a7235-74b8-457b-9f93-da540367f321", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194463, "uuid": "76d26585-0bc3-4d26-b8dd-62609b1f73ea", "value": "INV01542.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a20901-57d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1695227381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227381, "uuid": "286b6e1c-0845-49ff-b0be-00d5091c14e1", "comment": "Malware payload (LummaStealer)", "value": "bae86743ee72b5f5d00c1a7df5981c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227381, "uuid": "846935b8-4ba0-4405-9358-4cca4057a847", "comment": "Malware payload (LummaStealer)", "value": "7764dcf5ebc8e3193e1b4e1536c7a730ef731e257f171d96fe1011cb270a805e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227381, "uuid": "ea101bce-cb15-416c-b623-d0cfd65e61b3", "comment": "Malware payload (LummaStealer)", "value": "4c5f0aee7de33af1f6764885bfebec7509edbcaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227381, "uuid": "f05c1030-f04d-448c-bb2b-8f94356d299e", "comment": "Malware payload (LummaStealer)", "value": "c701b425976625c6831c8cc59f6e3efcacff7a935be69f2cb45ad2453c817162d825d216bb2e8d2053de2433b47356a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227381, "uuid": "58279fb5-91c7-416a-a759-b689b8a8fab9", "value": "T1BB940212BCE2D471C296C8395874C7B1EABF78335565899B33582F6E3E713825B6E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227381, "uuid": "1b997072-afb5-463f-af0e-f88c1d858c71", "value": "f441e1f89e815eda74d641cd1f758949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227381, "uuid": "6fca9391-9ac1-49c6-9672-ac7e1fa044eb", "value": "12288:glG6R4KqgsPgzwOMBNnSbX2xlv6N20SepwXqKRr:glG6zsQwZNvlv6aN6KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695227381, "uuid": "a5caad2f-782f-4dbe-b162-ca0f3bfbbf81", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695227381, "uuid": "c59e3eea-a9f4-4cb2-b5f2-587390a66a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227381, "uuid": "1db4c58a-6e9e-4fd8-b4f1-9fdd6ecbf380", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cd2998-57d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695228054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228054, "uuid": "02111dda-222f-4e1f-ac8a-cc5e983391b8", "comment": "Malware payload (RedLineStealer)", "value": "4171e0cb946c4bbef71c22a0e1ce378f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228054, "uuid": "62d0eade-9044-4c43-a254-aecd77ef292c", "comment": "Malware payload (RedLineStealer)", "value": "78ed362e48b76fb77f761b3f7d55c22902e6c6f672db2a45c9a500f8f9687d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228054, "uuid": "02f30ef9-3c57-4c67-9d08-c4c420a222c1", "comment": "Malware payload (RedLineStealer)", "value": "212c507c83a1c7a1bc5f76a16e83d67461889523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228054, "uuid": "af6cec47-eab2-4eba-b9dd-095d70345578", "comment": "Malware payload (RedLineStealer)", "value": "6a075b15802adfd99dc4e4d7a5779c65b82055d41556a51c3264a5be096066293b6393cbb88db037b660114d8b7b8c4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228054, "uuid": "a66fb414-04c4-408e-bcc3-7f0011d8bc00", "value": "T1EE652343BBE9E273D4FA23300DF216830A3C7C959E75572A3B48D8190DB25A5A93136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228054, "uuid": "a5c2aa32-04fc-420f-b163-f2a10fb27da8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228054, "uuid": "dcd9bd10-c209-4b76-b059-630da415455a", "value": "24576:syqKVxqf9dBTjdEP4E2yS67Ach5hcp9M67syEPUuIH2sYCSjdrh/bY8Q7gttB/oi:b8rvd6eZ67Ach5iSPtikrh/bY37I/o53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228054, "uuid": "1cda7f7d-db4c-43f7-b416-852debee986a", "value": 1432064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228054, "uuid": "cdb17ebe-2c80-4d9d-b5a3-57f5c55200d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228054, "uuid": "ff05eb81-ef32-4569-8b47-ea2627465dd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3b2da3-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221645, "uuid": "95a535db-d7dd-44c8-9968-9d09f607b5e2", "comment": "Malware payload (AgentTesla)", "value": "00d7041573e9cc613a622cbf1dc540b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221645, "uuid": "a22bc6b2-b874-42ae-a6a6-026810662bc3", "comment": "Malware payload (AgentTesla)", "value": "7998f63698788983a274a8615a93e3a14153516e5c20eb8e94911ac6e14feb28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221645, "uuid": "43080af7-e93f-4768-a0ee-b8a7c0796776", "comment": "Malware payload (AgentTesla)", "value": "0014747fa87c4b90a9af8179690cf949f1e3654a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221645, "uuid": "a66de9d7-3b98-4127-80fd-11a24bc1e918", "comment": "Malware payload (AgentTesla)", "value": "b65560d9fc09615f866811d43d02b666a523d741b0426c2166f9f0482dfee941095a543ebca9cb21f9c05b964a91135c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221645, "uuid": "5f28d664-c129-4a65-9eab-f15ac4a911ba", "value": "T1CAB4237CE98B0E46F353824A1B9AD673549226013C6C9FB37D113A8973E583B8E394F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221645, "uuid": "ba3972b8-f3ff-4de4-a3fb-b97c7b34311d", "value": "12288:rtraZapVCRcUecF1Q/YLR4zRXDAtTe196AMbB7RLWQ9Sy:9ah1VRiRXDAtqCfjSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221645, "uuid": "b0699e26-f7ab-4073-bc32-4941b64be625", "value": 515653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221645, "uuid": "05b9a097-ba7f-4e50-8b48-c9e3645e4d85", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221645, "uuid": "f3791bfa-4c18-497f-ac88-e5f1e6a0d5dd", "value": "Purchase Order.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f8cf2f-57a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1695207543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207543, "uuid": "74a1a873-47e5-48e6-a859-102771adff55", "comment": "Malware payload (Fabookie)", "value": "dee364376c8ad99ff1ee640679aaa1be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207543, "uuid": "e428add7-ca5a-4c52-941f-70fc7ec56e69", "comment": "Malware payload (Fabookie)", "value": "7a4d99824f0be690c51bcbb88ea9449cfda966d88ff206a2184e87cbe13fe49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207543, "uuid": "604915c0-615d-4fb2-ad98-b35c8dd29967", "comment": "Malware payload (Fabookie)", "value": "c929fdcae29f30c4853d1e450bef24b122e6be30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695207543, "uuid": "baf00266-4daf-4774-80af-14c616d7c204", "comment": "Malware payload (Fabookie)", "value": "8d96107edcc8e4b159fcd3f28f4830520c7c6cec5fd7627522d58d3b0d3f63a2186d0c1065470956bd5a7e33db63476b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207543, "uuid": "b5d69d41-dc98-40d1-8536-413027e2d440", "value": "T116742881B3DA4028E072C679CEB1C363EA767C155B3096DF07609E6A6E73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207543, "uuid": "1b7fb516-c998-4ccc-87bd-b55022f54241", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207543, "uuid": "4d29dd3e-aa62-4c72-926a-17b0edd78eb2", "value": "6144:zFZ8RIT6Eam4StJ3rXDf49Zu7SkDoPiaODgKYleQ4S4P:zIdSXDgjyrMAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695207543, "uuid": "30c652ff-90f1-49e9-aa90-23f17d092bd0", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695207543, "uuid": "7773d772-40d6-47a9-92cc-c0e7ca73f413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695207543, "uuid": "cb9095fb-1f4a-44f1-8afa-58c88d71bd57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7890e2ee-5808-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695250390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695250390, "uuid": "2e5c6b18-05ef-4520-b653-0651633dadd9", "comment": "Malware payload (RedLineStealer)", "value": "fad8c8367ced3f14a96c51fd375c4049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695250390, "uuid": "3e9a29a5-c498-4ec9-8a70-475223cb3be9", "comment": "Malware payload (RedLineStealer)", "value": "7aa5185feb66c3dbd8783d588a0ba32380f044050f1d1b1c1d8b13620bfd0b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695250390, "uuid": "1e876c5b-d9fd-40bd-8fd0-c99026473e76", "comment": "Malware payload (RedLineStealer)", "value": "f1b212b43fb5d16a2772aad6bcadf602ba1dd3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695250390, "uuid": "4f266286-6805-49a7-b56e-fb33ed85bf34", "comment": "Malware payload (RedLineStealer)", "value": "95893571dbec8a7184ce08d349b2e2041774ec4d89379520afd855bac8adf8d5cf969debd00773512fdb589a65491b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695250390, "uuid": "e152e93b-4cec-4647-8e43-5aa3d731434f", "value": "T152552302AAF95977DC7127305EBA13D70B3BBC618D3C062E278478491E639D1B93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695250390, "uuid": "7c072e9f-2da2-4100-ac71-530daeeda32a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695250390, "uuid": "e96d9457-6c6c-4507-90dd-376954f8f571", "value": "24576:1y5IgA4qt8gCD31fSQQzt2szptQ13miEzHEpTsgk2BXwYUWnf0dnFoTp:QKgP5DFfSQ63pWBlTs9cXwYLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695250390, "uuid": "ea47f08f-3598-43d4-bb13-775bcb400e5a", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695250390, "uuid": "9061973b-f612-4081-bac4-f64045cdb44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695250390, "uuid": "7f17c9f5-3fa0-42d7-9f12-9817245bc64d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7681ef-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695196337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196337, "uuid": "553694eb-97bc-45c2-92ae-4002b5d70f74", "comment": "Malware payload (Loki)", "value": "226748156718dc52b9f8fb06a3e2ec87", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196337, "uuid": "63ac4338-76bc-49b6-88d9-36b2e80d68a1", "comment": "Malware payload (Loki)", "value": "7aed44be2d55ec8c4f947e12f106744fdc50448b9d20507e2f9fd528e2c8cba3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196337, "uuid": "b6d4361a-f9bd-42e7-ad7a-3f52db67244b", "comment": "Malware payload (Loki)", "value": "862fa574bc1e152920f52a9cd5a299dc90acf6d2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196337, "uuid": "1dbf554f-c2fa-4ac3-a615-74d82fa26e31", "comment": "Malware payload (Loki)", "value": "b43dbba390277e8047f2cb176d994cf94629c160ebab485523abf8b4e887b43cbe870f26e8a7e82160825104783311cc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196337, "uuid": "572986cf-4b84-460c-9ecf-3e65e044380e", "value": "T1C7456AC39CCCBA82C71982B7EB16F9FC0A7BFE0D648524963471EA4A293356D5C36435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196337, "uuid": "54213d9f-6282-42f3-9bd8-c653b860906a", "value": "24576:wWQmmav30xSZy6w6VH6NkYZyew6Vg6N4rJwVQsTQZAVfHKwUS:FQmmQ306+6VarK6VpvVjTDVfqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196337, "uuid": "b6bea596-e0ad-437b-9779-0d84831f3e82", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196337, "uuid": "8fa07a07-07f5-4cef-8f16-4db2473f98b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196337, "uuid": "bceda97a-ddc4-49c1-9a0e-1c01a819f52f", "value": "213.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e8b15a-57f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695243594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243594, "uuid": "64db6c5e-fead-41d3-afc2-ff96aacfbb26", "comment": "Malware payload (RedLineStealer)", "value": "7a779a3f4790e98ae05a15038987f2fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243594, "uuid": "82bfcf7c-98ac-4d9e-99c6-c1403579ae2e", "comment": "Malware payload (RedLineStealer)", "value": "7b03b5c56612db66d1acc86259c8e07828412b36324e2a22968e7447095d40ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243594, "uuid": "6296fe1d-8d36-4669-b286-b71f024fedd9", "comment": "Malware payload (RedLineStealer)", "value": "6dbdbd948fbcbf304d5e4964f1a670010db17e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243594, "uuid": "92317425-c633-44fc-81da-d92d44f2f761", "comment": "Malware payload (RedLineStealer)", "value": "395663fe6077446e6d7cec22c10eb58ab384d3e7aeb7692490892399dcb803a7d0e370db932871d3c8c58ae8882d66b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243594, "uuid": "1c85206c-829e-41f0-8bdc-0d2314077269", "value": "T107552345B3D09163CDB16BB400FB1A871A357CE56E78C3AA7394F1694EB3788263472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243594, "uuid": "0c818fef-4226-45e1-b68b-a6feda9c555c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243594, "uuid": "28f9c587-fb5a-41ee-9c85-55b630ce56a7", "value": "24576:hyfayTtmcF0GtScY6EPC5njFWdLl81QPwpJZ+YX22SCjBnRwd/MQ+:Ufay8i0GtXm85WYm4pJZ+YX229faJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243594, "uuid": "6af7da6d-f11b-4e43-a1cb-0a6bd2273e15", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243594, "uuid": "dc5f5d29-541d-43a1-9c9c-e2242d0501ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243594, "uuid": "f65ed310-d854-479c-9dde-194bf830f6e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b728ca4-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695228946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228946, "uuid": "d5aa81d2-8b3d-4278-88da-b9ba660dd87b", "comment": "Malware payload (SnakeKeylogger)", "value": "54e6b3143669461f4df675f32705f602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228946, "uuid": "db060c06-702d-4167-9659-f00bdeed3210", "comment": "Malware payload (SnakeKeylogger)", "value": "7bfacddb1871cc1aab46c0274e8e8f2cfc2cbb4b7caef9df24b6933a1ff75124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228946, "uuid": "58909b85-ebb1-479e-b147-f64afaba13e3", "comment": "Malware payload (SnakeKeylogger)", "value": "779e635d839eecb38aa17b5a89ae7a5549bc7d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228946, "uuid": "18c0de05-8edd-4e7d-8735-69db2a25b61c", "comment": "Malware payload (SnakeKeylogger)", "value": "fcf273d079d2161d0bf59de3f09573426b71f2a047b20970197c41595229a8819e0a37f5ab634ea9b73ab4043cc3facc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228946, "uuid": "596f1dfd-1406-4d81-97ca-6fda2b459438", "value": "T11635499C365079DFC957CC368AA82D64EB6025BB531FD203A0131AEDAA1DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228946, "uuid": "9a92b290-4bdd-4476-a77e-e0190e38ad68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228946, "uuid": "d54021b9-5074-43b5-967b-cc0ed3030f14", "value": "12288:sQHCr/cT5J2iNtxIQ/tjwUj4m3r+hQClaHFe8MpZkD8qaCFHi4gIrDRjmfTf4SNv:y41F3904CuFe8MpCwcF6Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228946, "uuid": "a339627a-cf9d-4af8-936e-2d79dbb305d1", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228946, "uuid": "3820a946-d466-4665-9e06-8e02b57ebcc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228946, "uuid": "17caf37b-696a-45a7-94e0-4a6957c00466", "value": "P0#082023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5263563d-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695199215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199215, "uuid": "7d838f7c-5d5c-40c8-adb5-db53ba79e94a", "comment": "Malware payload (Formbook)", "value": "13b2e22fe1f86ae73f2b2c3f71da3063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199215, "uuid": "edbc79ea-44f2-4d57-a277-f571bdfe9fc4", "comment": "Malware payload (Formbook)", "value": "7d0d45caa5fb24fef82b7ab932fcfa907db162db0e7e821d3adcc457f30764bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199215, "uuid": "c417f20a-e148-4f66-a220-f07ca661b477", "comment": "Malware payload (Formbook)", "value": "8b7f8ee3c5672015d31221307bfcd24aa5a92cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199215, "uuid": "27ac57bf-1446-4764-8c5c-e4fc5cd49a9e", "comment": "Malware payload (Formbook)", "value": "449bed8dd06aeb0a2ecf2368856570795b54af8fbb3c938878dcaa8401fb0e4ae14017c1f1b8929316009db15a6c2296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199215, "uuid": "5df042cf-c5f8-47d9-aa58-8d35201d5926", "value": "T1A6D422143BA44E5AE11D6F7D09701A5163B19697BC62C3D4AEC2F0EB0B5BBD2C22374B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199215, "uuid": "08035163-d950-41e7-8392-99ae53acc053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199215, "uuid": "45211813-47e2-4738-a74e-59f618cfa967", "value": "12288:QQlexrzkdgO/cfHo9+g2pzqK4CBaokp3bXG:dlexrzkKOt9+vgdCBaokpLXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199215, "uuid": "efc113ee-6ad3-4236-8abd-32a56ef4c984", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199215, "uuid": "2e7b46e5-3214-4d45-b462-934f4d949540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199215, "uuid": "5b46566e-58dd-4212-a64d-3d32433b1c69", "value": "COMPLETE ORDER WITH DATA SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61606089-57d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695226728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226728, "uuid": "623004ce-3f97-4dd9-9a83-59d3a7e3e5d6", "comment": "Malware payload (Smoke Loader)", "value": "a749c50e50bea83a415298bf40d03217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226728, "uuid": "f93829cd-7bf5-47ba-8740-56d81bb4547c", "comment": "Malware payload (Smoke Loader)", "value": "7dedf613bef159a338fa71ae8e77e11899f9f5314ac3ebbb63c70d24537c3c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226728, "uuid": "e8c2494c-7bc4-4182-b8d2-8b5731aef0b3", "comment": "Malware payload (Smoke Loader)", "value": "066a179765249fa78765aa7c2ab063f7501d76be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226728, "uuid": "b756931b-688e-4acf-a846-7f2bafb796b1", "comment": "Malware payload (Smoke Loader)", "value": "19a60ae472592228eaad590dd5537a7c3b70132cc07a6d748f6a7e87ba30c8ee4a56b68ce15c98c8f3aab2f276507f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226728, "uuid": "2ef5f174-8802-4e98-b2e0-bce6ec3ba32e", "value": "T1E3652345BBD54062CDF61B342DF207B35E367E329A38C6692B10985F49717A86A333B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226728, "uuid": "ba259cd9-b0d3-4333-8917-7f5391ca34f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226728, "uuid": "ac7bdb32-7727-4838-927c-3778f862a595", "value": "24576:JywNd7sZxBoGLHldxRjAQ7Vz1lhfqIFNRyaQW2RxyK0uX0IMVJ2Ay:8wX8xBfRHGmV7NMaQWw4sMyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695226728, "uuid": "3994ed8e-3d94-42d3-93e1-beaac87243b6", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695226728, "uuid": "40089d98-1921-42d4-b468-7dc32a7b57cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226728, "uuid": "5620a455-1923-48ba-94d8-3e5f37504660", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe7e3a7-57d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695228283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228283, "uuid": "5eb8df42-d583-4853-b5d3-c24da4d180c6", "comment": "Malware payload (MysticStealer)", "value": "17fa8319d0f676b0a4e69d629e3b46a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228283, "uuid": "55d56b56-ae75-454a-b59e-527f9b2f4f30", "comment": "Malware payload (MysticStealer)", "value": "7e2fd37d4bb8cc4166498114d887a99f84122f6990cbfc2fe7047c8d41e866da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228283, "uuid": "ea4e1ad7-0ebe-4173-aef4-7d9e022b3e64", "comment": "Malware payload (MysticStealer)", "value": "7daa97964d11a0bb1af7921c81fb43a06ae16016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228283, "uuid": "fd639bf8-e325-401b-986a-24989706f7e9", "comment": "Malware payload (MysticStealer)", "value": "24e866bc6547e149132d23cf14a1fa43dfabf6aa8161b47605fcbbb7755a9cda0148c25bae5bfc15950b4735a087fd34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228283, "uuid": "7ad7f6a8-f585-4834-a9cc-de79e6e2f7ef", "value": "T14515AE117592C472D9B115344CE5DAB9563DBC204A208AEB73DC3F3FBF707929632A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228283, "uuid": "600caba1-509b-45b3-b29a-7b33a77410ac", "value": "ccc0dba82ee571a2525935dd8b932dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228283, "uuid": "8992e1f1-561b-4440-82a6-26885b613f27", "value": "6144:TNz+5SS9e1jf5dRV5mH8kzRAv/cAOzA1toyJWlKT6yVRVUKxAPIzWxMTYgK11jW6:TNip9e1jf5p5Usv/c26KxAPISkkW5cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228283, "uuid": "e5d9a872-fc5f-47f6-99a4-2fba7d16dd60", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228283, "uuid": "2a773be6-06d5-47ff-a2b7-188ffbbf6437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228283, "uuid": "12f9384f-6235-4bf6-810f-490b80cb59c0", "value": "17fa8319d0f676b0a4e69d629e3b46a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94348858-5781-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695192454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192454, "uuid": "8204fdfb-1e16-48c3-b47c-62b2d5fd0e26", "comment": "Malware payload (AgentTesla)", "value": "951261419d258095fde7deaf4e3ed2e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192454, "uuid": "77d607a6-7f5c-48fe-a6b3-a740655be9fd", "comment": "Malware payload (AgentTesla)", "value": "7e5020480daaa898fcea4049ce0c6ea7ecca96195f3afd57b9498ecbd67c7c5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192454, "uuid": "cb4a22f0-f50c-4648-b233-fd65b43f63aa", "comment": "Malware payload (AgentTesla)", "value": "057184e52f1255279aa48c9f830e49edc6c62d02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192454, "uuid": "7084e315-e163-4d2d-9ec0-16868bb6fd72", "comment": "Malware payload (AgentTesla)", "value": "dff859c8a4c546dea316013258b2c0b221a2de5663a34ebf12ab41cdaba2a7b9c64cc983c338d63961a37fd815c80658", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192454, "uuid": "d3519c42-6571-441e-a9c7-fd562d4639f1", "value": "T128D4C01931FF5E16C022F7F20BE8E9B686EAF1F6521EF7393F8116568359D019A02871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192454, "uuid": "f79f9f89-9bc6-4495-ac33-4f05b87e62c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192454, "uuid": "ea245ff8-d496-43af-bb77-0fb3bf17b499", "value": "12288:VD508bolxtBHPQMGKUfVv70l//MJsE3+YB6Xa5HXkrU3:ctdsK8vA/ksAlPko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695192454, "uuid": "429d2a03-b4ea-4436-8297-e917572e3bfd", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695192454, "uuid": "d02e2d0d-7797-4058-baa0-e45c165ea0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192454, "uuid": "9e912dfe-915f-43b1-84ea-56ad99c39a13", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd3ae2b-57e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695236658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236658, "uuid": "aee9a4d3-004b-4dc5-a1ee-d976e13bba59", "comment": "Malware payload (RedLineStealer)", "value": "06f291f5bf655f9096397f22d5b3ebe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236658, "uuid": "725da281-b771-4458-ac65-e65e6e8db67e", "comment": "Malware payload (RedLineStealer)", "value": "7eedaa75c529b9b052e817c2d259f2ea9642859b506ee87d358d317fd0ba3b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236658, "uuid": "2b688711-8ab1-4e37-8b1b-d51233373667", "comment": "Malware payload (RedLineStealer)", "value": "3ee0f479c5d513a341ec1782533a4860f6894ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236658, "uuid": "728edbb9-d8ff-47c9-bca3-1455d1af7bd5", "comment": "Malware payload (RedLineStealer)", "value": "d58cedecae6b011df7c8f9bedb5f7308df617c900d017687530106459ba0b334576bb46c663ecb3448d04caa88d701d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236658, "uuid": "fdfe9e7a-b007-4842-a954-ad3f13b9038a", "value": "T111552316DBD891B3C8F8637268FB428721317C26AE24A37327D1DC1E4CF169936717A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236658, "uuid": "b3ee92e8-bef7-4485-b001-b99c2f12c0a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236658, "uuid": "92a140bf-e541-432e-908a-59d4940d6371", "value": "24576:myjgeiQT70jHEFiBl1og4PUaQ0GIp0L4Hau/1zwssYBKKymrhQ9:1RiQPIHJSg4RUL4HL/1zjBKTmFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695236658, "uuid": "5b5b07b6-fc6b-420c-b31a-7befcad9b311", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695236658, "uuid": "3d7d2190-ff6f-443f-af84-8856700629ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236658, "uuid": "eb213071-fcee-41ca-aaba-e03277e77d65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8725900-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695229049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229049, "uuid": "d9a2baa6-2ba9-441e-9abf-806f9652976c", "comment": "Malware payload (GuLoader)", "value": "22f0ac97de0f5dd3d4a95b9ba14684a5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229049, "uuid": "5d3908e8-9d34-47c4-b62e-01974ee1e4b1", "comment": "Malware payload (GuLoader)", "value": "80407312227a80e31ac1d171f2d9c8fb31ee16fc8d089d4c861d53b34e6630d2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229049, "uuid": "e0a612df-6bbc-42e1-b91f-e23fd149cf5f", "comment": "Malware payload (GuLoader)", "value": "8c79409bda7b2bcc4eb418494bf0904048ecb316", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229049, "uuid": "473c6881-2eb2-46ec-87ae-4bb92a3a1171", "comment": "Malware payload (GuLoader)", "value": "fe3eb5fb6bf43047a6fdc488aa4d9813c8a3746708ceda1232060b914ead0e9de31079b09e6b6114c74625d48171b731", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229049, "uuid": "a3bb0a65-066a-4080-984a-bd3665b1e882", "value": "T18915234453A0D413CA902373E5AA8BF65658CDC7F93A6A0773917F283DF78166E2D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229049, "uuid": "2f11959f-bad8-435d-ae88-91d7d9d61c1a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229049, "uuid": "995acca6-0092-45a9-bde3-711352025589", "value": "24576:eq7JcjVuJlRAPpmZsWpdmlKK99NDpKGN/VcUN/:V7uEqisWvKWGNNN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229049, "uuid": "7f6607bf-970e-4416-8951-60e3549800ac", "value": 903845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229049, "uuid": "43c8d662-4c59-4dd6-ba95-6908bd4ec99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229049, "uuid": "e83afcc0-f5cf-4a69-b7e4-8ea381d29519", "value": "KZ_DHL3552647727464000000000003452742023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed87471-580f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695253487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253487, "uuid": "9fee3258-bd6a-4f48-a651-911a540c9732", "comment": "Malware payload (RedLineStealer)", "value": "d0d2ed0c5498b18ccf05105ea653d6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253487, "uuid": "19f0534d-ff1c-4f42-96e6-7e642a44041e", "comment": "Malware payload (RedLineStealer)", "value": "813676ec85fabf5ad36edb89e862d0e166bd3b28243db92a06028d30c74e29b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253487, "uuid": "f7df78ef-7bb2-4467-a161-a6e5d3fe1820", "comment": "Malware payload (RedLineStealer)", "value": "6ca53ced71e580e2c3bf568961764bfda30e7b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695253487, "uuid": "32f1f8ac-ec0b-4f8f-8686-32142a27a274", "comment": "Malware payload (RedLineStealer)", "value": "458179c93b36ede339a3153a8f1a0f5f41baf012c013a3ab104bec5edda7039bb4d776f9abb418f05f34f800a0caa32f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253487, "uuid": "5f3959d3-55ca-4f3c-bc8d-138496427251", "value": "T192552302ADE89531E9F4177014F207930E3A7C614DB8A79A7B839B6E49732D4B87136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253487, "uuid": "fba6a380-8e3d-4451-b467-e2085b0bc163", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253487, "uuid": "b3091af3-0e95-4102-996b-c06bafbf1ea8", "value": "24576:Vyab7kx0BhRt7SFvdL5TCx7zQ9px6PiIVEKFqRklr+vKD9XU:wacx0pt7SzsdzQTwTVESq4r+vKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695253487, "uuid": "07adb860-ed00-49d8-80e2-f7600625a1e3", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695253487, "uuid": "a78a16e0-90cd-4a65-a8a0-b108475d9577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695253487, "uuid": "c3ae0c50-b38c-4ae9-9983-ad4c232c267d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993c34aa-57b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695213078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213078, "uuid": "30cc67a3-d31c-4d91-82b1-174117d57fa9", "comment": "Malware payload (AgentTesla)", "value": "e4744eb964783fec5a5f9a996ceb3db8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213078, "uuid": "8b018e36-c3e6-4e02-a66f-77122572bc73", "comment": "Malware payload (AgentTesla)", "value": "816c822c36a89b5247387d07b11b5b2f14e8f5579610f911288cbd510bbee388", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213078, "uuid": "2cbb2063-a9ad-4ca3-ade8-f432c05a64a0", "comment": "Malware payload (AgentTesla)", "value": "af9c8b5ced12312a9e2435f3948121f5f6d2256a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213078, "uuid": "89081ec5-c0b8-4cee-8912-c2a217cb8e56", "comment": "Malware payload (AgentTesla)", "value": "d25cb55da2782ac483fe16aec666634174131cde11cff1a4d2daeb224230dc84f7a4576875b05fd172d20185486463f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213078, "uuid": "067c6309-06c4-4390-9421-a7d6ed7c460c", "value": "T1F705337B5D210306B6BC6E91FCFE32D7BF954698B208E82892C5DD190ECC5762920D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213078, "uuid": "e4f8041d-c3c2-438f-a9c5-7e5648a04dea", "value": "24576:jPLum5lFs9oK/rPuQQLXB3w1HUoG4HjwdF:T3zFGPur610+sdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695213078, "uuid": "e9943df4-df0c-4428-953a-aa425c6248e5", "value": 839497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695213078, "uuid": "63672bc6-d508-4bbe-a050-8fe1391b7ba7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213078, "uuid": "af9f6997-8727-4f41-8193-bd093c021fe3", "value": "Arrival notice & invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9836341f-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695228968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228968, "uuid": "9fac9cac-c0fb-4ad4-b812-ed350b2e55dc", "comment": "Malware payload (Formbook)", "value": "9032f044019161ceb48ad16bff220a09", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228968, "uuid": "e9af4128-8705-47b7-9526-91a45aa3143a", "comment": "Malware payload (Formbook)", "value": "81ffd4964a93e3b7ba7a6308d8f8461b752ec2d038476b926a7a7ec0961ce818", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228968, "uuid": "487f1670-5561-4dff-848a-91baabe5b813", "comment": "Malware payload (Formbook)", "value": "c2aa0c449807c6af48a7d4dfc1ae768e32d90f4d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228968, "uuid": "34bf0b7c-717e-4538-b531-9036d4bc474a", "comment": "Malware payload (Formbook)", "value": "fc7f550ab6fa6305693ca970f7543b8860479acef23c9c0780a08d31d285c99d603c4befa6c4b9ea9b28b23944f6074c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228968, "uuid": "0f141d2d-0f9b-4ed3-bf35-a63d4e40af61", "value": "T1FE456CD35DCCBA82C70982B7EB03F5ED062BFE4D948524D63571EA4A297319D1C3A439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228968, "uuid": "b40ea2ea-5387-4e22-9509-b94fbe29dad5", "value": "24576:0WQmmav30xSZy6w6VH6N7fZyLw6Vr6NC6ER31sITgx7V0y/iw+s:JQmmQ306+6VaPP6Vms1LTG0yaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228968, "uuid": "9c2ea1b9-a51d-4963-bf72-4cc1f85ed5d1", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228968, "uuid": "73630fe8-e369-402e-99d1-5d729630ba3e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228968, "uuid": "0af4b3e7-a37e-46a1-8bab-2a805386182c", "value": "New Order#880549.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b1fa7a-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695228856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228856, "uuid": "792c456e-9fb4-42e3-9845-86ff0a0ba0b0", "comment": "Malware payload (RemcosRAT)", "value": "d85446842044ca52db8884e4003ee4e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228856, "uuid": "36f08708-e982-4d22-8c12-f26ee974133c", "comment": "Malware payload (RemcosRAT)", "value": "8278a87cb192844a46818c28aba0106879e1c368366fc52064d2c7943f3f197b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228856, "uuid": "33373885-b94e-4251-994e-06addb4701bf", "comment": "Malware payload (RemcosRAT)", "value": "c8bb01b669c50e8a13bb0a87548193a4a2274b48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228856, "uuid": "ad3b0732-8c5b-4049-a635-65dc58bc06ff", "comment": "Malware payload (RemcosRAT)", "value": "467a2346a2dbcb7a1c96d19d9ed78f8eb0f7af3f3f8b5e1c04d62ed6cd45fdb4b76eac7eb7c8973cd45c3ba7080ce494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228856, "uuid": "712ceff0-1172-42a2-bf2c-6d6acf3d1352", "value": "T1CF2502253A6C9FE2D27D53F58299898507F6241EA13EE34A4DC374CF6591F808F60BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228856, "uuid": "a133184d-f903-4916-8a1e-2a5b4d498c75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228856, "uuid": "265df4b5-6aa1-4c87-b02b-dfe890145749", "value": "24576:2UW1hvtP1Q7FeBj4nbPqkfdmYmWgwiypm05:2UWjvV9IbPqXwWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228856, "uuid": "68ca21ea-6820-40d6-b908-60409c9f2b3c", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228856, "uuid": "970cc0f7-a213-4067-8986-db2d0ec9df3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228856, "uuid": "83aedad3-48c4-4a06-b754-f5df2e837ed5", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cb0e8f-57be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695218705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218705, "uuid": "b0d27e4e-f76f-4300-8a73-c5f4ef178cd8", "comment": "Malware payload", "value": "b4845a241a8c4e8a22e221edd9d9b5d7", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218705, "uuid": "d4e11e6a-ab6b-4190-a4e0-d8dffe1a950d", "comment": "Malware payload", "value": "82cd5ed58b2a63b3098f8322a7f45e2125406125354981716601e5274bcc9c9e", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218705, "uuid": "b7a09ac3-a34f-44a8-b1da-78ab57ed616c", "comment": "Malware payload", "value": "62c760e98d352131474947f3be744a1336d49643", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218705, "uuid": "307a453a-0f8e-4e20-bc16-a9833f6c204b", "comment": "Malware payload", "value": "44ec4f54174eb1ffa90eaa74da709593dcc735b9797a54037410e19cff89e4acb72fb33009b833f0c9ba66c1617fd5a4", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218705, "uuid": "56f94e22-6426-4423-8efc-d50f033d150a", "value": "T1F1A40200724CEE8AE64767F8A9F1B18E501EFD737AC960C76AC4B31E8435FAB9617150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218705, "uuid": "a6f0004c-a70a-400c-b534-176db9e886ad", "value": "12288:Ao1ZWQmmme6v3QLQuEjT6N6HfXckdZvooFy4s3AuworpB:HWQmmav30xu6N6/XZcoQKorpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695218705, "uuid": "5c5cb615-9004-4d47-9ca4-96f92d8f050c", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695218705, "uuid": "fd5a05b6-db8f-457c-b684-dada2b01f362", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218705, "uuid": "6e2d8aea-029f-45d8-a461-d92841e35fea", "value": "RFQ-ORS-687.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a483e02e-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241873, "uuid": "f190724c-579b-42e4-83ab-ef683028acd2", "comment": "Malware payload", "value": "b20aee0239ed12f8680bfb5464b24eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241873, "uuid": "a7041b7b-e843-4ac1-a464-b68b802ab0e6", "comment": "Malware payload", "value": "84069461bddca05d3fdcea06fc949a1365ca2d5bda7c05f728923b9c415b862d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241873, "uuid": "fd0e47e6-5411-4764-be1d-f74acaf2a9b2", "comment": "Malware payload", "value": "00adbec9df7aa650456df399f0d4e24d9ab7e5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241873, "uuid": "c0a7ca77-2477-44c6-bb00-5df9db0f1259", "comment": "Malware payload", "value": "36bcbfe85ea19080411ec469cb5b0ab4217effd9d7716a6b624cfd1a9520643c56fc371d9d8585bc60e4a3ae7384005e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241873, "uuid": "25fea0be-235b-4392-b6eb-43617823a875", "value": "T140339D65E9C38873D15A557D4D0ED538E83E2A223F2D71C3EBAF2D0CCD25AC61A193A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241873, "uuid": "39942351-c094-4a35-ae01-c5b90be54cd4", "value": "768:aKSmX3MVD4GXZEyuhhq5Db3QHGVkK/8KU6s47IOhw4RkcBup3lDOZvDm2o92yj:TBAp5XQHGVkXKGY+4ecBU3IZyVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241873, "uuid": "7bdfd271-2b12-4c04-af7e-b779fc653a5a", "value": 50934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241873, "uuid": "dd0a4279-2d48-4661-a43a-2d8985483c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241873, "uuid": "96894ce1-bab9-4158-9d80-20d9e17a0cea", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.13997.818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c83197f-57c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695219499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219499, "uuid": "ca7154da-d995-42ee-b8de-9a2e2a90ac73", "comment": "Malware payload (Smoke Loader)", "value": "c1a5f2c2fdfe92338f77c7b7d491d93e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219499, "uuid": "b36ffd26-08ef-4392-9bbd-2d22202398a5", "comment": "Malware payload (Smoke Loader)", "value": "8407e4bb6ffb05e1631bc7c1cc2165bb3ceef41e20586b9ca16baa65896c04ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219499, "uuid": "f8ad3c63-7896-483f-b642-d19a18d617d1", "comment": "Malware payload (Smoke Loader)", "value": "50f7c267a1dd3508d4e18c46d83d1e5dabe48310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219499, "uuid": "c29138af-5222-47e7-b346-db9e5079935c", "comment": "Malware payload (Smoke Loader)", "value": "4ca65a353a4da410d2c256730b67cfb45e4aadedc5c48fea789696fa5aff703b111d1d3edad9b40c50e50c622b7343f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219499, "uuid": "38921ba9-dc13-41d6-8392-22a7745ca5b4", "value": "T18724D011B9A2D472D5E741344830DBA4797F7C73E279898B33682BAFAE303D15B66312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219499, "uuid": "c2746aa4-f51f-4ab8-9066-d4acdb7e4ec6", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219499, "uuid": "57490796-563d-4910-b1b7-b818131ee2b7", "value": "6144:dPhrK7e9dDoe8OnkQp1Y7IVFKfukMG4UTu:dPhm0dDohO1asjKfukqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219499, "uuid": "d724856b-8157-49e9-a705-993e59cd3383", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219499, "uuid": "47ae46de-c1e0-45ea-8006-67b48b9b4ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219499, "uuid": "e86d084e-2ce5-4df6-b574-95df39eb3eb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a554325c-57e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695235432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235432, "uuid": "beea5903-8646-47cb-9118-998e26e55655", "comment": "Malware payload (RedLineStealer)", "value": "aa61ea1f0b44b10e36d34b44be724a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235432, "uuid": "24bfda04-a20f-4cff-81e0-85da0cc864f3", "comment": "Malware payload (RedLineStealer)", "value": "8552100483bd75252d34c2a7b6fb1dc859252c3189a1c4834cabb71ce243ac2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235432, "uuid": "ff716a04-1e85-4b60-abf0-77cba6b4b8f1", "comment": "Malware payload (RedLineStealer)", "value": "f3498c714e2e600a15c4944128a63ad3fde01358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235432, "uuid": "6807f76d-c37f-4d81-94d3-b3642ab76048", "comment": "Malware payload (RedLineStealer)", "value": "5b950b526f58942e2c4014a0385e3b3b32e386d5e4205bd3b9404255ec2465113d33db235ac18c4884bcaeace73401b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235432, "uuid": "86fb229d-baf1-49dc-935a-02fdd31bac5b", "value": "T1FF55230763E409B3D9F52B3484FA63436A327EA02EBD676F3781F5470DB29C160257A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235432, "uuid": "fade8dd3-917b-4b96-bac6-b8a706813522", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235432, "uuid": "562cdeb9-ffa3-4acb-bbe2-e08a42ee5b7e", "value": "24576:9yBDoubteka9EVp9jFT7AP5LT5r7bHJ2lpJdOB4De/qrkN39SHmcs:YeuzIEP9VU5r7zU384s39s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695235432, "uuid": "2d12b952-8cc4-4815-bbb6-bca29fd04b7b", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695235432, "uuid": "4ea19069-6ee5-4e2d-baf4-c4cdf6e9b422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235432, "uuid": "b60a955c-86f4-445e-a165-5bf44b2e44c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2017ed-57fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695245560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245560, "uuid": "81c723da-fbef-4339-bdd9-243adaf7b9b2", "comment": "Malware payload", "value": "9a4569b1b426ff858d74f0375ebe3195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245560, "uuid": "0ecc311d-c49d-4538-866b-7f99a5e5798a", "comment": "Malware payload", "value": "85630537714d5da40be00a1d0d43a52d17eedb10ea08785541b2e663231e05d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245560, "uuid": "94e930d2-76df-4066-a5ac-8393a71d8956", "comment": "Malware payload", "value": "b7cc26581826c7df0b2b4b2e545c86de7a446a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245560, "uuid": "4c589a0c-ff7f-4c46-b5ea-20634b0bef7f", "comment": "Malware payload", "value": "3afaa00bf79b2b58a415388bae520f944f589bca7c8cc6f38a7762244d3d35d8d3cda7eb3a19a75668794781210e14e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245560, "uuid": "46905dae-bffe-422b-a267-d55a0c7585ef", "value": "T12F24D01179E2C4B1D1A745348874DAB07A7FBC33A6B5844B33582FAFBE313925B66342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245560, "uuid": "98aa6359-eeff-41c5-9fc4-8187752b26be", "value": "d13f0a4e1c3acd1a644a413a45b35009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245560, "uuid": "93d33bdb-da82-425c-9cd6-1121f0cd12f1", "value": "3072:/Xt3eLxSje9uifyLyK628zceu0QMQyGVP4ceBjC5Bu7T/qL6:vAV6e9uoM78zc776o4ceYu7TCL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695245560, "uuid": "6ac6a690-b49e-4c32-8aec-5e17ce0ef4de", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695245560, "uuid": "52d99124-0710-48db-be05-a760618f7767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245560, "uuid": "434d8bbd-d267-4acd-bbf3-7d244ce202d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843f33eb-5773-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695186414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186414, "uuid": "027e4f81-c8be-4a34-a902-8b161c90c984", "comment": "Malware payload (RedLineStealer)", "value": "3b9508e658b4052ffeb8ca92a366a8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186414, "uuid": "c28208e0-2c00-46fa-b555-80923e52495f", "comment": "Malware payload (RedLineStealer)", "value": "85a5c13ab6e63d27df6dda8045714974cfe328725741bba7cec6d514d9bce4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186414, "uuid": "f4dc98c6-da24-4831-bfb2-90f4c05e696c", "comment": "Malware payload (RedLineStealer)", "value": "d9bf29919b768753ed01a784b7588ee143d9de4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186414, "uuid": "09273e3a-c53c-40a8-95af-41c2b91b3ff1", "comment": "Malware payload (RedLineStealer)", "value": "cb9bb3e5f360c4505781ef04860c8cf34f856558c5b1ad1aa29d1a7daabdb963337b29edb89f5c6991273f0697c241e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186414, "uuid": "856a2522-bcb3-414b-8b45-f2903df3d424", "value": "T19484F212B5E6E073D5AA41398C25D7B46E7BBC33AC654A8B3B9417BF5E322938D14303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186414, "uuid": "efd06880-996d-49aa-8b91-1e6a35e66d52", "value": "55f2fae2d830ccf9734788609a42549e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186414, "uuid": "6a5594c0-336c-4939-858c-9b205cdd4650", "value": "12288:pRDBpeFtt68N+TthqS47VT2CKroGy0wV:pRVpeFP68UTW155KcLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695186414, "uuid": "9e0a3d48-a718-4cd0-8850-7ceb25033974", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695186414, "uuid": "8f92cc1d-70d4-432c-b48b-515ada4a37e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186414, "uuid": "907e45e8-a396-4571-9c03-6a4c0f239fef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0289de1c-57cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695224851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224851, "uuid": "fd15b56f-a273-40fa-8308-5315af2e693f", "comment": "Malware payload (RedLineStealer)", "value": "396d518161809dca681412490a8cebfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224851, "uuid": "f2c23c53-af26-4314-9d3e-0733f8fbaacd", "comment": "Malware payload (RedLineStealer)", "value": "85ed7537a9df0d4e71c4332fed869ee285a6fe9ebd9bf34691234ab425c4922b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224851, "uuid": "b08ef9ad-6278-48bb-9b09-03e197676b7a", "comment": "Malware payload (RedLineStealer)", "value": "fead7dda280f9d97c62f66a4ff2b240ceb9c5d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224851, "uuid": "cc73de70-9708-42a1-afa3-530574fb0bf4", "comment": "Malware payload (RedLineStealer)", "value": "e8dc04aca0e79d11e479014e6fb55817d03effb11a4bac530c64913b44ebbbe19c812529914ab9a9d0dee5fd1e4e9e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224851, "uuid": "a9c72068-bd1f-44f7-9f6a-b8b4307a0a43", "value": "T1AE652325DAEDA462DDF823B09CF50B830B327D50DE7546BB2644B91A1E33DD4987232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224851, "uuid": "033d7dff-d7ac-403b-ac99-bd3b31c7f6c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224851, "uuid": "c996de12-cd57-40bd-80ba-6934c624212a", "value": "24576:ayJcND3e+VlHmjHaHdPqzwCSwLc8XzwtQ77IFTUMN/zCByU4:hJcxu+Vlwqqc3MPXMtQ8YArC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695224851, "uuid": "e319a0b1-8644-4aba-aee7-887d9d1bfbdd", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695224851, "uuid": "45f0f865-55ec-4952-b22f-6c7d4ea52dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224851, "uuid": "92c2f579-408d-46c6-9b5e-238abc0c9bc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c716eed9-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229046, "uuid": "79003ba1-9d13-4ce4-92bb-5e96986a7f8f", "comment": "Malware payload (AgentTesla)", "value": "4fe035d4ad7d6d2d4c6b2c72bb452479", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229046, "uuid": "0cbbf784-9ec8-4d8f-86f9-153a4506d971", "comment": "Malware payload (AgentTesla)", "value": "861858ded7f88ccc9998eb6286cf9376fe7509a04901808bc5a3d35b076412a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229046, "uuid": "1965d400-a293-475d-9295-d2db3910046a", "comment": "Malware payload (AgentTesla)", "value": "7c422abfead11eb078b59094d6e52c2c6e0ed3d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229046, "uuid": "fc9ab2f2-0208-4828-85ec-bc75bcd7c8bd", "comment": "Malware payload (AgentTesla)", "value": "33ba6a809e1af6968243b65864ee528185ffd2d73f69d56441290e220a238da2cd5d5bf18876293799f1b5388f102984", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229046, "uuid": "dd17eaf8-fda5-4d53-879b-105ca31d2e35", "value": "T1B4F4F1113BAC6FE7D63A53F54198894413F1652B613EE24A1DC374CF7A60F808B52BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229046, "uuid": "8be1a9fe-a27b-40ca-b4ba-9a2c9fa8ba99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229046, "uuid": "dbefdcfe-9593-49d0-a3d0-6aa76c951e9d", "value": "12288:ZdnU92iNtefSRwJel7MTqNLJDiFryZby3GyOkoeA46LSQ6uC7WsP4DI:XU91qfS9dMWNLJDiFrabwoeA46muE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229046, "uuid": "7a039af0-4944-4623-91b8-d46db1ba4d81", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229046, "uuid": "9b6fd219-339f-47be-98ee-1fb17956da3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229046, "uuid": "839613dc-6ba5-4dbc-b9c1-3bab336d59b6", "value": "DHL - 1ST PAYMENT REMINDER - 1003921407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecee49e1-5764-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695180147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180147, "uuid": "6fb10621-4de7-4190-bf5c-e0a63caffbf7", "comment": "Malware payload (Smoke Loader)", "value": "419bb1b0f8c68c756f923a7adcb97b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180147, "uuid": "42f56289-0d60-4b30-8db2-908add34c47f", "comment": "Malware payload (Smoke Loader)", "value": "86e8c70995160fb78bb6bd1a9db0bd05d6723b17e403d1aa7d95760f6f75fed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180147, "uuid": "1db4dd93-3123-47bf-88e5-1dc304ffee6e", "comment": "Malware payload (Smoke Loader)", "value": "a8462e59d25819b2b97dccc86bdb60dec54bebfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695180147, "uuid": "bf13aa5f-e0d0-4870-a3ed-8a68e0467033", "comment": "Malware payload (Smoke Loader)", "value": "368abec21b8b8398cf077c6fd511a094a8ef0cef4f7522f7b40383200a18b44391f096efa5b33161b143a34c5b0204ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180147, "uuid": "8192e445-c831-47b8-9085-49121fdea79a", "value": "T1B844CF2277E3C472E4A351301470CBB12E7F7C72667994DB33D41B3E6EA02D19A66366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180147, "uuid": "b08738d0-a0f2-4e1f-b302-07d4dc2317f7", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180147, "uuid": "f8a48bb5-06d2-442a-914e-1d1ef1d6d7ec", "value": "3072:rl7XIAIrWPgrVGhDtZRlX5jahILcxBFSB/ntypeeQ42Q8yN/:rtWrJrEhDDrppYAhnYpe+2Q8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695180147, "uuid": "0dce890d-fe1c-4d0c-8bee-8917a34d234c", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695180147, "uuid": "f815bd45-28d9-43df-a55c-c92306f66bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695180147, "uuid": "fbdb6162-dcc2-4da2-b987-7c76d50d3c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b91b55-57b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1695216619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216619, "uuid": "5aa2e13a-cea0-4cac-9fe7-4e3ca3a9631f", "comment": "Malware payload (NanoCore)", "value": "d4e61a92ff8da165dbf4922816810d0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216619, "uuid": "898adbca-b9a5-45a4-a451-1fa019608286", "comment": "Malware payload (NanoCore)", "value": "87f26bbe201d7f76fff5ae536708f3f7f18dec22e1b3424923429a54b452b29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216619, "uuid": "fbe005d5-6f52-4448-9e36-72309c3302d9", "comment": "Malware payload (NanoCore)", "value": "f9b6e2a4f93966873a49b365246515ff545c12f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216619, "uuid": "e003103e-adde-4ce3-8a2f-4a7ea4973d01", "comment": "Malware payload (NanoCore)", "value": "29809a688bd82e4bc70c8f61c793510d31946ac49dc4eeb9be016c1b1c1f91b7c0d922c342a2af31a07a59e9ff93a207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216619, "uuid": "105c95e3-0514-4bfc-a971-7300fd772e67", "value": "T1D59412A1B2A4D497D0A350B01D75D9BC6EE2BD068C68664733D0BF1F3A73711AC1A362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216619, "uuid": "0d24513c-e699-4a3e-acfd-597b14fb7c44", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216619, "uuid": "0ebfeb66-49cb-4eaa-830f-de1023a57085", "value": "12288:2YOaKgu716epyzOdHTtbxXTusQRhvx5QAqehcWuCojf2N:2YOj71rUCdTtFTevQANhBefc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216619, "uuid": "777c786b-0e70-4532-a16c-7825eab1ac7a", "value": 444649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216619, "uuid": "a68ab48a-cf9b-4e42-bf27-f60db4e611ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216619, "uuid": "2c295d26-9491-4d89-9a6b-e600d72979b5", "value": "simonalight2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d830192-57ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1695225487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225487, "uuid": "531fea57-bcf0-49fa-9c00-35c0c5ad62f5", "comment": "Malware payload (LummaStealer)", "value": "f9e664749b9883c2c11a13605e9e9656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225487, "uuid": "4e8da1e2-5832-452c-af52-5d8823aa9ec2", "comment": "Malware payload (LummaStealer)", "value": "8a7659a4b6739474463309063dc7d3e0b31f738efaed1f07da450fb0eeff4b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225487, "uuid": "ea479853-966c-4389-8971-702a55643067", "comment": "Malware payload (LummaStealer)", "value": "534cf60d87fe26459a70a7f9939c44593a2222fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225487, "uuid": "42e843a2-ef7c-4e01-af54-ef478d43d0d4", "comment": "Malware payload (LummaStealer)", "value": "7ecee2352cea3a64172856dd009ffcd577e43f5549b8aab9bab634218d6d2157df756b031649fe3389a129f800c90ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225487, "uuid": "066ae4f4-86a8-4ebc-a363-91c502fb025f", "value": "T160941212B9D6C072C4A344370838C954AABBBC73F67986573754277E6F322816FB6392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225487, "uuid": "f29e7abb-e47d-44ac-bd92-7e3bb25ef112", "value": "e1f9f27a83d13d8b0a5e72b935d02f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225487, "uuid": "d5b77f51-cc7c-4dc5-bf60-ec8736f54f06", "value": "12288:0ftsVA21H4Ex6fU8isWQb+QWltXWrXGtVErGiZ6:0ftXWYExivjWPXWAErGiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695225487, "uuid": "eadae1f0-dba7-4c64-b1f2-6cb2363e0e20", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695225487, "uuid": "31abecad-3b3c-4558-9815-7e786dca0c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225487, "uuid": "3e63839b-5d12-411b-89e2-b924da957958", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2ff373-576c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695183475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183475, "uuid": "03aecfc0-4dfc-4280-9f45-bedf91db04a6", "comment": "Malware payload (RedLineStealer)", "value": "23fe748961d1db32eb2b08c2d9b07f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183475, "uuid": "ef4ae443-9183-4a71-9ff7-f33bde3aecc2", "comment": "Malware payload (RedLineStealer)", "value": "8ab4fbfe2114eb1f9d7b0dc46e96cd41dd1cc2a122e86d1c1c458387c7853722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183475, "uuid": "1ee6cc10-45ac-4ae2-b672-faf4a1f05798", "comment": "Malware payload (RedLineStealer)", "value": "e89643aa0b0260bcef60e6e2fac70e08bcb28289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183475, "uuid": "1a2eb63b-6edd-44ae-82f9-9c639e535ecb", "comment": "Malware payload (RedLineStealer)", "value": "5016c04af13543acd110f360f6689fb5f2c2600db438c486bcc92f64a202b1b8da3a07bee1d892a1425984b28c2bb2a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183475, "uuid": "80388866-98c9-4ef9-b469-5f7b062265fc", "value": "T12E652362F6E41071D8321B7058FB1B5316377CA20DB8476F5B82D8261AB2AE86C7573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183475, "uuid": "ea3a715d-bada-4a01-8850-9aaf596123af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183475, "uuid": "d9ae1d2d-7567-4eed-a209-01c270609375", "value": "24576:ey+2zTOIFuj89xwSJV6yuBkAUsMsUcuYaR9T767SoYMCpL5D8:tzOTkJf4KsxUcunRt767SouP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695183475, "uuid": "7f577582-8040-4a4c-abf3-bd71088ecf6a", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695183475, "uuid": "8fe60c1d-25fe-411f-8bb0-475cbf42dab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183475, "uuid": "d9e67d3b-a5a7-4c7a-869d-5f41807b07a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99a6465-5784-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695193886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193886, "uuid": "3d0a5aa3-0e40-499d-ba09-a0a338e537a8", "comment": "Malware payload (AveMariaRAT)", "value": "560f0bff93cae96bfd9cfe836afea3a9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193886, "uuid": "647a51f7-72af-4482-a94b-7474d3d611ab", "comment": "Malware payload (AveMariaRAT)", "value": "8b07a54c56a90cab57991dfaa5f1d2f3a2ac852a15f88606b4a4a4045fd41951", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193886, "uuid": "bc3cd95e-9bf9-42eb-a449-819f6942ae9c", "comment": "Malware payload (AveMariaRAT)", "value": "837299fa94637824b717fc2ad407b7b1288fcd4f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193886, "uuid": "21d60bf1-e096-4b7d-ba1e-66579f59b4eb", "comment": "Malware payload (AveMariaRAT)", "value": "059e172a91c3348a7b289b5f455a99e6ae76d31ac277133c0f710e580b83f89e6cef60885e0dcb248cddce3de19699ff", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193886, "uuid": "324ec7f6-d157-4ad6-acaf-ac33f78f70bd", "value": "T125D31A33BE10512BE92589F12CF69A3E76166F3A17917C873252BB042675293B6F430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193886, "uuid": "992526c0-2de8-4208-a264-c3956a66a902", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193886, "uuid": "57708237-186d-4c60-9ed8-d31a5f8cb2dc", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVCg:UVqoCl/YgjxEufVU0TbTyDDalQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193886, "uuid": "b2b53d88-5868-4c23-a614-c6c914508088", "value": 138281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193886, "uuid": "2edbe517-852d-4cb2-9bb4-547b60a52925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193886, "uuid": "d3d0a1c6-8105-487f-9faa-e9e8909ce9cc", "value": "spoolsv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3054ab4-57e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695233281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233281, "uuid": "c391c5ed-bd6b-4d5e-a706-b454e7b23142", "comment": "Malware payload", "value": "c641e5f07343c4430feaec992166a3c8", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233281, "uuid": "7a6e236a-492f-4dc5-a246-70fc5631efca", "comment": "Malware payload", "value": "8b5c0cdfff949c42241546ea4fee9c4aa0af70a23c7e204d66f9bacb034e544b", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233281, "uuid": "23498133-0ee7-46cb-b926-1854995f2268", "comment": "Malware payload", "value": "62f8788e8fac62d0faf75c5debdf8375f272609e", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233281, "uuid": "3af7f25c-05d8-44ac-820e-5650a7104d64", "comment": "Malware payload", "value": "955018a86e9dc8d792112cb53d66082df260e577e4c59a60637fd3a21f180932c3a346f1a72187f5a185c77ce3f79f43", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233281, "uuid": "f8fbb791-1f06-44f6-b5af-c3954d391575", "value": "T1AC116339A688CE58DE7010321C6B0E86CA6345C4BC34D37F28E8C4117F43859C6633E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233281, "uuid": "95a9eb2f-8d00-4b9d-aa86-53b611ce8efc", "value": "24:9z7xznz/stMUTBKQRl/Qvr1syQQSbAfsIvorL6y1Y:9nKM6B7PYvPSbAfo6KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695233281, "uuid": "bd82f467-37ab-42fc-8969-febbba62800f", "value": 904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695233281, "uuid": "eeb416cd-e009-4090-9b17-7e31fb41824d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233281, "uuid": "66d909ff-f491-4663-8a94-76d7d7a22c12", "value": "U.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c39e20-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229170, "uuid": "340882c7-aa7e-4acc-8a9d-cb6da844a74f", "comment": "Malware payload (AgentTesla)", "value": "ae0f35d5292498526ed57830eed8b6d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229170, "uuid": "aa6cad42-3ace-4b5b-8cb1-224d5e5a0468", "comment": "Malware payload (AgentTesla)", "value": "8c15a8c2b5d83747a09840de8db4a5836121eb7e1fddaee1f1529e8d82737734", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229170, "uuid": "86f8178f-dddc-4156-ba90-1242eba033e5", "comment": "Malware payload (AgentTesla)", "value": "94eeeb2ecd6a46e6f1b3e1695b4f549d153b847e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229170, "uuid": "a07f1614-115b-4aeb-82ea-d16b2a2efead", "comment": "Malware payload (AgentTesla)", "value": "3b131dbd33a8f7df43a6a025e401d3b9a1fb7aa1707a2a0d590c50e10284711bc5892c5bd544a97bae12ab823026740e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229170, "uuid": "65423e8a-bb85-4e23-9ad9-efc2077a2f26", "value": "T134F423F1C9B22C36C54E99ACF15E40182FBF91C5460A4FC9B7B588D7C9F88B3629246C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229170, "uuid": "14b49348-11c8-4b57-9549-0abe8f84b6b5", "value": "12288:KJJBQeEiKoDxkii6fgeOGkr9Iy7yj8XB23/L0LEaziTIVR9/kvPlz4l4+XCCwJK8:ogX2krSwy6G/L0LTTVR5Yt8CLCwwZGqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229170, "uuid": "1735c691-51f0-4cd7-be4b-d369de3a71c3", "value": 725625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229170, "uuid": "5de0efc2-7bbd-4b10-9fbe-5a34436e96bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229170, "uuid": "7e6cadb7-4973-4b7f-beda-e7ec29680d6b", "value": "Fatura talebi T\ufffdRKTIPSAN.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f677de81-579e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695205074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205074, "uuid": "112600d0-ff6e-4c4f-8533-9afa40d748bd", "comment": "Malware payload (Smoke Loader)", "value": "b1bffa4b91e0e0748caaf741470e3fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205074, "uuid": "dab12fc6-0878-43c6-9f0f-5ccc372bac84", "comment": "Malware payload (Smoke Loader)", "value": "8c60fa8fa4b468973b28566c54ced1dd235a228c167972e87463e3ac0a44570f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205074, "uuid": "21346861-822f-4de0-83cb-4a2559931d51", "comment": "Malware payload (Smoke Loader)", "value": "5cf479877bc29f4ed845a794224f94e1f875089c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205074, "uuid": "e4d4dd2c-7866-4598-80d8-9439119b4876", "comment": "Malware payload (Smoke Loader)", "value": "0b1f9e4877a4ec9ac30d6fbdbe005cce74b551361bbd540a416282d8022c62bf6417e00aaef6cc200e659e9159a3374e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205074, "uuid": "bfe49bbc-0241-490a-be72-a7a0351fe93e", "value": "T17334DF2134D4C073E56746358824C7B46A7FBD375E658A8B3B802B6EAE313D39E21B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205074, "uuid": "d54da18e-2b4d-436e-a805-47d7b29b35e3", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205074, "uuid": "61bbe389-0d2b-4753-b568-f3809363bf00", "value": "3072:zNSG05/j9i2qaipT624OaQ3AZMb0khfYUfKhr1QBuIw9FWHZ75vj7cXTzm:Qf/i2XKTYOH3vfpFSr1SwA5hjoXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205074, "uuid": "01ec8731-ad23-4ecb-85d5-a3d06dfd3763", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205074, "uuid": "c5761944-f759-4b7f-989f-2691dede022b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205074, "uuid": "ba9c846d-6fde-4e11-b6e0-19172d7d1af0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f17753-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241876, "uuid": "ef301762-2525-4edd-a3cb-1c91f2fd902e", "comment": "Malware payload", "value": "9322fd19311f3e6d4204b2adb69e2a0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241876, "uuid": "ad6fa38e-9e08-4c18-8b16-37ad83579068", "comment": "Malware payload", "value": "8c64fd35f497a220abc72b4ff31d023e6a83905051dc067bfe35551776315d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241876, "uuid": "e8030c4b-1831-4f4b-b359-b3e08cdaa5e6", "comment": "Malware payload", "value": "68f78745b68dc853bd0afc05ec25ef9507735945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241876, "uuid": "67573b4f-0e03-47bd-9592-d254ebbe3b49", "comment": "Malware payload", "value": "c06467cd349fa15321896492353511fc8a36cd3272331dd0c25f10795d6d8b58f85ba218536e3a9dc38208377f8e9df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241876, "uuid": "6ee02adf-cf10-40ef-a33e-98782970429d", "value": "T1B4239D55E8C38873D15A557D4D0ED938E83E2A213F2D71C3EBAF2D0CDD25AC61A293A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241876, "uuid": "7f1ae234-163b-4905-97ca-2385c8fcab5a", "value": "768:+KSmX3MVD4GXZEyuhhq5Db3QHGVkK/8KU6s47IOhw4RkcBup3lDOZL:vBAp5XQHGVkXKGY+4ecBU3IZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241876, "uuid": "89a88f4d-295a-4a6c-8ec3-51ba90367cf2", "value": 48022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241876, "uuid": "af854b53-5704-4bf3-a323-fdbc3d7325c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241876, "uuid": "7655f46b-110b-4c42-a326-04312ff22804", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.20034.20459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8283eb2-57f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1695240618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240618, "uuid": "dd33e80d-0d3d-41fb-a5cb-d20e37c56f50", "comment": "Malware payload (AZORult)", "value": "c1174d80870f95adcd61cadfb70cd864", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240618, "uuid": "9a5c8368-a8ed-4f49-a31c-7a793a1677da", "comment": "Malware payload (AZORult)", "value": "905a4037c88ca3ae7cb91556aeee60a02c08fd5b15379c2c0e54702c88041970", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240618, "uuid": "5a89ee00-a19e-434d-b8cf-7664a20c8233", "comment": "Malware payload (AZORult)", "value": "3745ccca243a0937c2ff33f01b710893362587c9", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240618, "uuid": "8f71169e-6483-4525-a029-d0c177b1ae94", "comment": "Malware payload (AZORult)", "value": "d711fe23fb15202be8dffc286a04ae281982a037f40919ab764d78f4ab9de02cb95704a15a2cf6af51e6f0b1a67a8285", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240618, "uuid": "8249c0e2-9ce5-4840-aa0a-086123b06499", "value": "T1F99402607B94C81BE3D14574A874F758CEBAFC281D3A8B02BAAA77DC7139B954C6C311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240618, "uuid": "ced69d76-2537-46c2-bc21-fe657ea348be", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240618, "uuid": "1539f9d4-a52f-4523-b6ed-3b96be5d8595", "value": "6144:xB+pgUvsgje7IL1booOR8gPOquMGwWWRWHYcCT3hUt4Rj35j5YEj3BTun4e:xgnN+41MoOR8gcMGwWnH1CTxdR9xxje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695240618, "uuid": "964e20a7-31a7-4dd5-a01b-9652c0c3f510", "value": 441148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695240618, "uuid": "6791e2c3-34f8-4de7-9c82-0587fbeaaa81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240618, "uuid": "447b7677-9a08-4007-88d6-4e68c2f8913d", "value": "Accept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1715e56-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695196342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196342, "uuid": "d65e95f4-23f1-4520-8b6f-3018facda1eb", "comment": "Malware payload (AgentTesla)", "value": "ad08772e2adebe46242e8e3f302e373b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196342, "uuid": "3ec5c28f-61c4-423a-bfe6-d1bc229be7d8", "comment": "Malware payload (AgentTesla)", "value": "917eeb46453deb94e6c16c4519d29d32566e39618baa3c877d9f979ec938e2a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196342, "uuid": "e291595a-32da-4d78-821f-0990f3d95317", "comment": "Malware payload (AgentTesla)", "value": "381d9bb6eb6f8142771253681d88cf5011b09a6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196342, "uuid": "6f8424fe-ac1c-49a9-9a56-14b064cf842b", "comment": "Malware payload (AgentTesla)", "value": "d5f475919af3f9285a61cc58b4bbded499c57d5b023354d5a7bc9783f7bdcbc72b2cc206d5aee314a82d6c4cd918f0a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196342, "uuid": "8eb688a9-9241-4b0b-9770-7d1de2ea8e65", "value": "T1DF456AD25DCCBA82C70882B7EB17F5FD0A7BEE0D948528D63071EA4A293319D1D7A435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196342, "uuid": "a5fcfeba-3a52-40c6-bcdf-4115dce9c313", "value": "24576:FWQmmav30xSZy6w6VH6NlZZyLw6Vm6N1aFR3FQkTwJ29+SfKwy6:EQmmQ306+6VajP6VzWvFbTz9+SiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196342, "uuid": "aa1a4d8f-9b15-4d4c-a19b-5ea542df5c1e", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196342, "uuid": "b527db93-9b28-4d8e-a1f5-e85c3d29124a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196342, "uuid": "884316db-2973-47b3-83d7-b7cce63b7452", "value": "PURCHASE ORDER NO 4100000673.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59251fe-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695199436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199436, "uuid": "efeb00b8-a9a4-44cb-9ec0-47c2c3d8c019", "comment": "Malware payload (RedLineStealer)", "value": "3897266dddd5a1a83e0e5e43d3c6bc6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199436, "uuid": "76a4d234-5983-4074-9097-ffd151b4e135", "comment": "Malware payload (RedLineStealer)", "value": "929b56c9ca3a8d7dc569c67de9e73136b06df81438614880ee1e7f6ed952e965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199436, "uuid": "54cc2a42-a18a-4323-b262-23332a82c6a6", "comment": "Malware payload (RedLineStealer)", "value": "f5a979d8fc921ebc7fb28d0f06a77557e427b782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199436, "uuid": "cd33ea0d-363d-4668-8fbc-825388a02455", "comment": "Malware payload (RedLineStealer)", "value": "f38d4cafadc3ef1a973060aa897c059dcd2d80bffd8ec0479f12e681ed5e18f4eb4fe9a42e41532b8898ea0e4b1b41d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199436, "uuid": "263cef45-9b8a-4f3c-9bc6-38cf5a545ebf", "value": "T131652303A7F98476E4B227F849F611F30A397CA43A744BABF361695A1C71A46B025733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199436, "uuid": "5007fc67-c5d2-4a3c-805c-40ad569f0d4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199436, "uuid": "8521e163-89f3-4dc1-a1f4-7dea2fff8ecf", "value": "24576:CyuvlnByICAW8FHCFRe+qn3eHmJjJ+kP3AT0oeKL1M8o/eTahLkbqMEt45iN:puvlnByIcwERVq3eGJjJpA1Z1MyYoTz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199436, "uuid": "3c180270-5397-44a8-b9e6-bacec50b5732", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199436, "uuid": "741a1adb-b56c-48dc-adae-b67a46fd6f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199436, "uuid": "976d5741-76af-4e74-bcf2-d9f8df248153", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c77dd4-5750-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695171512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171512, "uuid": "13206004-950c-4b9a-8c58-9ff7af6e6436", "comment": "Malware payload (Smoke Loader)", "value": "903d66fdd50dbc5476a6a236611f9c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171512, "uuid": "8bb55258-b2fe-4f17-980e-99a94ababe05", "comment": "Malware payload (Smoke Loader)", "value": "92dd5612e2bcccc65cfe2123ac7c1cc2448e1ebc1300ccf00ed34b2a65398295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171512, "uuid": "d58cc9d7-053f-456c-94f0-1c0f068ad595", "comment": "Malware payload (Smoke Loader)", "value": "06bad477bd0f58272441c43134f3ad5b60298eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171512, "uuid": "c5cb0b96-4ad4-4574-b38f-be77a6e6039e", "comment": "Malware payload (Smoke Loader)", "value": "9b313765be3f5cc8a4650530df33690cd91b682d2b4970767532f0b3792bed9a503dfd8abed057ea1361d24712ed8610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171512, "uuid": "ca135d24-f46c-4df0-950f-c27e19b9cb2c", "value": "T1B4853301A7DDD0B2DDB5677068B3078B66353C641D74DB2A2706A59F1C33AE8CA3076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171512, "uuid": "304b1aa0-0bc8-46f6-a664-f518b8d41100", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171512, "uuid": "65100496-4af4-4807-88a4-e4e3e6f93439", "value": "49152:oA4BSgGKSibe3fzzxPkfym2fwmHayiCj+7fWUE7Jq:B4BSJibePxP+79yDj+7OfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695171512, "uuid": "6961d98f-ebf4-4ab2-9086-98d9af4ad42c", "value": 1716736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695171512, "uuid": "c36e8f2e-2d1f-42b3-ba26-47fc6bd9e93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171512, "uuid": "0d7cdad4-d541-4cdd-abb9-fbf72f8c9025", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf8d3f7-57b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695215770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215770, "uuid": "a84d1af3-d6ae-4b82-81b1-b0427f3ed484", "comment": "Malware payload (AgentTesla)", "value": "9bc1a642fcf8d2358aa856abb1acba2f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215770, "uuid": "c6227f9d-4104-4a37-bbf1-15e86fd20fce", "comment": "Malware payload (AgentTesla)", "value": "92efc0a12d514b2af1c752608c7cc0c778c6736ac508bffcb77f9650a6ef1992", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215770, "uuid": "4f284035-b1e2-42f2-8315-bf84553033dd", "comment": "Malware payload (AgentTesla)", "value": "ff7535ddc0956a86b8ffb3fb847e867cedae4b12", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215770, "uuid": "8ef94c63-21b3-4fdf-84aa-844ff65e8812", "comment": "Malware payload (AgentTesla)", "value": "4d0c13dcd391c2efcc32c26c1b055eb38c1c119b7437f3f583e58de08447241cb4ee7930566d7d9ef836d0db43476db1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215770, "uuid": "6af9e6c5-3e68-4c91-9ea4-687901921c03", "value": "T1EDC42342CC0A1083AF7C552D9B5168AF0E4CD3B98F63D52113EAEBE66783A1DCDB5871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215770, "uuid": "fe4006cd-bdcf-4f8d-add1-9235cd414b53", "value": "12288:sCoWCs3nc5DO7CuSBURh5EOibTypjQ5GjMTkq9+zo5VkVh2E5e+:sCoWCs3tcBURhjHg0o5Vgh2Ec+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215770, "uuid": "1ceaf5c6-9104-409f-b110-926dcf3864e7", "value": 571041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215770, "uuid": "f328fda2-12dd-486d-9314-d7fcd119da48", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215770, "uuid": "47c2ec00-cd79-49b4-b77f-792e94b502b0", "value": "Payment JIECANG.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9c4011-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229114, "uuid": "da3afa1d-4d0a-4924-ae2e-9ba2b4c6267a", "comment": "Malware payload", "value": "5789abfd18bea68da8d812c35bf46126", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229114, "uuid": "e10da975-3316-4b71-a8b6-2e9d23c5df94", "comment": "Malware payload", "value": "93b9bfb13d0cbf3d090c27efc0ffac921aac926aab1e99fc574361d1032b4f5c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229114, "uuid": "d019bb7b-578c-4116-81ed-2cc232af4ed2", "comment": "Malware payload", "value": "19dffdc8dc7d08f6ec481caec83a98962c633be4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229114, "uuid": "ece36bde-9b17-48e3-8688-24d04442002c", "comment": "Malware payload", "value": "e46ea3178dde1ac6aca9bb358324d431b1e82b516c4b122fa535fb634665db90e30ac79fec09fc9bf7bb99482d2da38c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229114, "uuid": "c33e5a6d-a9ad-43fe-8a1d-6a3fe6714e42", "value": "T1EFE53366529575E2F38923F09B2DE419353C46C705693E090F96DB1FFEC607A2A88BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229114, "uuid": "adf8349a-7f3b-45d0-81aa-8d7fbb572202", "value": "49152:BjEFJ96i7N2KlRja3gEgGtgu6OWBjFkOolZVlHFaxer2ZUOP+O1n+oTBLr:q/7IKlRjaECF6OW/UWxerEh+sn+oTlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229114, "uuid": "2eb40bde-cffb-4283-a65b-fa6d86f721db", "value": 3168399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229114, "uuid": "f5da8a74-4a7e-48a1-a7b5-4c05017c4e63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229114, "uuid": "21917fab-cda6-4c07-9c53-8e83b0a6dabc", "value": "Fatura.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09675b2f-57a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695205965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205965, "uuid": "406c2b39-0f1a-44a5-ae83-844a3ed5b932", "comment": "Malware payload (AgentTesla)", "value": "72e4c036b96efd053d4233076fc4d426", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205965, "uuid": "39d05232-750d-4158-9a66-47cb494e2df1", "comment": "Malware payload (AgentTesla)", "value": "943ab44f62fc79c07081e2831c5069d63e6121a94f64f508f9808f09065da978", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205965, "uuid": "cfaa9fe7-d86e-4f8a-b474-2301a09551bc", "comment": "Malware payload (AgentTesla)", "value": "60b0b0514b5c3a2a416e35db0370755ca49f852b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205965, "uuid": "2cf5f78f-5597-4bf3-b83f-b2d9782aa2f8", "comment": "Malware payload (AgentTesla)", "value": "c1830e7bfc33f5cb1838ec0f81f3792b4390c66978db863ca8e15f7cd371bbf024e28758b103092f3d0fa31f637b76e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205965, "uuid": "e9593d35-132d-4e3c-b69a-f0b479695956", "value": "T196D4BF1431EB6D56C426FBF50BE8EDBA96DAF0E2121EF73A3F810642835DD448E42971", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205965, "uuid": "48340009-2675-47b7-bb35-22cf7b460384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205965, "uuid": "9f826dfb-bc03-44bd-a4db-ed16b313c9be", "value": "12288:evwTC9yh1a7trTkGY0sHBNVepe0Bk8Jurp5SsBpS/8tOxpTF7rDx:y+Pqr54/VetJ85SsWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205965, "uuid": "9fa25ad1-0d21-4859-a73a-12e0727b0f5d", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205965, "uuid": "dd99f575-cbf7-4168-ad8e-46973f2ffc32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205965, "uuid": "846b23e9-8dcf-43b3-80d3-1e951a950587", "value": "SecuriteInfo.com.Win32.PWSX-gen.4483.17238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cc3378-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695229069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229069, "uuid": "b05323a3-4530-49e9-b0eb-dde8a665db70", "comment": "Malware payload (GuLoader)", "value": "354b019401325ff28a5d2cbb274472ff", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229069, "uuid": "14dac110-f7ae-4472-a96d-f40d1b09d165", "comment": "Malware payload (GuLoader)", "value": "9490c9ab48e5d901acbe59cb0fbc27d8a6dd7b13976ee16fa4c2da61742e4314", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229069, "uuid": "64dc75ca-9708-4077-aeac-d74ef9a13771", "comment": "Malware payload (GuLoader)", "value": "31c5cf959a67e6b0e9e9483c5069a05edfb50384", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229069, "uuid": "d9460fdb-fa8d-4c5a-b26c-ce6c83a1ea98", "comment": "Malware payload (GuLoader)", "value": "655724ef8554b6e1020ee586f6568d844350e08513e19012b767dee9f2679272d24194f62674ded0d451c9703b8f2eac", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229069, "uuid": "6bf372f7-ca43-4cdc-9ffc-527397b5027c", "value": "T1280328A1C6C60A384A4B1BDEBF01A652C9FD813A8326802DF65D176E615396CC73FF5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229069, "uuid": "2b15e04b-ff9b-415c-a00c-bc5345965fb4", "value": "768:corMtwTVlHPwlR5EQi/GoF6bgTU2XMmjp5zAiPh2SF0GCG8x:coQqPwN6GoF6b2cmV5kicW7Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229069, "uuid": "09a28391-8499-4c01-b41d-62a71bd536ca", "value": 41028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229069, "uuid": "ad0d0968-f985-4e88-b854-35150752cf86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229069, "uuid": "cc0510fd-6ba5-40d0-aa84-a3f93a04b612", "value": "BL-GLLCN0003290.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca1ffaf-57e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695234747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234747, "uuid": "d3276b8c-f1ff-410f-8902-8436d8136bf8", "comment": "Malware payload (IRATA)", "value": "60e2ec5f1dc345e0edd123e3d2abad4a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234747, "uuid": "1efc110e-53c6-4ede-b052-84b5695722e3", "comment": "Malware payload (IRATA)", "value": "9531060222b82dc748913bca24eb75685895830ebce136fad0aa115445426c47", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234747, "uuid": "aee1ac04-e60a-4fc3-9f2d-e02e8c362f68", "comment": "Malware payload (IRATA)", "value": "a23ab385d112df8c80b72490283c24cea684e058", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695234747, "uuid": "d593828c-b88d-4d50-840a-f7815d6c48dd", "comment": "Malware payload (IRATA)", "value": "6f6b449c02412650c2de235e588aee52918a1940eb2e827990ad688ea9f465a6f625988b8c0dc55a1cce7e6a06d4320d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234747, "uuid": "44248544-6075-4309-ad30-fb56d42d93ce", "value": "T1B116CF97F395A96BC4F39372817613A5414B4C228F87DBC76D28763C28BB5C42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234747, "uuid": "00ed0ed3-fe75-4daa-96b5-70fc8f96fb74", "value": "98304:oivCgpGk9exeuEgLCrg3TNRltvW5E5pUrFOeKoD:oiqsejnNVW5E5pUrHnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695234747, "uuid": "2455a447-9684-4aff-b62c-bb4826958aba", "value": 4328336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695234747, "uuid": "4eec823b-c04d-47d4-b82a-cb78eec72b2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695234747, "uuid": "f29910bf-fdaf-47d4-b2e6-ef4d0b33e174", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dae58e-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229013, "uuid": "f67245bd-ad7d-423a-8742-4eff3ea20397", "comment": "Malware payload (AgentTesla)", "value": "b6d67fb82d931b66adf46c4283186677", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229013, "uuid": "414690cc-363b-4a21-b267-d56c1d7b7968", "comment": "Malware payload (AgentTesla)", "value": "9549d97eb752358d01342132fd4605531f199ba9a5e9e366dc6063d75ffba5a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229013, "uuid": "f578b2e3-308e-4758-ac4d-dde22aed6918", "comment": "Malware payload (AgentTesla)", "value": "7d2c57618e544c0eb7fe8c3ec0236e2b355a0c2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229013, "uuid": "c191e97d-54de-4a2c-af21-cbfcebbccb88", "comment": "Malware payload (AgentTesla)", "value": "5e7b84092b039cb87792c41362d39dedf87f9f4952fb44dc0f84e7baf9e4b9fcc34e7d83351a8e8fe651e1eb929ef23d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229013, "uuid": "747a9de5-2428-4476-94b5-2016f34846f7", "value": "T163257DD1B1548DD6E97B07F1AD2AA53022E37E9C54A4C10C5D9A7B9B36B3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229013, "uuid": "38863a25-56ff-4b3b-9fde-422fae24c473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229013, "uuid": "61610bd0-cb33-4efc-b09f-83924327df6d", "value": "12288:Qd+oUK2iNtj5ciCDC2ymkOQmqWfWc8qnudcFizc4YDAv9A+:7oUK1/eiWCBmkOUWdudcFiz0Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229013, "uuid": "2f0d6e60-e0b8-4438-bab9-6bfa7d42e2c0", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229013, "uuid": "ab6a7858-cd7b-4e60-802a-a410dff7779f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229013, "uuid": "40b5bc55-66bf-49bb-bfc9-24f0ec576f4e", "value": "sipari\u015f formu_831513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bce907-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695229019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229019, "uuid": "2608b670-e873-43fb-969e-c11518651922", "comment": "Malware payload (Formbook)", "value": "c6240f16924f29d562206c72eca67e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229019, "uuid": "e7db6931-bd86-4043-a785-4738254ec345", "comment": "Malware payload (Formbook)", "value": "96a3709a8156268f9daaeac2aab9c66146967ef173e5d5d2e8a0ed8bde75ab63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229019, "uuid": "15586f0e-5789-4439-a8dc-73cc14f6f654", "comment": "Malware payload (Formbook)", "value": "a997a2b9a79c3951f74b8331d9d338f8db35add8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229019, "uuid": "539ea6ce-5a8a-4812-82a6-64b0260f3578", "comment": "Malware payload (Formbook)", "value": "5747c99569625ce3d8988b26025ca3416a5015a16c92b565a7b828ea1e32a0e4724303e09b597a719e02846d76f4c065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229019, "uuid": "285cf929-753b-4a5a-b75c-e5dc11dc0438", "value": "T153F4F164366CAFE3D67E63F44298990503F6652EA13EE3550CC374CB65A5F808B21FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229019, "uuid": "78234276-ee46-4f76-a093-177ae83ff3a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229019, "uuid": "ac167080-4b4c-402c-b26e-a310657093e3", "value": "12288:GdwUJ2iNtxooevkol51LT9Ox119zN11pB5zvwGVzhthsZQ+aE+iu:lUJ16oeMuT9Ox1nzNBBVVbKZQjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229019, "uuid": "dc204ae4-6d10-4bf3-a046-7b09fde14016", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229019, "uuid": "ac12b875-4e1b-4844-8fed-3e98d0fa4fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229019, "uuid": "ad6fcb8e-7f8e-4898-8a7f-94fce8a5f313", "value": "Halkbank_Ekstre_20092023_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f7f616-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695229076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229076, "uuid": "79048078-6091-41fa-806b-7bec124e19e7", "comment": "Malware payload (RemcosRAT)", "value": "d466b5ea2723bcc1cc7bb139232e3049", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229076, "uuid": "0415e672-d8b1-4f5e-9238-ef6a6e6b7488", "comment": "Malware payload (RemcosRAT)", "value": "97dd87984c83ca4f37b22a643995dc5c971531cca713e023c12e3e42ce223c65", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229076, "uuid": "378f2bae-b7a7-4ba2-b177-fb3515a6bb95", "comment": "Malware payload (RemcosRAT)", "value": "b6c72ccfa73223217e5a7de663cb5b28a7b327a7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229076, "uuid": "f24be909-887c-4a55-8d94-166b21443002", "comment": "Malware payload (RemcosRAT)", "value": "c3c2ff8c9fe86e50a257ffe29236891de75818a98c428e902369d1de18e74592e7c72fa9380791f5ef210dc8d1245b49", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229076, "uuid": "f6ed8a89-2fcc-4fe0-b0ce-472875b27c4c", "value": "T1AB64001079EF688CB2B37E621BDCB6E58F1FF7E11709A19E2510430B9A52E44CEA5D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229076, "uuid": "008949b2-6e4d-4d61-accd-06ee8807cd38", "value": "3072:hVp9pOG62x13pBnoNe5wg/HbLvL+fLbLRp3LOLKfK2w51LKE7oUaB9Eu4ahdjaJk:QGtZ8KoUjSkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229076, "uuid": "8936a9ef-a20c-4028-85e8-c18996924afc", "value": 327980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229076, "uuid": "59ca09ac-1be6-47f6-a555-868f4f61500e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229076, "uuid": "44bf9df1-a535-4188-8d5f-8c2c8a867f99", "value": "AG00109020023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0abdfd4-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695199347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199347, "uuid": "6bb66c22-b596-4909-842c-03cf967cfacf", "comment": "Malware payload (Loki)", "value": "4240e1f4702039b72ee67c3415f2bec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199347, "uuid": "30746df5-0138-4fc2-934c-4068d2398983", "comment": "Malware payload (Loki)", "value": "994dc036815301e1dc941170900f527cea3db5a51ccbbcdd58863a9914d5d1f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199347, "uuid": "bfc9e840-f764-4d8d-8e64-02a7ab4cfc90", "comment": "Malware payload (Loki)", "value": "b53c3c9ba480cb4c48dd2cbd38a6ded818461206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199347, "uuid": "820d0e62-0c81-4633-b2b7-b796d5dc8f9d", "comment": "Malware payload (Loki)", "value": "043b199c0e7ef8c612764fb62cc0431d58fdee14a34a366dca862dfa796ca8c636eb902388a4b44d122967a089dc24d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199347, "uuid": "9ca277ef-0a21-4cd1-92ab-bb976921cf8d", "value": "T16FA40254B7A45EB3C24D04BD0462298023B574A7B419E78A6ECF7CFA0ACBBD586037D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199347, "uuid": "2094ea87-f40a-4c7a-8ac5-892ad6bf1210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199347, "uuid": "9793817d-f397-4841-97cf-27e8f9ae121d", "value": "12288:QQR+nDsNGHA91GaKbI+6lcDKhIG9U7i5X/OFNjPDMYDcKBCVheyRUClEYJTcWh+o:5eyWYBJTB+MCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199347, "uuid": "7360f84e-750d-4f5a-9d37-b7e8e8858c0a", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199347, "uuid": "9bb380a6-6ee8-4495-b49f-bf1e9468a694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199347, "uuid": "fdba5e08-0b29-418e-942d-ede20bf18360", "value": "SWFIT_Copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdf003b-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "dbdcbcad-0577-4cdb-86e1-0a584c26a82a", "comment": "Malware payload (AgentTesla)", "value": "dd0a598210eb6329f2d614ead679d3e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "fbfaaf08-4c78-49c4-9086-45c3fee128ad", "comment": "Malware payload (AgentTesla)", "value": "99a8dbacf70de531b3f0fe81ab684aebb845ddf2148942548edbb23f239aa487", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "bc9952e1-cb04-4420-bbee-d4976ae7fc3c", "comment": "Malware payload (AgentTesla)", "value": "c1a2f26c4b0bcfbaa99e065f865305ce965527de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229002, "uuid": "059e2b9a-29fd-437c-8dc1-8b1c0b94f48f", "comment": "Malware payload (AgentTesla)", "value": "20acfcb1a7ce590b3b19d1de4719bfb0d41982dc3168e011fb30a56ffa1288013debb0ef889735e2db5289c4fd79a114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "885f7de0-4c2a-4adb-ab2b-ce7b2db58daa", "value": "T1AF15021372AE0616E6FB56F946B00014A7B7B94A3262D7EC1C5014DE19F1BC38B93F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "94199332-9d79-4708-82dd-8aefad8ea4db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "e96364bf-1396-4316-9753-252b54f4fd82", "value": "12288:s5FImlfJw1U4z5HZGTwrjoBC/kIzOxk7fW2rDCfACWN+Ulql094jKS:mbBwrzm20Y/kIzOJ2nu2Lql094K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229002, "uuid": "773a74f2-4e02-41ee-b878-48b510798d59", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229002, "uuid": "4cc75ede-2469-44dc-ada9-75185d7c27bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229002, "uuid": "c0aa7dc3-c8be-430b-9201-d703660bc475", "value": "PDA Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35356a4-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241871, "uuid": "9733fd4f-a566-4fdc-967f-42288ba53428", "comment": "Malware payload", "value": "77fdfc5d053725e81f621812b251fe17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241871, "uuid": "bee8479a-9589-4f97-92ca-6f02e0ee3a07", "comment": "Malware payload", "value": "9a17ec32a78a19497512fec7f271e8e80b3c0da372970ed1938cc5121ff96f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241871, "uuid": "6fda17ae-f31e-473f-9ec4-b62bcff81a91", "comment": "Malware payload", "value": "1a749198799b1d6048872f799126d404d7892b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241871, "uuid": "ed64c8ec-2c82-4c2c-80ae-08a2a6417d87", "comment": "Malware payload", "value": "b440026927900f98135e5ac77289cbeb3eccd610f270e29660af3dc34a77caa01b9b1527a7a215c61f3139f20e88b10a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241871, "uuid": "8d1693e8-6e3d-4931-a8e7-271f35a5f75a", "value": "T121C26D83E993C972C25ECAB95D4D8534E8362A223BA2F1C36F6E581DCC141814BFC756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241871, "uuid": "e5f74288-bcb5-4cc7-a89e-03cde3515d5c", "value": "192:n2xfRq8HebguuREnZXbzNbotbFtZKN8lryIl36lLqsNmCBo:q3HqsREnZX3Qt02g2Yvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241871, "uuid": "2939d039-1563-47ae-9f39-c90cb58579ad", "value": 26612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241871, "uuid": "47cb293e-787d-451b-b41c-20884439e59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241871, "uuid": "45bab7dc-50bd-441e-9350-2eb1f5e48e54", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.2583.19029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b803e350-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1695195950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195950, "uuid": "c2ec2439-1448-4929-b925-58bf1fad7230", "comment": "Malware payload (DCRat)", "value": "5a09955b26de8ecdfd90121d3e208825", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195950, "uuid": "d2f8212b-8df8-4b3d-a81e-af2015f7e369", "comment": "Malware payload (DCRat)", "value": "9a813ede666b2e709555af5fd3da93ee77a30a1f615c2036e9161932482bf022", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195950, "uuid": "cdbf01be-b83e-4cca-8400-4a08a9fcb064", "comment": "Malware payload (DCRat)", "value": "f9ba5c15dca18cbbcac885c3d31b54b4416ff06f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195950, "uuid": "f9785bb2-c780-4c36-b4f1-b9d7e1600cd7", "comment": "Malware payload (DCRat)", "value": "e8aab438ea10831d5418ff14a027adb50b7c6ce4cd0bc77ad8fe02365b74abe1192c15cda55a020847a0e8607dd331ef", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195950, "uuid": "6abbf614-43a3-442e-8906-a950dbd34e15", "value": "T1BCA5124278E1C4B1E4B2123209E0DBBA1A7F79340BA59DEF17D01B6E8F217D1C67166B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195950, "uuid": "63ccf0b1-8e85-4caf-99de-96bc96633a54", "value": "f13181778fde385e01ef306b3e3c20ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195950, "uuid": "a99317d2-2dec-4f0a-b1d2-9b851013c024", "value": "24576:+af/AXatCkb39Dhd0FhOKx/sO/PPpcEbIYPxvYz3zkdpliAzT4t8NO5vH:PAXcCY3bdeOK1pHpcEUYWzodpFsiNWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195950, "uuid": "acbe371c-c61b-4622-b145-66166fb443f6", "value": 2114048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195950, "uuid": "eec38c7f-c5e7-419e-9840-38a33372935a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195950, "uuid": "fdfe0ece-6258-4a82-b5df-e4bda9bf25f5", "value": "5a09955b26de8ecdfd90121d3e208825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26f8ea2-5774-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1695186921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186921, "uuid": "517e58ea-0f43-4b59-b77d-3ebc641fc3f1", "comment": "Malware payload (AsyncRAT)", "value": "b63badeeb68bdbb85ba1c2881a3c70cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186921, "uuid": "1e8e6999-0a9b-4d5b-969e-58d81aba1892", "comment": "Malware payload (AsyncRAT)", "value": "9afc1999b03ff2458e479b9e18551464b01d358de1a22e8fa8435d92ce799eff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186921, "uuid": "c134c5d3-6ee1-4987-bbe2-2cb5ca0f92a7", "comment": "Malware payload (AsyncRAT)", "value": "f8a9cc6abaa72ff8c708b28a99e6037081794218", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186921, "uuid": "f1e1abbc-2d0b-47f8-92bc-17e45e156863", "comment": "Malware payload (AsyncRAT)", "value": "de08e6a776c3db52590204a4d106f0dad256f004a549c747341083723288108833f02dd967e38cb7a8a1ac893b0688ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186921, "uuid": "4168194f-2ed1-4474-8756-f25015bd21de", "value": "T1AC232B043BE9953EF2BE5FB949F361458679F2637603C74A0CC011CA5663BC29A41AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186921, "uuid": "87a5fab1-c674-4087-a43c-9ee6f3ba750b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186921, "uuid": "4e3ed6b2-040c-4982-b25f-67f771a2e706", "value": "768:78ZbMjDxh320FWTeSQB2CzUI8YAP9be3LctPInAwuyfYK086jbhgIrDJSosYVhKj:IZbMjDpV8qUI863L0QAwuyxWbOI3qYV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695186921, "uuid": "af705327-d9ce-481a-b2a7-0325b5c62413", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695186921, "uuid": "c6a6d09d-ad9d-4d48-a760-ffa91b65314e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186921, "uuid": "1b836e78-a14d-4b2b-b38a-de3bb7a3e70a", "value": "b63badeeb68bdbb85ba1c2881a3c70cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c4fb3d-57e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695233734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233734, "uuid": "9316dd70-3d0c-42b8-941e-4765954992ab", "comment": "Malware payload (IRATA)", "value": "87e86f2ce5624ee7e4f5d11a9b3b9cac", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233734, "uuid": "54c72478-1901-4454-822f-fac1af1f1c84", "comment": "Malware payload (IRATA)", "value": "9b55f8708c349c1360c4fe60b22993a62dc16654b569f74c467ade3b26567032", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233734, "uuid": "676b6054-5b86-46b9-822b-88cf53ae398c", "comment": "Malware payload (IRATA)", "value": "e808d0ea324e70340b1ed234587401b35e2609a2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233734, "uuid": "4a758610-eedd-4048-95c9-04627f9a996b", "comment": "Malware payload (IRATA)", "value": "9754d60cd0f1b5d16209805f590d91c4de3edbdbd6e00ff451d596cc977989723921b6cf40cb2c4ffc6f1c76ed743dc0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233734, "uuid": "a3895ea5-120c-4eb0-b540-b78aea948b4f", "value": "T1EAA5339AF266C141D9EBA337A5520BA1CD7B3D22DE13458F7CA9337D22B39E05F49600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233734, "uuid": "2de795e3-61e8-4ef5-8187-15880b7c538f", "value": "49152:AEahFJ/IunV2Hk3ZRBfIaqU/RK9XFhRSIt1bovH27Gxaz6OEb5CbsKWP9FF5Qd:AZhj/IunVuk3ZfqUc9XFjJPohxaW1lCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695233734, "uuid": "88cca5bc-6cdd-47be-ac06-b97c63012427", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695233734, "uuid": "7e3040d4-5143-440a-8012-70360789a8df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233734, "uuid": "c0f01ebe-a437-4aaf-a539-b8c00282acdf", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823bfe9c-57de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695232367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232367, "uuid": "8005237b-e9c2-47f8-814b-b59e2ee4cbc2", "comment": "Malware payload (Smoke Loader)", "value": "ac88b379af705201963bd292ac158f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232367, "uuid": "cb5d4539-2b3b-4a0d-ae53-3f43ddeed267", "comment": "Malware payload (Smoke Loader)", "value": "9ba1244d26d06f499561a367939bd73ffc2fb9597f584cf74b41fefe72aaf0ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232367, "uuid": "09efd195-3cb4-4be1-9a42-1b89506fc7b8", "comment": "Malware payload (Smoke Loader)", "value": "e9c896fc3cc19dab03323df8bc467a477353c3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695232367, "uuid": "9aaf2d8d-43a2-44e6-be57-329e5efdc416", "comment": "Malware payload (Smoke Loader)", "value": "79eed78dd1239f3ee417da4cb8cd601ee6ba2aa85506d9bb469095e8636ad9dde490bd94c8798744fc30efc4fd287b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232367, "uuid": "833c8db6-95dc-4f5c-8e6f-721c939e7859", "value": "T1AE552316EBEE1063EDF567B459F354170A73BEA04D3C825E2F469D0A0C33981A139B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232367, "uuid": "113107fe-e357-46c5-8f79-380e511c3679", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232367, "uuid": "ea324c5b-c396-47ac-9979-432fdcb9a872", "value": "24576:ey20saBgHDrGLqNBGk+YHa/4Ov4Fj1QgCG9iohnBIezZnDQZ:tUaWHDaLGqSEkhs0iohDzZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695232367, "uuid": "e1a8c1d6-94e6-4c50-b8fe-7e438602c71c", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695232367, "uuid": "e7afd4c5-aa6c-4e6a-99f7-b33e2fba0746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695232367, "uuid": "1c500027-5a97-4ccf-bd66-b01756fb31c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61843fb-5777-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695188216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188216, "uuid": "114b5bab-9150-4f4c-ba33-e3c2a3b67511", "comment": "Malware payload (RedLineStealer)", "value": "b20c721551b9bb0facacbb97634dffe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188216, "uuid": "d9dfa94c-225a-4f60-b89c-e4e06a055da4", "comment": "Malware payload (RedLineStealer)", "value": "9c635d041db44da88d307712e8083f5f6afc7fa46aab63ac77fc80a87dadffd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188216, "uuid": "969da304-bb75-43dd-8d63-6a5b0a3400fd", "comment": "Malware payload (RedLineStealer)", "value": "4327c898bf1ed8ff70a5a95fb793d68bc6f8c9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188216, "uuid": "fc88dca5-877b-4087-ab2e-ad0ffa09d397", "comment": "Malware payload (RedLineStealer)", "value": "aeb09b05ecf6a2790015f2bc1183c39f6f1c53014c8ab4895bfd1e819d25339d23dac4cd4a9ad8ddcdc428c133c7deaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188216, "uuid": "b4cd2e48-ba3a-43ed-a730-2535f162e183", "value": "T12B652365FBDC6033E4F42B709CFA8BC31632FC636D78862F6546E98908B10A4A5B5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188216, "uuid": "6521d873-6f49-475c-b60a-29970e26545b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188216, "uuid": "44ea17e2-42d8-4daf-be2b-706b2c356629", "value": "24576:Ay0mIBmjxGXdiuzGgkytNLrWXuTp+ellmj5uzXM1Y2i+M/QS0GnBNX:H0gsd1G/UNrWkpxlmj52XMS2oQ1GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695188216, "uuid": "2892fa10-ca19-4e91-b6b5-1a85aa529de9", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695188216, "uuid": "d519a461-fbaf-48b1-983e-56569a906c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188216, "uuid": "8527cf1e-6962-4373-8d4c-a96fe1ae7048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12a2d50-57ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695211508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211508, "uuid": "f4d1e673-8e89-4c44-8f3f-9cc162782d4c", "comment": "Malware payload (RedLineStealer)", "value": "da6c7e3043682f9f5f59b115d883a79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211508, "uuid": "33c1bc9e-04b7-4a71-9f06-243d176304bb", "comment": "Malware payload (RedLineStealer)", "value": "9ca727f2089fc4e80035f27f2acc1d9ae5cafe4158bb89f4a3c93dfefaa5e4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211508, "uuid": "0c0352ce-6ad9-4404-890c-5c039a6f6b4e", "comment": "Malware payload (RedLineStealer)", "value": "538784b39daec9ddd432aee3e5bd9f930df4041f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211508, "uuid": "10e85508-fd02-48c4-bcc1-0ada2d2be527", "comment": "Malware payload (RedLineStealer)", "value": "b82386d73d681e6f26be9148985a14bdd1203493bd85856c2bbf27c8bbb6ed7d2644dd61ee9e23d63af978e785ec24cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211508, "uuid": "651d48b0-2ee2-4294-846a-dd083636f952", "value": "T13F652302EBEC6931F87617B0A9F212E70B27BC525EB48317539AA4598C737D03672736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211508, "uuid": "1469c3db-c190-48c6-845a-aeb5fce1520d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211508, "uuid": "77c8ccf4-1d2f-4a9c-b290-b9401b9f8eab", "value": "24576:7y6efuVIpC2zNoKbRNNiTehmzzDHUIJKLlIMVDk6bx1A6/Rl5QTSCg7:u6uuVIoc+KQzX6P175lyTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695211508, "uuid": "9176b4ed-f9a1-470e-92b6-b6a1a1cd8f4d", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695211508, "uuid": "432d662d-f8af-479f-8106-c9f4b7daa75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211508, "uuid": "d313da98-efec-4b9b-98be-76ffc2ea49a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9463be0b-5784-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695193743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193743, "uuid": "b9665be9-4192-40ae-a606-2880637920d3", "comment": "Malware payload (RedLineStealer)", "value": "25d6140a5a993362fed2fe43e8627a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193743, "uuid": "7c4b53dd-b435-42f6-9b22-2d94291d4989", "comment": "Malware payload (RedLineStealer)", "value": "9d717f55876b260cb9dfd43b9c3326ede81d078440b08c06099f64de59b4afe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193743, "uuid": "6e0ed6f1-e476-456a-b77f-d39166aa6807", "comment": "Malware payload (RedLineStealer)", "value": "2887607c69bae8ef104292b36355551853b4d67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193743, "uuid": "bbf7b343-631e-4a3f-ae58-da068a1b7ba8", "comment": "Malware payload (RedLineStealer)", "value": "917d93d7d29e9e1dec03441a8b8ef4b6bbd1a79e5aa1d0bb917ade0ac777c29b8ef1dc976e4efdeabbf0a5f8900aa239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193743, "uuid": "80dfd3bd-9ed8-4cda-a7f9-37d973d104b9", "value": "T166359E2234CC8161EEE230FA469EBB7592BDD8B4071A15DF36DC1AEED7602C16F72581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193743, "uuid": "b21d9e8a-fe84-4221-b27f-67594edbb6ef", "value": "f6040bff5e7406bf13febce5512b9888", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193743, "uuid": "2f341f29-a3c4-4742-b3a2-117e069338b2", "value": "12288:RwsWlN2dA1o49i4ytPZR5QZVfn5TjzorNHK4kIubL0igNxcoYBRcrdLCAM:GsW32dA1h9i4ytQVl3hZZBRdAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193743, "uuid": "377e17df-5ac7-4878-b98a-54ba1f6eb8d2", "value": 1116928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193743, "uuid": "cec0867c-d7f4-4cad-94b5-62fe4cc8d6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193743, "uuid": "a5fe9b67-d41a-4617-ac23-a27f73fd8f0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd366d8-579f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695205405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205405, "uuid": "ed128ced-9de1-4230-a233-c55ae654cb13", "comment": "Malware payload", "value": "5d63b7168f5a6763724716ffa55d77fd", "object_relation": "md5", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205405, "uuid": "acfe5b50-6073-4a07-929d-13d7dc2f6f67", "comment": "Malware payload", "value": "9d7b170d3c6d63b5f1a534b0f9d665fd8d086123ec8ffd66d8f27761ac139928", "object_relation": "sha256", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205405, "uuid": "efc4eff4-f1d4-4842-a271-87893e10f25f", "comment": "Malware payload", "value": "d60315e2806d1986350820ec66b368bf2e0184b2", "object_relation": "sha1", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205405, "uuid": "e6ebb008-b7d8-420a-b3ca-657a88eafd43", "comment": "Malware payload", "value": "e4b96f4084c39a712f7c8bc59208e75a17815cae09254773d31eae0105a780cd96a2ae245bfdbceec8557f8243072c14", "object_relation": "sha3-384", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205405, "uuid": "1e324421-7257-4479-91ba-7bc4a7f7389a", "value": "T133B0222A822A08B0C03338A0282888200E0B00C2B003EC20F2880F0828B2888AE822A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205405, "uuid": "3d20365d-2af8-4256-8081-7e68d4b246c7", "value": "3:HRAbABGQFf+ty8WddSJYHwmRDxn:HRYFq+LW6g1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205405, "uuid": "fbbf20f8-aa91-4d9d-9014-e97321a40d0a", "value": 123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205405, "uuid": "88f47f6d-c605-4380-bf2b-e648f4a5edc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205405, "uuid": "852d02a2-ea41-455b-ab79-cad21fe0283d", "value": "a.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19b80e7-57e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695233708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233708, "uuid": "ddf25b57-eef8-40ab-b48c-584290f64365", "comment": "Malware payload (RedLineStealer)", "value": "d9eead113eff38f17241398dba03f9f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233708, "uuid": "1d18e3fb-750f-4161-840c-2247703c4073", "comment": "Malware payload (RedLineStealer)", "value": "9d8124b131a76d0299f638ed3d9a6967e84bfbfd9d4f5ce73661bfe6b84ec705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233708, "uuid": "a6f7d5c8-dc87-41e2-9df0-f028cc9c01ee", "comment": "Malware payload (RedLineStealer)", "value": "823292b7472c153a2ac1820c52c1be3af1f5bda7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233708, "uuid": "f37d8c88-7f4d-4a28-a92e-dbe0887edf73", "comment": "Malware payload (RedLineStealer)", "value": "d5ae058336d4d48cda21ba8853064ba8151037250cdd96a3854b1aa67542b735b0c49c2e7a60beb187108ed75246285e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233708, "uuid": "a3554c81-b419-41d5-bfeb-a596f7e3a20d", "value": "T14F552392B3E891B6CCB513B15DF617E3097A7DE1D834DB3B3781C94889B6A80A431379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233708, "uuid": "1ab3ab6b-c3aa-4b17-bc18-2a32d97c98ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233708, "uuid": "49fb0138-9d80-472a-8733-437262796e05", "value": "24576:2yJX32yg35rzliTdranX4kcPbLyAK/FTa+JNLWg7GKxVg0aAEKtTT:FJXL+5rzgTdOnCbSc6Z7GKfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695233708, "uuid": "66645d8c-ec75-451a-8a53-811264916c7f", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695233708, "uuid": "3358305a-6f10-4309-ab23-6c98edd5a79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233708, "uuid": "d6c34b56-8746-44d0-80dd-ea21926ac86e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a8869c-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221546, "uuid": "5ab930b0-1bd0-453d-a46c-abb6d6cc237a", "comment": "Malware payload (AgentTesla)", "value": "eb10aaf48df85c865f478c31c200d5c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221546, "uuid": "dfc491ee-ab4d-4c0d-873d-c1cdce8ea55b", "comment": "Malware payload (AgentTesla)", "value": "9de62e10117526b21be8cded286a1522be0237d4b6e24d51d5bef8cd66cf7eb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221546, "uuid": "01831b25-499b-4a23-a20e-29024fb49f2f", "comment": "Malware payload (AgentTesla)", "value": "fa0e4b7ec09bae30a4417312bac325bcb221ecbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221546, "uuid": "9d91a677-c7db-4a79-b915-373f59301bf1", "comment": "Malware payload (AgentTesla)", "value": "33e30c9a2b638e38e28bab7b6e2fc8132ff517d4d33e98873f0a82549761f3c01683854fec9e2ebaad7125216b295760", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221546, "uuid": "a6911447-b0bc-4988-be19-ab42bb128c61", "value": "T13CC412143B609F5BE46C0BBC4475155023B1E913F8A2DBE459C670FA0AABFA9C702B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221546, "uuid": "c0eb200e-18ec-4cd1-be4d-5573e1a9840c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221546, "uuid": "30890e89-219f-493b-ad6c-2e9fdff206f7", "value": "12288:glFGoKLCa3K93PYC1ZkxL4Ntmz0JTOKP6SRml:aFGrCac3P1Od4NoQqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221546, "uuid": "162ab76c-edeb-4043-9bcf-fe446b7cb0b8", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221546, "uuid": "9f149713-f2a8-4c77-b2e6-6d7d02c76319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221546, "uuid": "0c57912e-6d00-4b76-885d-629a89ebd9fe", "value": "PO#7A68D23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f29227-57ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695210675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210675, "uuid": "180c9aa7-0cf6-4abf-b7be-728c401626c9", "comment": "Malware payload (Smoke Loader)", "value": "59c947071beafcc89d473b6a78cf3c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210675, "uuid": "a54b6b73-11af-491c-a992-5abc8502e2ba", "comment": "Malware payload (Smoke Loader)", "value": "9eabfeb817fb350056d1647712b7ab45a06de6182c321729dce2529870989242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210675, "uuid": "014d29cf-4103-47e6-8416-93dd888970fe", "comment": "Malware payload (Smoke Loader)", "value": "05fb4ea7c6a98a12c1cc9884708960e388f037fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210675, "uuid": "e10a03ea-61cf-4952-9cea-bca18f74107b", "comment": "Malware payload (Smoke Loader)", "value": "ceacde0575c423bc00b4ac7885673dc35755fe15b5ab8378f2fe617028ce9f43989b4c5fd3e37d9401820c1cbdcc85d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210675, "uuid": "d5d69d86-9573-4ca5-b6f6-602c56a4b875", "value": "T1AD6523533AC84032D8A61BF066BE23830E7A786219B8D3BB3745D95D19F26D4B43537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210675, "uuid": "1e415df1-cc59-4746-bbe2-bce425831391", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210675, "uuid": "c4f9c238-0479-45fa-920d-28632d1073d3", "value": "24576:JyCmcQptZtaOStC92bQi9KAEiXTj72W6ofdZCQN78gnVvmy6nISrm:8CmcQzZtajC9i1X/WsECVvmwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695210675, "uuid": "1202cc76-7a6e-4af8-befe-98926c8dc269", "value": 1435136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695210675, "uuid": "0dbea731-c438-4c06-9395-bd2ed7b76db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210675, "uuid": "60454420-52b7-40fd-b9d4-ff479f80a013", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c67fdf-57da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695230625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230625, "uuid": "635a417a-4414-42c4-86f4-a39db5fe5982", "comment": "Malware payload (RedLineStealer)", "value": "748b2d86b4a88da177bd92331e79986e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230625, "uuid": "0c7d1a87-7dd4-4b9b-912d-fdd329fbf2f6", "comment": "Malware payload (RedLineStealer)", "value": "9ed376f6a207601c6cd314a0475feca5ba4b0ff3077b048a8eeaac0aab30d4ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230625, "uuid": "9503ac44-d54b-4248-b2c4-c5a50ac0ae0f", "comment": "Malware payload (RedLineStealer)", "value": "3971c0981eacb1c7d6efec7617eeb7097f6d3d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695230625, "uuid": "0d979206-0bc8-44f7-b2dd-089b3edb23b5", "comment": "Malware payload (RedLineStealer)", "value": "66cef5b08351dc7e1090cd2af2f11d304949c1168a803b06d878ce47445ef11167ee9f885d67d9ad0ff0075fad6a98cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230625, "uuid": "448af2dc-ef0a-4160-99cd-8aa2347087d0", "value": "T1046523065BE84473E8E80FF069FB56D709337C658C38835B2551A06A2CB37C9A6717AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230625, "uuid": "c65f91d4-6e02-4ea6-bd67-bb49bf657018", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230625, "uuid": "6c4afcf4-2c19-47d9-980b-19ed734861f0", "value": "24576:UyMrGd44yJPRGgqOy0v2uO3RLBYVVqyp0b9z7dZS+0ESDdnOdCXVKWiwT8HHnrnA:jMrGQRGghU3Avqq0Z3/iESpnOdGrYnrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695230625, "uuid": "54b70e59-d9c2-4a77-82e7-6e9f08e2d580", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695230625, "uuid": "b58258c7-48d8-4603-914c-d46a40d15ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695230625, "uuid": "83ae18c0-d4af-43d5-92a3-d16860819add", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9efeb4-57b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695215099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215099, "uuid": "357eef45-add6-42dd-900b-cf5bca2cabe1", "comment": "Malware payload (AgentTesla)", "value": "f7fd43ab196a8bb654572a3be8e61e84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215099, "uuid": "d5a5a6ca-d02f-4b47-8c34-44979c8c02ed", "comment": "Malware payload (AgentTesla)", "value": "9edbfdb6303fe8b151d8bcd290efc3bb6f56b3d09c413a22c6d08c742a7818ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215099, "uuid": "3851ef00-dbbc-4c71-b24f-5b23a3e7c599", "comment": "Malware payload (AgentTesla)", "value": "a700fc5000b0464d7abba21f9f185b695f4f43eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215099, "uuid": "32d0ae28-560a-480b-aaac-d7cffb9e0472", "comment": "Malware payload (AgentTesla)", "value": "63a0332c47c8ebaa87747b08bc5e733c82e3da5e8c182ace01d5e51b96873652d225a0fc97c39be653496f0632281bcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215099, "uuid": "cd89774e-2e97-484e-b42e-7d815bea8799", "value": "T17BD412143A948F57E06E07BD457021112372AE26BEA7EBE01DC5B0E14F6BBB1860678F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215099, "uuid": "3e203631-8d30-45e5-b8cf-9535f33bd7a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215099, "uuid": "d0108b82-7f7d-4f92-b2be-f7e66b170022", "value": "12288:xJKarqr0t8zMAR3eVjatrI0LBebLAdmM+ACmgPXs6cf48QW1jw6Ji/0hK:xESqr0ty1ht00teAonnPti487OP8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215099, "uuid": "acff6a6e-5a31-4987-8cd2-710973c1ab86", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215099, "uuid": "3184a18c-f422-4b6c-a59b-38b27b0cd249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215099, "uuid": "d0f221b3-1edb-4739-b2c0-d8362bcbd358", "value": "ENQUIRY NEED QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f437f30-576b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695183024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183024, "uuid": "234a942c-98d9-4090-bf13-239dcf6b4954", "comment": "Malware payload (RedLineStealer)", "value": "32acf80455e5d25d029fb1e090f29645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183024, "uuid": "ba34fa1e-f8f6-41d3-b95f-bc2f9c4cb904", "comment": "Malware payload (RedLineStealer)", "value": "9feba6d81b9726666ce35ac03074abd57a2d9f900072d5b71f60a4e04fa609bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183024, "uuid": "62802b6b-48d6-40a0-afdc-efeb5654e234", "comment": "Malware payload (RedLineStealer)", "value": "90695c1ca3308fa59e2c8de26e06ed44db376661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695183024, "uuid": "5376e482-8253-4455-9d02-2b308691943a", "comment": "Malware payload (RedLineStealer)", "value": "a8b7fb1a487131c328ba42ad443be6139f0a9e4188b37d733380298ac7203dfbd820c523f03a73ff2e1ef354845aabae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183024, "uuid": "3560e07e-b8e5-4c2a-93f9-915ec4327938", "value": "T1B9556C0FB2E8FF4BC3AA1935C03A5861C773E6091A73E74F1A3B41667C526A49B479C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183024, "uuid": "502e6a64-f673-41a6-95e2-f748c860accb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183024, "uuid": "13f5cdd3-ddf5-4b32-aac1-766d86ad157d", "value": "24576:Zg2EcbsWzMms/0PvkG5JJbfEvzRPtf0EAxffwXsQjmhe3BDq:MWne0Pv/5HEvdtfDAVWjaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695183024, "uuid": "967024dd-c1fd-4ce7-ab4d-10da7f166e2c", "value": 1403904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695183024, "uuid": "5a6b0a7d-5af6-410d-887f-1077d7789805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695183024, "uuid": "ebb71c17-10af-4c84-b81c-9020372b17ac", "value": "32acf80455e5d25d029fb1e090f29645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3365d0-57b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695216068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216068, "uuid": "380b2a09-7762-4546-8a43-e5d5dbf30588", "comment": "Malware payload (GuLoader)", "value": "c43de45637dac8da880ef4f20909b194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216068, "uuid": "912045f0-968a-4292-8cb7-ac0f0eafcae1", "comment": "Malware payload (GuLoader)", "value": "a0b0db8c6dc77550bb990118e37e3dda30255f3abd39c04089bb120887d225ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216068, "uuid": "5b609ef6-0004-456d-ab72-f473b80a7ba4", "comment": "Malware payload (GuLoader)", "value": "08a9ea5bf342242d323be7a1a14eb04d66e626dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216068, "uuid": "2ac1e153-ad24-46ab-b43b-f89b9722bad7", "comment": "Malware payload (GuLoader)", "value": "361355a53121920c2bdcd099f25f13f2bdc730f84ac5e26c33cbbb0a60cc3b1487116bd99889a4f4cb70cec7ee461f37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216068, "uuid": "b5210915-c20b-4ebe-b073-bdecd5d99071", "value": "T16F453302429D9B32F39761B24D963D1FCE91CF1420B537822F22BE91D876AF5E91A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216068, "uuid": "6c1bc77e-8c51-40e0-aca1-805cd311851c", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216068, "uuid": "4db6e089-24e9-468f-9c65-2c6830af55a9", "value": "24576:klY4e8txwpsmTBmRr++qiOKpTnDeSsp1jQW3GwiAtsp1kt4KdAZJO3FqdPH5oUPL:xcwGAARrtsKpTYpyW3GwY6tMqOzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216068, "uuid": "51c29132-94ff-41bd-bdf7-3d55266bea56", "value": 1229552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216068, "uuid": "07d2e742-5c74-4262-96cc-296360484d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216068, "uuid": "62b06aef-536a-4780-aadd-6967b68cb499", "value": "Gaelde2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d772535b-57b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1695214471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214471, "uuid": "a2900914-1a1e-4b96-8ca7-96d72e78366f", "comment": "Malware payload (DCRat)", "value": "749faadae2cfc8e9ac47e15f6d099558", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214471, "uuid": "979ce818-3f26-4552-b4c6-b33cfed2088c", "comment": "Malware payload (DCRat)", "value": "a0c9b79869f0fa64f1d735b16abae30d131fc2617f0ff7965cd32e77cafeef81", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214471, "uuid": "2c690303-c82d-4866-9ccc-0b3cceee365a", "comment": "Malware payload (DCRat)", "value": "7edc29bef58bee1c87b4f3f591dc077ae55517ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214471, "uuid": "58cd67bd-f58a-4a69-9056-387afeedd608", "comment": "Malware payload (DCRat)", "value": "825c2f6a3f5854945dfc4f3afa45a92c47a5f5ac968134f0b27fd92b0f058cff9a00af1d96f74cc564b4ecfa4dcea990", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214471, "uuid": "d75604bc-722c-430a-b357-1dc0ff835433", "value": "T1DA657B027E40CA99F0185673C1EF420847B5ED512AA6E72BBDBB737D55113923C2EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214471, "uuid": "f8d87a18-f285-414d-a107-1bb599469f00", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214471, "uuid": "6e52ca7d-fb61-43ea-b843-d6744d474ae5", "value": "24576:u2G/nvxW3WieCzebX3deV6oZHOFfWc4W2B7D:ubA3jUOnwoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695214471, "uuid": "1f477be2-f7dd-4ab5-95d7-7ef8067523df", "value": 1488521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695214471, "uuid": "73e17915-93e4-429a-bf64-6ca08a6a8dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214471, "uuid": "d1f3fcbf-b67a-4a1d-8d7b-18c2ca74792d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2534ba1-57fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695246218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246218, "uuid": "fa47b50f-bccf-4c20-97c3-c864b5281a59", "comment": "Malware payload (Smoke Loader)", "value": "829a0997d9f85f18f95428d9f5aa7d49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246218, "uuid": "56cfd8a8-17f5-496b-80b0-be50176ba87e", "comment": "Malware payload (Smoke Loader)", "value": "a104162675efa1ef6558d3f8edf218b8c2be3832e38fba88b4e0b73679e54b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246218, "uuid": "8af78a6a-1760-4db5-8ed9-c6a9f8333250", "comment": "Malware payload (Smoke Loader)", "value": "6ab9efaad3949097b0449af87908b47ebc03d4f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246218, "uuid": "f6a46f23-949d-44a6-9a86-3ec97e36c872", "comment": "Malware payload (Smoke Loader)", "value": "0900be631327acf1494770a5ae85c70316c72ad5a900aab7dfde0b2b4886816247258d22fad7a16e2c18a49323ac0e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246218, "uuid": "49874e06-d98d-432e-a494-15d6b3e8dc2b", "value": "T19255236377D89262DAB113700DB2525B0E39FC962DB6833F7A5939091CB37C1A93036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246218, "uuid": "b76f017b-fc6e-454d-b529-9509931f323c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246218, "uuid": "aba1cc54-fa06-4480-b8e2-7744d78ba1bc", "value": "24576:dy5Gcgp7hV2lgilAPS8eY/JLsPUcGfNcZZWMoyTYIWDHMNyV/kinKjmlV4SF:45G17hV2zkJLdxNSPTYRDsNojn7lV4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695246218, "uuid": "d79956b1-d53e-46ba-bd36-f47778242e24", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695246218, "uuid": "340f1b91-75e5-47ef-8652-9855c29f13e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246218, "uuid": "942d9470-89da-4032-9952-7d2927d01db4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faab10db-57b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695214101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214101, "uuid": "0de20424-0385-4466-8f25-41fb99fd7dc4", "comment": "Malware payload (Stealc)", "value": "70530be5c9fa9ce3ab74176e6d36349a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214101, "uuid": "743d7ddf-c0b5-49bf-a1d3-65e3da6ebe90", "comment": "Malware payload (Stealc)", "value": "a20c54c6dcdf4873685aa12c7810150e190288a99cd363fac321bc49445ff168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214101, "uuid": "655fa53b-96bc-4704-9286-b33d20ffe3ce", "comment": "Malware payload (Stealc)", "value": "8634dca834e0fbbbe40898ac1279d82e89eecce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214101, "uuid": "8861bf66-4d27-40d3-b15d-b7a8ed40fcf7", "comment": "Malware payload (Stealc)", "value": "c38ee8e19bddac6eb7cd36512744377395d14ee0a6babc459e620b2e6fd53178b6beeb1645651f7cc076a858afc9b8e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214101, "uuid": "368c7228-badd-4d07-801b-322749340f6e", "value": "T1AC34CF323591C072D5A746384825C7B46A7FBC726E658A8B3B942F6E6E313E3DE11307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214101, "uuid": "bbad5be4-c74d-4eb4-a6a9-bafa3a69708f", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214101, "uuid": "2f61c345-1808-4e24-9d6d-8fa7a02a4224", "value": "3072:Hfuh0Bo/oz/n81f2QlqWgfn4uH42n7OUhnXXgE3o9em5vM6Tzj:2qNz/8F2Qlpen4uH4kRxAE7sM6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695214101, "uuid": "f8f79398-97cf-487c-8d38-d8ffa9e971e1", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695214101, "uuid": "8fd40403-4118-432e-9abf-097a13b4cf2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214101, "uuid": "c720d5a3-1ca7-4653-a00c-f32665a08d04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7016ffcd-57b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695214727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214727, "uuid": "26e44860-d0ae-4839-a6c2-8b58f6bbc741", "comment": "Malware payload (RedLineStealer)", "value": "18eda642c0fe68ab57c4899d528af5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214727, "uuid": "874c076b-7a4e-43d3-8659-968ff7394c4f", "comment": "Malware payload (RedLineStealer)", "value": "a2af9ebda6b57e38dceff2cfe34aaecd19f0c4bb5e1b3f91524324d0fd52de80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214727, "uuid": "e5aefbe5-ddfd-46d4-9be6-0df2de7a8dd6", "comment": "Malware payload (RedLineStealer)", "value": "496b288668f7a4e57183ea9c67b0371ba5461d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214727, "uuid": "8a4b6df0-2595-4273-bae4-aba18c9beee0", "comment": "Malware payload (RedLineStealer)", "value": "6d3802fbb9a4e4b455025d887573738dc6056c3651152c68219e4c57dc977f83e0a587c06f1bcc48dbdfcf3641fbec33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214727, "uuid": "063c5f3b-deb4-4fef-9be7-0d1ab1d70fa2", "value": "T13E84F113B5E1C532E26B42748D25CBB06B7BBC3658758B873BA51B9F6E31382DE15302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214727, "uuid": "1d43a99b-8377-4a3b-b0f3-f6e0a7d342a6", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214727, "uuid": "77347758-3b7c-4b0d-b369-f82fd2d70817", "value": "6144:8DoJjYAa3AKbylyCzc61YCyE2vtqb6dXYuP/JjcCTa:2usAaFyoCAdGetqSYOSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695214727, "uuid": "66dc2444-e6d4-4027-a715-edcecd8c4657", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695214727, "uuid": "0eb33dc6-85c9-411a-b482-c251b7b3a793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214727, "uuid": "204d2b01-97dc-4345-ab9f-36de0b7906de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0528447a-57f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695241177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241177, "uuid": "714e4df7-629b-4b12-8993-beb54c116be3", "comment": "Malware payload (RedLineStealer)", "value": "c24852690ea6fd5e406e7ef4b4697a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241177, "uuid": "e6fd6702-29a7-41f7-9e5e-b2a0e0724d1f", "comment": "Malware payload (RedLineStealer)", "value": "a2fe83f6a5d9c4fe2fffbde916c2ca1a855b9d79f7d5907e977f23fa38540894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241177, "uuid": "40f6cd6e-90b6-48b7-96c2-5f6c3f2ea685", "comment": "Malware payload (RedLineStealer)", "value": "38c7807ec04ec89f5c3215fa2042fbee859c7ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241177, "uuid": "433637dc-e8a7-4b09-978b-1caaa49375b3", "comment": "Malware payload (RedLineStealer)", "value": "2d93b8636cb6d4fce10cfd4534aee77228e5fbbbfa33daf05054ab357839b44f7bb2a3762c2882a9fa2001b725f0fd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241177, "uuid": "e2939c24-8f17-4bc0-a72b-392ba2dcb1ed", "value": "T113552347ABEC8023D579177018F356833B3DBD69892817AF7A696D2D48710E0A1763F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241177, "uuid": "a4de287b-d96e-4c17-a977-15fa3ae25da9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241177, "uuid": "4fa7b1eb-58a3-4620-bbdb-5dede6755fee", "value": "24576:wyjC8R241an1fSIeohxRqT/M29pQR27o6bzkYEvILS1ARhNivNy:3jpoG41f3eKxwQivo6MBguQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241177, "uuid": "a9d05aae-f264-43a6-9ba7-02b26346d770", "value": 1397760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241177, "uuid": "1d22a0e3-65b9-4d6f-a93a-a1f019a0e006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241177, "uuid": "4779a79e-aaa9-4dc9-93b2-d14c3b19e0b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5da71d-57f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695243764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243764, "uuid": "4d4f44c6-8e3b-483c-ae16-08e40134b7cf", "comment": "Malware payload", "value": "0fe9ef9ffbce48b357af9b2cc1edd934", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243764, "uuid": "438a9d4b-14b7-489f-8cb6-0d90072e96b7", "comment": "Malware payload", "value": "a4b485eda4f26a832800790fef33813ecab2de8e8200d0c334ff64b843fcb03c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243764, "uuid": "ca9f5dad-cec5-4c53-9fb8-e4555d4c7c24", "comment": "Malware payload", "value": "3af6fc06ed7e346fed41f00ce35adc70bfef2fed", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243764, "uuid": "9984b412-033a-4d99-b691-85fbd197a2b1", "comment": "Malware payload", "value": "dc5417c726bd742be2c6ed0897a907d6d4756ce4985ea0563653b2b8c6a389fe0ca2e51fa0dd38d7e8da34fa0ea41d3c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243764, "uuid": "bdd4120d-df3e-40a3-907e-608f18bee379", "value": "T132F50192F3CAA92FEDF3C33647B5063A015A8C198B43E7475924727C1DBBAD44A85BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243764, "uuid": "c0751b9a-3fe5-4a9d-8369-d171acf6441d", "value": "49152:f/Hghijymzgl+o+kUiKoxONDKJ9lpiNvGPVpD0iqs8hOrIWavSVxAfH+lEydhZYn:3Hg+z+5ZBxgclpTPosoOIWavSevyd7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243764, "uuid": "b7815483-6194-4032-89c0-7f71883b6dc0", "value": 3611349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243764, "uuid": "c74a875c-3c62-4577-aece-e9539bf5fb2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243764, "uuid": "c7da06cb-debd-469b-baa5-4a14333f6c63", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0e54a3-5799-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695202933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202933, "uuid": "286893bf-ad34-40bf-a319-025c0e97691d", "comment": "Malware payload (Smoke Loader)", "value": "d8d48faf7adb599fe1e17451b164e9db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202933, "uuid": "710f32b3-b823-4577-8123-74eecd41a554", "comment": "Malware payload (Smoke Loader)", "value": "a4e6221aa7745feb21d710cb4919530751ce3ad657d49d8b5c26cf76269fba72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202933, "uuid": "07b29416-8c57-480f-b953-d3eb855778d1", "comment": "Malware payload (Smoke Loader)", "value": "af838a24a20b71181977cb1920f4764676573846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695202933, "uuid": "d7b385c7-d6c9-4ec2-b7ff-0524fd2cf1c7", "comment": "Malware payload (Smoke Loader)", "value": "bdee8dda0cd37cc2fd19c3d5181efc4e7363e83eb079ea439962c869f0412401da98641873f698a1045c77c414b59ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202933, "uuid": "f30e95da-3f07-41c7-a8d2-b833bdd47604", "value": "T1AD34CF123595C473E2A745344820CBB46A7FBC7269358A8F3B842BBE5E313E39E25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202933, "uuid": "b8a80eb5-75f4-4b39-99bf-81b9d9030cc5", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202933, "uuid": "a09cd1f2-bab0-4bcc-b504-73369596e577", "value": "6144:p7qgq/a6G/A3F9qFuGNSxhOCZv+N/HhT:Btga6AgKFmxlZYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695202933, "uuid": "da434948-d830-435d-a092-628fb0a80b1e", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695202933, "uuid": "f490cf07-e46f-4538-a6ca-311f82dd7685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695202933, "uuid": "8d63fde6-d595-4c2a-af44-2b44a719dc29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26061d95-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229206, "uuid": "44b1e629-689b-40fe-bdea-3b2e4ef8e665", "comment": "Malware payload (AgentTesla)", "value": "7040be6b861fd995849a474396a5e527", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229206, "uuid": "3844db88-0666-4a20-a524-e543009c24e2", "comment": "Malware payload (AgentTesla)", "value": "a6107780fb8d46927db6aa241d771899017301c708a2e06ad0f60d9fee78a08f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229206, "uuid": "6c5b3747-d31e-41a4-aab8-5ed61a22e8e5", "comment": "Malware payload (AgentTesla)", "value": "b572f46abe7dc0fdfc5974bf1b0c97f6402a3caa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229206, "uuid": "66379d3b-0c42-4255-8fe2-100ad682cc59", "comment": "Malware payload (AgentTesla)", "value": "375f3cc84d0d156d66671deef18579132abcae858378fcf62130f7d1f10f7a9abbb7617bea42d91ae1e6ae8735f3fc20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229206, "uuid": "4fc1be71-dd5f-459f-a884-83e828af0e3d", "value": "T10CE423F5B3654617E856A77713A18742F8AEEA40027905E7B43F859C8BCE77188BCE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229206, "uuid": "714a0874-9ed9-4ad3-8914-b4aa1b3b819b", "value": "12288:tyAc9moFYwlCjqlqjyrqLYZ3Y8BBNK8t15mxZKjUugtJm+Rw3q2:Nc9moFY8zArYNDLt59AbJlRCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229206, "uuid": "6dbde88d-06a0-4d53-a428-f3b4f27a4bfb", "value": 658011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229206, "uuid": "dda6180d-f61c-46c4-90e1-08151c23e7f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229206, "uuid": "3be861fb-86d7-428e-8315-76fa4e1479a2", "value": "NUEVO PEDIDO - CF0002.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8316d3d7-57d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695228073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228073, "uuid": "f2f84a44-b09a-4776-b601-7bf4c6632692", "comment": "Malware payload", "value": "def042b8e363f5f3e93ae46fc00f262f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228073, "uuid": "c0b87aef-2eff-483b-bd9c-80761072d58f", "comment": "Malware payload", "value": "a6744bbcbd1359a266fc98e748a53c0a0258c0b9a299d77bcbd19ea7da4e9d11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228073, "uuid": "733a6294-f4b3-431f-9e7e-77f495879a8e", "comment": "Malware payload", "value": "f3c195014f028b7f1fc18518d493b97b03268fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228073, "uuid": "0f91ff3d-b248-4951-be3b-81a7bc95956c", "comment": "Malware payload", "value": "50ff623dc25268b5828dbeb2c2fbc9842ee1d966b751198b39792586a989add19269c550225a988ab7c89b29a44447a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228073, "uuid": "a09ba270-9ba5-4da8-a4ea-68c12cfb78b5", "value": "T15F752211BAC08871E8721D3506E29672BB7D7C702A668FDFA3941F2E9F301C19A34B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228073, "uuid": "4effefca-091c-4af9-a925-4ca045c31fbe", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228073, "uuid": "bfb4d8c7-4083-45af-8fd9-64959812e195", "value": "49152:acbz6NStPTRlXI1bNPo3zqHvtCvYPEXBBra6:acbeStbY1bloDqPtcYPEi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228073, "uuid": "a94602c5-2af5-4dd0-a1c8-0b5705a2a983", "value": 1687678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228073, "uuid": "cac20dd6-337a-482e-b34f-7720b544efe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228073, "uuid": "58855313-67ca-486e-9bc4-833707f7dd41", "value": "def042b8e363f5f3e93ae46fc00f262f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015344f4-579c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695203804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203804, "uuid": "7cf4ba56-5ce7-403f-aa3d-69c125c20fa5", "comment": "Malware payload (RedLineStealer)", "value": "6864b0e82b32046fb60220ec37efe795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203804, "uuid": "36ab26e3-177d-41fc-8591-7b0e4504350c", "comment": "Malware payload (RedLineStealer)", "value": "a7115481c1a407b98c614f6c4583c62b8708ebfc5b0341011a402f07a9fc39fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203804, "uuid": "8114a739-46b8-48d7-adb2-56c79cbf7f16", "comment": "Malware payload (RedLineStealer)", "value": "a7fd11e2e4a19a7bcffdcaf04fb35b48749d8b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695203804, "uuid": "1ec45eee-df62-4293-a47d-83b52679cff6", "comment": "Malware payload (RedLineStealer)", "value": "9df28390d8441630c9f302f2c8b7604852192a18483eebafe3e35b20be4ba66fa7d05b61477153839104e9189376edd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203804, "uuid": "2c3c4e17-86af-48cd-a8c4-b0b2c1ee4530", "value": "T14C653353B3984472EC7A6B304CF50BA32B77FDA15E255A7F174299CA2CA3680643173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203804, "uuid": "86dcb196-1177-4043-bd9a-f76afef57530", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203804, "uuid": "4969c8fa-f72b-4fd6-8509-291c4685db96", "value": "24576:hyTpCEXy0SfnhaDDTmEXfPXeKBy+3rn5zlJZ+RKpdNC8P:UojnhUTm6By+790Ods8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695203804, "uuid": "358bc3c5-236c-44d9-9f99-87ff054bcf0a", "value": 1468416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695203804, "uuid": "0b7787cd-5ed5-4abe-ad5a-2cd909d19bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695203804, "uuid": "09383a6a-6312-4027-aaa2-01b7a1f0d1e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4c1428-579f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695205352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205352, "uuid": "3c153ed6-5d5e-4974-8787-49f6a5c15ea2", "comment": "Malware payload", "value": "1773e8646fe52635df786f5f5d6671ab", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msbuild-inline-task", "colour": "#09E6FC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205352, "uuid": "33f7e604-7cf4-4135-ba1d-6d6df0027670", "comment": "Malware payload", "value": "a73df1af0503afa2cb4a2b02c544244ece148c16fba7eab6714ce2923c6b3b9f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msbuild-inline-task", "colour": "#09E6FC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205352, "uuid": "d2dd6805-ae49-4c12-95bd-c0c4139551eb", "comment": "Malware payload", "value": "0e7cd9f075254673936b81e265f1b817100e61bf", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msbuild-inline-task", "colour": "#09E6FC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205352, "uuid": "47cd200f-5cd8-48d9-ae35-502a1d409bed", "comment": "Malware payload", "value": "dea634798b17322d2f416e936e3c88905f37351361c7db3bea866664f687066d4aa67d9e5c1226138c662ba959f123db", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msbuild-inline-task", "colour": "#09E6FC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205352, "uuid": "97625140-8a98-4127-b94f-e3cca5fd2148", "value": "T184A19405855FD9E4662331E01251EC869A22E677162DEC50B9DDEA80CF07EB820F77DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205352, "uuid": "e450441e-b580-4b3d-928e-17e5fe4a8065", "value": "96:9/9Lez4ezr09Cw2OfVP8qSCKOF2tWK2t2t2tyMkwwZRb5aWDCCMjO9zMcCp:qmpXvF6d6K6yLCCMjOh5Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205352, "uuid": "c2d0a3b3-9d79-4426-9ade-ba3bef80eb08", "value": 5013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205352, "uuid": "a32d9ff7-63e8-443e-ab7c-fcee1b762a05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205352, "uuid": "ad60fff3-41e2-4bfb-bd4e-d4b531d26a86", "value": "jscript(1).999999999231232131231proj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0840bb71-5779-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695188783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188783, "uuid": "ce78540e-a3ce-4315-96a1-f0d998309d69", "comment": "Malware payload (Smoke Loader)", "value": "9abf90bde094785cffbe3f34094b59e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188783, "uuid": "4ed3e9b3-4c25-4228-a41f-64fa50d27b18", "comment": "Malware payload (Smoke Loader)", "value": "a76ac34a9fc8146224d737ebb15bdbf2e35acd67e274ad328fcab5b99f8a99c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188783, "uuid": "b28adaaa-3faf-44f5-baba-a72568805558", "comment": "Malware payload (Smoke Loader)", "value": "18e57ddb3d32d20f526cee6dd2c4731fea2f326b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188783, "uuid": "d1eb9477-0abf-418d-8f39-3794ea92ed5b", "comment": "Malware payload (Smoke Loader)", "value": "5a35ca9f6780848a5997d80dab3a86e4d092ba260e4bfcddb9d226b947820c5f95a14edbffa328ccf1c3ecdac66879e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188783, "uuid": "85cabb26-2d70-4eb2-8ec3-06e3731a3ad6", "value": "T19144C022B7E2C432E4A3453454B0CBB51D7BB8722975C5CF33D41B3E6EA02D16AB6366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188783, "uuid": "a0c32a36-de07-4346-bce3-486aa05969ca", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188783, "uuid": "cc84e34f-6dc6-4b87-9e3c-61df4d2a8507", "value": "3072:iBXiXrgPgrVGtBtNHPBidyXqJWmICEg43wZi6lw/khZjfHg:+ArnrEtB3vBioXqJ3TEg43k/wshZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695188783, "uuid": "2a9c4e02-84ee-40ff-b723-3db383c56c38", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695188783, "uuid": "4ccadfd5-c7a6-44b5-96ac-b99ec4e3def8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188783, "uuid": "5afffe9e-6ae0-4f76-b028-3e1f0e6d7a36", "value": "SecuriteInfo.com.Trojan.DownLoader46.15438.29069.1781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acd4755-57d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695229724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229724, "uuid": "bb5e15f9-2f00-45d8-9560-dd2dd58c98e9", "comment": "Malware payload (RedLineStealer)", "value": "d36106beb8038bdea6c1912aabd244f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229724, "uuid": "26112929-288a-4bc9-bbec-9af3d9050dbd", "comment": "Malware payload (RedLineStealer)", "value": "a87a42e90b9d980accdbb4d57448856ac8d2d04eb890fcba9d7dafb3cfb66cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229724, "uuid": "5ee525f8-7cb0-4474-95bf-41430118af3a", "comment": "Malware payload (RedLineStealer)", "value": "d902fe8e91764167ee34b91de48c16a3d902a693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229724, "uuid": "646cd648-9fc7-4b55-81e8-5d312b5fa624", "comment": "Malware payload (RedLineStealer)", "value": "f47bf33a136487e2971459e4d5a8c86b4c4de131e17912f4a3f24323879616a07715d095034dbba09f270e152d815419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229724, "uuid": "9a57a708-3c9b-438e-b009-4d29946f3f7a", "value": "T1F5652352F7E04631DC76677051FF03D30A397E217CB8932B2291984B9CE5A60BA7B35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229724, "uuid": "680b4ce2-72b3-44e4-b33c-31aa3ea14dca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229724, "uuid": "4d51ff8a-f36c-4df9-af58-db0fb3159aa6", "value": "24576:oyqu0ZFlhvGepBPyWtcocFyQcChJS4k0bMtUs0JSTL:vqFZF/eepBVr6yQTjk0bbsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229724, "uuid": "ca6118b3-3667-4110-a20e-0f144f7ee9e9", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229724, "uuid": "1d9f6ab8-683e-4caf-bbc1-44263c9ba751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229724, "uuid": "c372459b-b9e6-42fd-991e-3661efe17d27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13384e7-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695229010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229010, "uuid": "1e0c070b-4803-4022-8d4c-c1e3028ba173", "comment": "Malware payload (RedLineStealer)", "value": "6c382d38721565c6661e84a40c8a8785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229010, "uuid": "82d3008f-15b1-4bf4-a975-422ce6c087a1", "comment": "Malware payload (RedLineStealer)", "value": "a8a364e0b9c52b18f274e6531e824e57248e1f820bf7fc7a4f0da093e24ce940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229010, "uuid": "66676f8d-1121-4eee-b2b1-10df05adb52b", "comment": "Malware payload (RedLineStealer)", "value": "1da7e34163a3a53ae7ff0a7d9f074aa653c45478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229010, "uuid": "544565ae-c3bc-457c-9498-d7a6170666c6", "comment": "Malware payload (RedLineStealer)", "value": "0be2af725a86af6c5cd7ce8ba34edf8e0a3a9cc4610253ec8e7e0c96a4ab02f9d3f262f5e1c2ec5e7f6a3d35d2ecdf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229010, "uuid": "d8e55994-d78e-4ddc-b450-68d7d821b487", "value": "T11744CF217180C1B3C8B7153044DACA3A5E79346647B992D7B7DD27BA6F213D1A33A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229010, "uuid": "8640c97c-f927-4180-83eb-b0b8163ee952", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229010, "uuid": "d898904b-b34e-405b-8b13-44a97473ec4c", "value": "6144:zDKW1Lgbdl0TBBvjc/OwkKeVBltVIAhpxwH+/vj5:nh1Lk70TnvjcI4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229010, "uuid": "d545e6f4-45f2-4aaf-aeac-da215934b902", "value": 272960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229010, "uuid": "7dc1f980-1bf7-4ebc-b216-939d507c10fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229010, "uuid": "6fb7ec25-00d8-47d9-8ee8-b59b709eed6a", "value": "Fiyat 10243975 KARDAG A.S scan.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4684a618-5776-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695187599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187599, "uuid": "3cad15be-8691-4f16-8f88-2434a1350616", "comment": "Malware payload (Stealc)", "value": "07c9eeed79b204ad1cdeffb32a34bf40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187599, "uuid": "4f20e2ba-7ea6-4b63-b8f0-7b612101b9fd", "comment": "Malware payload (Stealc)", "value": "a8f129e213ff60a297ab08e090082a217bbf8a7a0722837d24d8e677e89608c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187599, "uuid": "1234a244-c365-495e-ae38-3ea927dfdf5d", "comment": "Malware payload (Stealc)", "value": "98d6e7e8c2de289cc4e25779f96e87801c6b4392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695187599, "uuid": "d54887c8-6409-4ba2-8a07-3a670ad8cf1b", "comment": "Malware payload (Stealc)", "value": "3a097bf6099642dc0f5304c691d07713013217b2656aefdeb3db2b794dddc8d7b3aa5668dec1be0e7f03214c1afe0aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187599, "uuid": "2cfa560a-8dbb-4e90-95b2-3f22d8026a2b", "value": "T1A934D01235D1C433E5A746358860EBB46A7FBC726DA44A8B37D41BAE6E303A2DF11347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187599, "uuid": "839c3115-3594-4f81-8263-9651eb7b9fbf", "value": "55f2fae2d830ccf9734788609a42549e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187599, "uuid": "393758bf-946f-4050-a117-e4d38892b743", "value": "3072:35tjm+0EPxZ2GrQFk9bh8tcpJqfAsg/rFc7UfRkOEH5WlYT1Mi:zKuPOGsF6bh86q4j/8W1lYTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695187599, "uuid": "c296b746-120c-43a0-a8cb-339e427763bf", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695187599, "uuid": "2ddfa930-dd8c-4999-9de8-b623df91107c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695187599, "uuid": "b550f2d7-35e8-461f-8fab-096966a005df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280e09c5-5788-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1695195279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195279, "uuid": "4a7b89d8-3c39-416b-b12f-360d586e66e1", "comment": "Malware payload (Tofsee)", "value": "dc620c70e65d6dd08c16b665e55798e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195279, "uuid": "f63064d1-f725-4f3c-9c2f-59c951a5b55f", "comment": "Malware payload (Tofsee)", "value": "a95e315c8511c16e6ff6eb3462991e4b10a8d57f11cf02d66b6c97fb8d06abdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195279, "uuid": "578f05f0-119f-41ed-a663-a77ba3cec29a", "comment": "Malware payload (Tofsee)", "value": "12c8f0ab4e60f952c1153232e17626a305ecbeb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195279, "uuid": "e8d472ba-991d-4721-89e1-0c04d67e17cb", "comment": "Malware payload (Tofsee)", "value": "cec6a1a735c117c65678580e1f999323945f30506daa81ecc80901eab8d234a0582e46f29417e13d89f4517ca3f52a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195279, "uuid": "3cc30f82-46fe-4b69-9080-8f718183009c", "value": "T14234CF1235D1C473E26745344861C7B46A7FBC3358274A8B7B842B6EAE32393AFA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195279, "uuid": "fe51e2b0-4396-47ba-96ee-36755175c603", "value": "ebb1ad55f48b70b0a48dee8a767738f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195279, "uuid": "79bd7a71-437c-4fc0-8eea-4677524f158d", "value": "3072:hi8G0+iXbfqMq9u92Xi2hYtqLDdqdcIxwzGn5uYSGgqexQkK+c5/b1TT1a:ZfxfqMGu9ci2XLD8V5OG3k2JTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195279, "uuid": "4c81d579-c5a5-47da-b399-76142787587b", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195279, "uuid": "2a2e571d-eaf8-4a04-890f-6668c598e8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195279, "uuid": "f9c16950-3b48-4020-8ee3-73af7865c056", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860cfb31-574d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695170096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170096, "uuid": "59d93140-742d-4efe-9862-d347d484a74c", "comment": "Malware payload (Smoke Loader)", "value": "2296b750ee28f71d5f99535322b44da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170096, "uuid": "7e04b985-3222-4a8d-b84e-e9090c55cbc8", "comment": "Malware payload (Smoke Loader)", "value": "a9f3066845f3f00c34bd13812d9b2db561ec77824aa0ece2fca57f0071847d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170096, "uuid": "82f8e4fc-8600-4bf6-87f9-c5216237bbb2", "comment": "Malware payload (Smoke Loader)", "value": "01347ec0c2275b06295058fd0baeaa92c2688408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170096, "uuid": "7295065c-4942-4621-9789-5cc4bb617c75", "comment": "Malware payload (Smoke Loader)", "value": "ce598deba82ead069e57d0dbc182ffba3004839f3de4d24352e50110cd27488db814ae76eeafd0b9468737cfd2e27c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170096, "uuid": "4a5310c6-6bbc-4f5d-accc-4d333f0e9620", "value": "T1C444CF21B7E2D872E4A3453455B0CBA55E7F78321A35858F33E02B3E5EA13C19FA9352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170096, "uuid": "a5ca47e0-c74a-4152-935d-acb2527cbcb3", "value": "5b1aff3fca1c9b0f312fa66041b0a4f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170096, "uuid": "b0a07994-2453-49e9-aba1-3ce52521ff3e", "value": "3072:mQX7ouHB6PrOM8xby3kZ677wwvqop8FAzTeogCG3Azf:3/BOrOM843kQ7pqk8qOog/3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695170096, "uuid": "ade33607-5773-45d8-b352-bdfbc7856291", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695170096, "uuid": "e49d2c92-5026-49b4-8daf-b9d2936049a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170096, "uuid": "bf7d36d5-51c9-4f6b-89c1-829bee3652c8", "value": "SecuriteInfo.com.Win32.Evo-gen.27021.5969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f76237-57aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695210041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210041, "uuid": "15f3900e-3f24-47ba-965d-94653dd7433a", "comment": "Malware payload (RedLineStealer)", "value": "2c9547539dd4235bb091d037c492fd75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210041, "uuid": "98fdbd9e-4744-4b5c-86a4-5d13f86d4713", "comment": "Malware payload (RedLineStealer)", "value": "aa57952b8faccbc8d18c1a1614d31dc540ca51980b5290aeb3371c521827b77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210041, "uuid": "454bc37c-34ac-4286-a6e2-1dfbfcf58104", "comment": "Malware payload (RedLineStealer)", "value": "c019d762c747372977413e37cf78ab0f55c2da7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210041, "uuid": "c04c94ac-bc24-4099-803e-d54025e1b49e", "comment": "Malware payload (RedLineStealer)", "value": "a7ab600fd18105cd652284ecf5c02acb8c745c349114a5ce1a7a90262d596748c9ea1520ebbfbe07432464e7564f7388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210041, "uuid": "c89d70bf-5f2c-499e-af13-a1d86ca13879", "value": "T1C9652312E3FD4467C8B237B16CF637830B37BC52997543692A46A84D5CB2788A836737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210041, "uuid": "892ea6cf-4efd-4c2b-af7e-38884b00a58b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210041, "uuid": "8ede4a7d-496a-4ed9-95b6-d8f5e0ebb3b1", "value": "24576:Iyu4M3iB8blq2IFDBuZIoQ29sa0PLxu4W92m8HR4StSUzL100VWc1NNBQhFsH6:Pu4MySlGMZFt9spLxu592m8xUKL10sWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695210041, "uuid": "3e7b77d9-4f04-4364-bc4a-56001591551f", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695210041, "uuid": "1d1e1227-c24d-4ce1-acd4-3bce37696471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210041, "uuid": "b784c436-a9e7-442a-98ca-9aca7d01598a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a518ee69-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695196777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196777, "uuid": "cac17d00-e76d-4dd7-a0ab-d7905978e5eb", "comment": "Malware payload (AgentTesla)", "value": "511e9229dec350735267fe7a752b5ac0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196777, "uuid": "699bc516-c16d-45a9-b0e7-d91beb3d0a76", "comment": "Malware payload (AgentTesla)", "value": "aa58a7fe408a357c51f347af61022d8192a765b9607b664ec09f2b4f5287a041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196777, "uuid": "7d81f76f-fa5d-4271-a327-787d16c22559", "comment": "Malware payload (AgentTesla)", "value": "f10567fc5c6ab310605d11edd293a1a2901fa49b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196777, "uuid": "f6c57a9c-ee7d-4292-bbfc-b25f8d4aa5fe", "comment": "Malware payload (AgentTesla)", "value": "3c1746aabec307bd504682822d0215864dd244d9d1f3887af091b838c854c3c8cf54c6b25b5ac65c11b735cf71a2760a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196777, "uuid": "f475f603-ce0b-4587-9e5a-e435d72d5a54", "value": "T17ED423186E35603BC8FA9BB76AD5421C4E1D363880F627015B927B7C2F8550D7E2CBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196777, "uuid": "b5336065-6078-497c-a04f-e366b3bd6818", "value": "12288:5fhnWNt/e3pYzt59egLaZwZZXo61CIhF3eF4FN4mpScJ8Nt8yr/L3:jx+rw0IwbY6EIL3uuN4mryrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196777, "uuid": "6913b47b-42b0-4c64-887e-5209eaff1ae4", "value": 650110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196777, "uuid": "42c811b9-cbce-4481-813c-5cdecb2a1c4d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196777, "uuid": "f97df3fb-9765-41a8-aa8a-25a23efe5f2b", "value": "MT 1289 Fire classification.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdcfef6-5784-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695193923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193923, "uuid": "1edc71e5-1bf6-4992-916f-9dbfbfee5c62", "comment": "Malware payload (AveMariaRAT)", "value": "09f5bf7937d7b236e476040581e924a5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193923, "uuid": "bdb0bf4c-0ec8-478a-8c3e-e8e820a169c3", "comment": "Malware payload (AveMariaRAT)", "value": "aa5bc6b0cf464e4751b55f27110c4cd19822952a028edddb72efdcf43bd3dc8f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193923, "uuid": "c2199464-eb6e-4912-854a-2353c29b28b0", "comment": "Malware payload (AveMariaRAT)", "value": "c347c9b2d59842043245be513cc004aa4debaf5e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193923, "uuid": "5eb70488-faef-4581-bedd-0c015933ed06", "comment": "Malware payload (AveMariaRAT)", "value": "ded51a2d7e57ed07ced49ab14e67960270049749af00c366ef2d8c71573292e2e4bd7eac82d7a599ae97a9e133ecd71a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193923, "uuid": "a63a41ef-63b2-4514-bfbe-0943da071ae6", "value": "T164D3F817BE50613ED4118AF12CA8E66EBA626E710FE46D07B366FB1425B240335F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193923, "uuid": "333018d3-2fb5-4af3-a713-55b5762c9e81", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193923, "uuid": "2fd83ceb-3e7f-4222-9867-325462d2fbb9", "value": "1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVCv:UVqoCl/YgjxEufVU0TbTyDDalQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193923, "uuid": "e4b8c022-056d-4ea5-b377-2ba2f8a3a39c", "value": 138271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193923, "uuid": "e0872e21-e58b-4c0f-81d7-e61152b8b83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193923, "uuid": "21c05454-6366-4475-8e72-f6538688ed03", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868d9567-57f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695242682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242682, "uuid": "4c097838-17fc-45a0-bd02-f77dcd9767c6", "comment": "Malware payload", "value": "098456d760ae2a268c02b8249b95a936", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242682, "uuid": "4e860d82-7c5c-435f-b84c-7e0524e10980", "comment": "Malware payload", "value": "aa5f8259ec70ad1da7fe0b615d5cd4bebb09544a5e529fdddc6215d5c911833c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242682, "uuid": "18726ad6-f825-4f1e-9640-df02ebc5d159", "comment": "Malware payload", "value": "93f82001553d8bcf5ada12383a01ac49dc2fb5b3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242682, "uuid": "7df1a415-6b81-43d6-bcf2-27caf07ee31d", "comment": "Malware payload", "value": "a2eec75e61bd7df0dd29196cca3415e79a4ec7c48ee8bb2aaf4f65af427f149abf8b3fcebe96dc7fb66a3ef25e179efd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242682, "uuid": "18827d78-ad33-4daf-9c5b-4c81687d79f9", "value": "T105262383F661A257D472C033A146273665064E18E946B70D3D0C7BBA3BFBEAC4B846D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242682, "uuid": "36d84572-49bd-4357-8d67-84e47a18d8d9", "value": "98304:NikkpXLxwToSgP5D5OS0JKcFpIPqhaG4oOOPyPmeZNvf:c1W8SgqUcXIPqhaplOJef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695242682, "uuid": "1b271dd8-460f-469a-873a-e6d5530a567b", "value": 4640250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695242682, "uuid": "cb94378c-e48f-46c6-b12a-7a5d6066004b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242682, "uuid": "be63207e-6a05-42a3-9bb6-1389901949ff", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901b3f91-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221653, "uuid": "9b9c357b-70d3-4433-8627-a516873f28f5", "comment": "Malware payload (AgentTesla)", "value": "4b16c4589ce3211b6f45051b5fb422b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221653, "uuid": "b66b94e5-c38d-4e35-a32b-9c048f195cb0", "comment": "Malware payload (AgentTesla)", "value": "ac04f04d01ae5428a8017be37d7d1352ad3212852c259d1a0e2f775969ecc36c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221653, "uuid": "81d9157a-041d-461a-8ca1-da49caf077a6", "comment": "Malware payload (AgentTesla)", "value": "2b60d36184571a1bc35c335ab8941c2bdc7f02b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221653, "uuid": "a9866852-df4f-411a-b2be-cb19deafdd66", "comment": "Malware payload (AgentTesla)", "value": "24f954c475f0d511ebefecb1165dc246aec3bdf018d8536801276e4394ef5b401dd95cd817403322b1d9440285b4ab61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221653, "uuid": "8963d13b-e276-4ec1-a807-cd626186fac9", "value": "T1CCC4120C3A91CE42D09C07B4406108E157F5DD677987FB795ECAA0FA8A87B25C743BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221653, "uuid": "b5ae01cb-1122-4af8-ac7a-9dfb1f715897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221653, "uuid": "1dcf30f0-d3bf-4058-86dc-0b28479a9501", "value": "6144:Jf4NOk8oV/BR1z/8XIppg4P/l27t9mrvlRlOYADKgt5Q1OW4kXQAN2Tr3+oUSWXh:hi+9m7H2RqF4kXQf7WX42Yu26NCc6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221653, "uuid": "2e06a11a-32c2-4dc2-b4a7-04dcce75f253", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221653, "uuid": "d6804054-5eed-4f3a-a102-cdc5a4a96886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221653, "uuid": "235463d4-f81b-4254-b953-8429638a5c0c", "value": "SWIFT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3e9892-57b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1695213513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213513, "uuid": "763c795a-e7a6-408a-9fd9-f13f92863197", "comment": "Malware payload (NanoCore)", "value": "9e48278fd8663c2722eb3ce7b5ae34e7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213513, "uuid": "6873fa35-2f26-46f6-9e13-22736b0eb9bf", "comment": "Malware payload (NanoCore)", "value": "ac913cf8fc7fb6a7f7b35a51b63016ea29282e37cfec581a82668e50871a5ccf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213513, "uuid": "267da430-060c-4030-8a34-b8545a60e9bc", "comment": "Malware payload (NanoCore)", "value": "daf4ea109d2fdaff37b9c777aa7082a8087082e9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213513, "uuid": "79b10e03-5d22-4e4e-b47b-b527106594eb", "comment": "Malware payload (NanoCore)", "value": "70704a264419797de959b0632bab71745b640dec9c430c80a71b793524c7a25523e83fba6a97c5e19702d131978fc2b2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213513, "uuid": "3d3d5c59-b5e9-4ea4-95e9-3e3897cb709e", "value": "T1C245AFF875047DD62A6F536BDA96ACDC13B616239ACBA4CD8064BBC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213513, "uuid": "6c3bf76b-65ce-415e-90ca-4dac3e6bf041", "value": "24576:w7OAHXB6hBFelUYko7Uo1hoRiHGHjWcDGwxPGzPjuqsXiV9llerGaOl4jIpSoMO:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695213513, "uuid": "021422ad-d017-4825-aa38-c188c45a067b", "value": 1180783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695213513, "uuid": "1aa4f610-4a5e-4ae6-ace7-2e1f14eed796", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213513, "uuid": "34f1209c-e53b-4555-a1ce-7a391f38abb3", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.15404.19304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d71b998-57f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695240868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240868, "uuid": "31f9040f-1ac4-4d08-a910-ec51844fdaa5", "comment": "Malware payload (RedLineStealer)", "value": "af004eaffc4aa5a96fa3965e26788614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240868, "uuid": "44e680bd-8092-4c34-a859-99bec5e55dcb", "comment": "Malware payload (RedLineStealer)", "value": "adfe60c3ad26b5e986e056dd80412e5d10c309c61f8dde3eb53b04647110b041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240868, "uuid": "869be5de-7fa5-4b62-beba-0dfd33ffeb01", "comment": "Malware payload (RedLineStealer)", "value": "d7205bbaa5e43677bce0ec1377294e3ea10eaaca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695240868, "uuid": "ef63d276-63b9-47ed-a74d-d19b7323b352", "comment": "Malware payload (RedLineStealer)", "value": "d69fb1b7981df2acde50bc24c8105926226d4e5108168d4a4a9dd6431f8ad11e243c8927bc28ee7da7417c176038ae5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240868, "uuid": "2e00136b-2108-40fd-a2e2-29ee9321f4a3", "value": "T13D24D01175F2D073D1A785305834C7A47A7BB8736BB4A94B33982FAEAD303917B66312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240868, "uuid": "4c517936-b8b7-4adb-8a4c-6f1cb6e9e95a", "value": "d13f0a4e1c3acd1a644a413a45b35009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240868, "uuid": "e9e94305-afbf-4463-8e86-2351b6e56e7d", "value": "6144:JiCycD1v2QASCcaaYR/JLR+f/VABJITmL6:J0s1v2QhHYVBR+VuYs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695240868, "uuid": "b850eed0-12c2-4cec-9b28-2cc7f312de90", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695240868, "uuid": "ccc4eb08-914e-43c3-8d08-69dc3f740c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695240868, "uuid": "9e140e98-438f-4d6e-908f-d024d56c2184", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7f3d9a-5778-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695188768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188768, "uuid": "aae7dfff-2bc0-48f0-83bc-3255d6ca1b40", "comment": "Malware payload (RedLineStealer)", "value": "48839a7e29ecd276f5a07bf75bd3179e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188768, "uuid": "0827707f-0768-499f-8fb1-45be8c26d9de", "comment": "Malware payload (RedLineStealer)", "value": "ae015116529c25e2c01857f9a69a0b960296211252ca3a32d8a79218ce0e8346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188768, "uuid": "cb5585d5-a975-4023-bf24-fcc3e0dd423b", "comment": "Malware payload (RedLineStealer)", "value": "bfb8a0aa93bfb68c7b5296fc18d7de19be365632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695188768, "uuid": "03e23a7a-f555-4775-8a99-c9e91b31b76c", "comment": "Malware payload (RedLineStealer)", "value": "6045b8a6da249efc45b307121378d7a013d222fad800346cab6efb4efbf1070700bfdf76650848dc250837add8166e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188768, "uuid": "4c1e27a5-6d64-4c2b-b7d2-3eab41ffc4bb", "value": "T16F84F112B0D5C072D5A646358825CBB49A3FBCB259E55B8B3FD41B6E5F323C2BA12307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188768, "uuid": "5b50af5a-bdda-414c-a7d5-d3784224f78a", "value": "55f2fae2d830ccf9734788609a42549e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188768, "uuid": "70efa89a-3cf6-4c0d-8f94-6361eaea0f9c", "value": "6144:J9pHxOtI71+RK6kZjcAaaLEHg/yxG57PSaP8XTh88BbTW0/T:ThEtIpAk1cAoxGNP6Xd88Bb5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695188768, "uuid": "af8d606a-489c-42a9-9734-3f5e8bf38d50", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695188768, "uuid": "5948e76c-945a-45b6-931d-f7eab806b768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695188768, "uuid": "933f51c7-c821-4bc1-8663-95e6b84805bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8867a2a8-574e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695170530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170530, "uuid": "a6ee3e7c-229d-42cd-aa92-4c5e89835cbf", "comment": "Malware payload", "value": "55320d5590f68b86e71b030ce87b5d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170530, "uuid": "c0914ebb-f9ff-4cee-ae70-4895c55bb924", "comment": "Malware payload", "value": "ae61cebd3200bfba7fc721f97225f5184e007e9e1546aacd59009a9278b702d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170530, "uuid": "fccd560c-a8d2-4890-8efa-299f3078a17f", "comment": "Malware payload", "value": "18485989807197057afdcb1e5b8e6c0e74f78aad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170530, "uuid": "1e478933-4792-4f18-a115-481bce507903", "comment": "Malware payload", "value": "b63b698db6505e3916e1cbf89732cfd02f76d1c95b7e971b7bcfefa73f056623d71dd65f2d1f687aceef0041d4726074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170530, "uuid": "5a86c695-c17e-4bc5-8e8f-77e6815444b1", "value": "T13A048D4274D0C131F5E31472D2B8DBB4AC3EFD21172898DB67D8356A5E704E2BA36A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170530, "uuid": "802dca33-ee32-463b-867f-103634500afa", "value": "8ea5cdbcb00ec0db5419d8a29ba2f4ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170530, "uuid": "a1dbd093-f8e7-4f26-87f7-534dc8061c9c", "value": "3072:CFgiMd04bHHr/GFDtarONKp9wOqqw61fXbEvgkYEM2PUARU2gpPF:0E3bHL/r3w5616YEh8ARU2MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695170530, "uuid": "00796036-b294-40b0-9881-e4825b722756", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695170530, "uuid": "27bea95b-5bf4-4598-8ca3-482922fb55c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170530, "uuid": "45afa184-3409-40e3-9a8d-cef6e582adbd", "value": "rund1132_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26e5f27-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695196800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196800, "uuid": "4b4cb377-7614-4795-bbca-fbf7c67468c7", "comment": "Malware payload", "value": "b66608c10b8bd3a763690e6c352178e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196800, "uuid": "4ab76a03-a600-4974-857d-bdf46aeff98a", "comment": "Malware payload", "value": "aef7e9ad881812d1e397c28146a951465097769d80e13b511baaea8f635481d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196800, "uuid": "0f273323-378e-4ee4-87c6-524fd940a510", "comment": "Malware payload", "value": "72921183a67b04fd66480d78fb45d6ef11beaf94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196800, "uuid": "5968c7e8-40de-4f5c-b0b1-61ef54b23a5d", "comment": "Malware payload", "value": "01a1d7045ab8759e0f194432ec934ef9a9708998019e70f061cc9291ccf082f09e091c4e9a587e00f243ab52aecab392", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196800, "uuid": "1c694f42-4476-4678-837b-e372b7ad2022", "value": "T13BE4EF97F3C6789102431FB2762B79D9ED2E9AE83088055A9115FC88F6A47DCD6F9C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196800, "uuid": "4f67eb3f-509c-4da9-b1f4-e9fe085582d2", "value": "12288:8Dx6bEzPgSgBHkELRKNtTowt1epZRy7rrgHTrvtscfTTBbauYpQRHuiugnCBwKx2:8Dx6bEzPgSgBHkELRKNtTowt1epZRy70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196800, "uuid": "3bf9c056-de1d-4147-8e5e-c03140f7ddee", "value": 701197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196800, "uuid": "46a2e99a-1542-4c02-bdde-68d289fa3445", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196800, "uuid": "25aca016-ffab-4a49-bf03-364200b19322", "value": "Moneygram_Cancellation_Slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367891ad-57ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695237394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237394, "uuid": "b6cffd63-1002-4ff9-8664-567c0a3407f1", "comment": "Malware payload (IRATA)", "value": "5e3849a2b90692ce7b8f37939f10109e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237394, "uuid": "7cce05c0-c0f6-4298-a5cc-7bd6db7d0ac3", "comment": "Malware payload (IRATA)", "value": "af8f6f0cc338a39949e073e20be907b810180da8c8071e29cdfe209124186f87", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237394, "uuid": "440791ca-87b7-43dc-bcfd-8ebf82958f86", "comment": "Malware payload (IRATA)", "value": "1eafca781b2783aba61f4f5b68f37fc4b835be50", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237394, "uuid": "3d75bee9-8c0d-47cc-b9ef-85c3e161df6b", "comment": "Malware payload (IRATA)", "value": "fdbcecfe353afba99da4eb679eb64c3d9efd209012234e5c2f8709ac25e4f278a8464c357fbbe1b0955a0470a7e01156", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237394, "uuid": "ec55c56a-f564-452d-a4a8-a61f6267bbdd", "value": "T1EAA533D7E7B190A9C9DB7F322214A3E8927B1EA34E1358837444B7795A327FECB44181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237394, "uuid": "49f821bf-311c-4f0a-a541-76066386cc9b", "value": "49152:AEzX5dmMXtHYN8cGpCiTayAs/10i4kwIrmY6OEb+cSUcbsqna/:A6X5dmItHgVsdiZb1jqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695237394, "uuid": "ab12a737-a729-4f4b-b9cd-0d6b8a2d37e9", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695237394, "uuid": "db9ffaad-4c0f-46fc-b8f4-f8d2349ecf50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237394, "uuid": "ea64b37d-46ed-410e-9125-c9b99c4b5580", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bd3980-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695241870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241870, "uuid": "b44cb33d-092b-459f-b871-4f6229d9be59", "comment": "Malware payload (AgentTesla)", "value": "152c9e33692855c6724d54b508e46abd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241870, "uuid": "135a7946-9f87-4444-aade-89494bfeaaa7", "comment": "Malware payload (AgentTesla)", "value": "afa9527d820aa91c5ab7b8f39cccfe705ac87f32a938d22ee5bf7d963accb0ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241870, "uuid": "b5ae88fd-0d5a-40be-96f0-bb05ce865606", "comment": "Malware payload (AgentTesla)", "value": "16d70127626da5be9250f16d4f981bf8ac49a8c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241870, "uuid": "55166eb0-0dbf-474e-85ab-0abc143d7948", "comment": "Malware payload (AgentTesla)", "value": "0bd27288b7211df5e3ba68d1325b26576d2a00acecdd53b2bf09df2db5d8483ee87e8a97b65ab1cfa06af5df54ca2e95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241870, "uuid": "c25c6015-8b7f-419c-812b-4f3b74316a39", "value": "T146C4AE1531EE6E05F07AB7B50BB8E95547F2F5E2A23AF70D3F8402864569E40DD22B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241870, "uuid": "f81a00f0-6985-46fe-9234-4d02e66a5553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241870, "uuid": "f5966993-fa99-4075-ba7d-0124391d6aa9", "value": "12288:6uvgIb5GS0xzkvs2YltV0y7OqVVrDaA5+oZCe38kO6dKm:D0PVkqPDak+o0escdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241870, "uuid": "ef221996-25ec-4641-9483-2636a53ada69", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241870, "uuid": "662147b1-794d-470d-a36d-8a016a5969bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241870, "uuid": "ad25dd14-83e7-4dcf-b755-8b120c6170a5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1705.5261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f9ea98-578c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695197160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197160, "uuid": "bde8382a-a60a-4522-a54c-9ba2e56c1119", "comment": "Malware payload (RedLineStealer)", "value": "48176e8e6fbea981ef18e00862cb4c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197160, "uuid": "3734075e-7e9e-43f1-a693-180c7c32eea7", "comment": "Malware payload (RedLineStealer)", "value": "b16b54175ba7bc8b86612c46a1c195010b6dc35d70f12d4269b3b9f2184e802c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197160, "uuid": "1090e442-ee44-42c5-aa32-58cc884cc3ea", "comment": "Malware payload (RedLineStealer)", "value": "598c60b471c8d429b95a6fc2915a2e568e114868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197160, "uuid": "9d0593e9-7715-444f-8af0-65f060c43cd2", "comment": "Malware payload (RedLineStealer)", "value": "a03762dabdb09ff01a07ac670b529d71d7eafe3d84e1cfd3714f8164eca28c224eb21435bb6df43e7c985136c9aeb29d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197160, "uuid": "1e88df78-d068-4cfa-b4ce-1972b6981e0b", "value": "T19C65230367CE8163DAE21B7079FB0283163EFDA51D78965B27448C4A0EB39E4E935727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197160, "uuid": "30415bcd-c118-414e-96ef-e74c118b1efe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197160, "uuid": "2f205d88-a134-47eb-96a3-e31e0c4f26e5", "value": "24576:yydq8Eyryo3tKF8PWQm9lRDGwcmU3/EG1edXHGEvaXFAJ:Zdqoryo7utHfuPEGghvaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197160, "uuid": "31325660-707d-4ca2-b4c1-535a7d922e62", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197160, "uuid": "f42e6678-ebb7-49ac-b0a5-1166841df5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197160, "uuid": "58c3ce69-ed8a-4861-a0be-606bc8829517", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cad565-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229172, "uuid": "d95fcc37-1ce9-41f1-bb07-c774719d4e60", "comment": "Malware payload (AgentTesla)", "value": "1b41c7a0ac2c4166ec0dba869d6cb718", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229172, "uuid": "f7c9f650-21df-4e21-b4c8-5b3d6086f40d", "comment": "Malware payload (AgentTesla)", "value": "b1c74b43c3c2dac3db3b5f1fa1c834dd4b2bb293ac926cf3efa82ae82db01683", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229172, "uuid": "1483c4bd-4403-4228-ae58-56481be0fe35", "comment": "Malware payload (AgentTesla)", "value": "87b0c70a15437b73799dabab6068b6d3623f693f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229172, "uuid": "743ccf6a-9900-410f-9555-a229c180705d", "comment": "Malware payload (AgentTesla)", "value": "98e62fad333824faf6537e9b2155a2fe03ccb2bca194352d218b33dabb0afc6888ce2bd4251a66e9943d52ee1308974a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229172, "uuid": "4bda1117-073c-4f5c-9157-a1c2957ff99b", "value": "T1E9E423D8029D8A7FBC6FC0A4927EAC2EE1B158BDF7AD374B278616C719B40B44309854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229172, "uuid": "85a42177-18cc-410b-8793-ef2097b8c538", "value": "12288:3snW4fxV6Ha1zOERxIJWxtpKV1NEj6G54YIIXAogUA2meNqhmmBmtzHbq:cN8H+CymJWxtZjlDXACpmmmmzHbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229172, "uuid": "0228907d-4009-4fce-ac32-65419c28c59d", "value": 686082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229172, "uuid": "1ae9d264-18fb-4353-84ad-db024a88a972", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229172, "uuid": "ca6a346d-167a-437a-a743-d874e1af62c5", "value": "Order_list_PO 184383.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c7bc54-57a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695209420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209420, "uuid": "6c76950e-b529-4a46-b79b-c270eda4705b", "comment": "Malware payload (RedLineStealer)", "value": "fa30364a5bb26b5aeb82b1013c10bbbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209420, "uuid": "c9acdd23-e845-4d18-8da1-66d63a107561", "comment": "Malware payload (RedLineStealer)", "value": "b28546dc6fd49007ebf76ad4b5225ffd8096240801fab6afaa18b3cc3cd9444e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209420, "uuid": "129b68f3-2214-4bf7-8f77-3dd20d230ce9", "comment": "Malware payload (RedLineStealer)", "value": "60c6392f1a24d2750f4bbea10dbf6741ab810309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209420, "uuid": "a51cc23a-f90b-4536-aa57-21e4526200b3", "comment": "Malware payload (RedLineStealer)", "value": "186c40b6928271119af19363cedf749d1aea0215c7c1fae955f4c1de621881bf654bb572662cdde7a1520a220617d605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209420, "uuid": "f95e2595-9b77-45ba-a72f-4a8fd013653b", "value": "T1EE652324F7D9C174E4F657725CFE11930B3ABDE92A38422B2B4F480C19B29D4953276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209420, "uuid": "194da32d-4c9b-41e5-b108-aaab524e72e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209420, "uuid": "7eae34c5-71ac-4592-9b1b-c9cf43894cc9", "value": "24576:ey4KLEwK2CZFbG2hnFSubF/5Qpw853d5zCXIUDklmrlTf4t7oq2z3L1qJ3nfHMzk:t49FDhnFS4Fx0wEDC3kcJfv723fIHGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695209420, "uuid": "17c3247a-9cea-4a1c-ba60-e5203fe23a3e", "value": 1436160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695209420, "uuid": "24b8eb49-cac9-456d-9d2c-7a1e7230ed49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209420, "uuid": "2d944eb0-342c-4341-bd75-edaabd961fea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44476294-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695221526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221526, "uuid": "8629334d-0c11-4203-b5ce-41e5839d76b9", "comment": "Malware payload (Formbook)", "value": "53d4cdf2984b73a8e901dc99763686b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221526, "uuid": "4cc10489-0486-419c-93ee-269ed28d2d94", "comment": "Malware payload (Formbook)", "value": "b334948991343e7c83707d03ba19c913841e49022c74c1f890f036bdbc04071c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221526, "uuid": "2249d7c3-db86-4d31-a739-72f4125118a2", "comment": "Malware payload (Formbook)", "value": "9f3fc20bc2a6aa7d857bc948227d93eb443ef25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221526, "uuid": "65343927-a2f3-4964-8bd3-1dd2589cc8b4", "comment": "Malware payload (Formbook)", "value": "20b05c2be5dfb37508a8d6ce46dd1afaedcae66f6b588e13f8ba108b9a560cd6bc1312e51e4eeb1805553e919172fa97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221526, "uuid": "1607374b-d1d2-42e9-b17d-f6bd80f106c8", "value": "T1F7C422043674DF13D54D07BD04B008A23B769A477DE2E7A85AC9B0D68E9AF9582073DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221526, "uuid": "a7bdf3c3-6ec4-41af-a03a-4b66d8c269f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221526, "uuid": "6188f0b8-9690-419f-b218-11d5c71a095e", "value": "12288:NHCWbysshKZtQLbmgcSP4JvBjSn49lzkTSks5bNjVHJKqQeh:NiWbIh68bmtSP4xZSnOFrJNNRHJKqQeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221526, "uuid": "6378a85a-8173-4806-b8f1-b8430dbcb567", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221526, "uuid": "77a0187e-926d-441f-9599-7e34d6c6b246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221526, "uuid": "0f715984-57de-46d8-80b8-353761a5a657", "value": "SKMB801526CI50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ae954f-5749-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695168351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168351, "uuid": "a6ce5897-9947-4860-8969-0f3d2786612d", "comment": "Malware payload (MysticStealer)", "value": "191eff4fd84213a20863ba5e370fc702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168351, "uuid": "015e0b73-ad4d-4356-ab5b-4c3f4a134fc9", "comment": "Malware payload (MysticStealer)", "value": "b396990aaa99a367607e75ac886510a2230e08c1f02745214b3d0f3d78d82a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168351, "uuid": "1d2e023b-3875-4314-a93c-26cee80bdc99", "comment": "Malware payload (MysticStealer)", "value": "1b00cb2d7a0235597c102a84b2b369012d377fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695168351, "uuid": "390b8648-083e-4a79-9699-697f0d6eb6e4", "comment": "Malware payload (MysticStealer)", "value": "7233f36056a42e5a231e184bf845b7768586f97932490bcc8553dbc07c53e94d0f7dd7df9d19b08bcd4a2642edfbc8cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168351, "uuid": "efba18b8-5eea-4afd-a618-4ee0bd04432b", "value": "T15B35AE21389480B5EEF220B746DCB67943ADE4B007190ACB42D85BEED6E06D17F376D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168351, "uuid": "b63b2937-188f-4c77-9411-220b38740d09", "value": "f6040bff5e7406bf13febce5512b9888", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168351, "uuid": "faaedf69-3e9b-4bf1-9e5d-8fbef4df6573", "value": "12288:bNs5NN2dA1IY9i4ytPDxZZZVf95Tjz8L2aB4vIubLkl8r7PZql33TwxRodiuKPmr:5s5/2dA1h9i4ytXVX3dsTwbosuKPCAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695168351, "uuid": "1b4bb8c2-a9c8-4f7f-abe5-cb1c82edeaab", "value": 1114488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695168351, "uuid": "716edc50-463c-4803-bcb8-17c760b1a363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695168351, "uuid": "d7caa371-b95d-4e72-b23f-31b50cf7845d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2daa8c8-5772-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1695186090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186090, "uuid": "2a6ab396-951f-4af3-b16e-0e9160bdcaea", "comment": "Malware payload (Tofsee)", "value": "12cdb492973fa18e05f3a2e3c595541b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186090, "uuid": "03b7ece6-3996-4e12-bc4a-8698d4b92c3e", "comment": "Malware payload (Tofsee)", "value": "b3c6d1a964f702e6e1f032facdd6f890abd2b834a1f1267415a91a22753b93fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186090, "uuid": "6c99ee6c-82f9-4c67-a55f-b5864a45ddbd", "comment": "Malware payload (Tofsee)", "value": "05c8820a33c4acbe74deffc85364d7ac6abec686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695186090, "uuid": "cceb606e-ed0d-4dcb-8a49-ea0b4faee5b2", "comment": "Malware payload (Tofsee)", "value": "a96d565587beea85a44454479a71f0d2b3440ae8ac42cd4970362afbb2bdd84114db7d1bd78a90096e77373d3ee46f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186090, "uuid": "1c5ea921-eb0f-4ac1-8ae0-63005d787095", "value": "T10734D012B5E2C432E16746394865CBB46A7FBC725D314A4F3B841BAE9E303A3EE15317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186090, "uuid": "1d5b1aec-2475-49ea-a9c1-4db2998ca8d8", "value": "55f2fae2d830ccf9734788609a42549e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186090, "uuid": "93d2b6c9-d9ca-47b2-9881-75981ff1c1dd", "value": "3072:fFSHmg1Ae5CEEvwpYmPkP9yi1DrOIfzk6q7R6a/obLX5WLGNT1M:AGxeVEvYYmPk1Dxhq7R6a/oMLGNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695186090, "uuid": "a08669eb-ae66-4914-b99f-e9ad1061e7b5", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695186090, "uuid": "8eb65fba-fc47-4a9c-9c09-618def627a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695186090, "uuid": "2e9f1013-6fff-4502-ac83-4de53aae3d75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe545d3d-576a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695182754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182754, "uuid": "7ac2988b-1e58-40d1-929a-f641c4e59d70", "comment": "Malware payload (RedLineStealer)", "value": "d93569f4d44458cceb11a985f0fc5096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182754, "uuid": "b3341698-54e3-424a-84c2-425163b99b6d", "comment": "Malware payload (RedLineStealer)", "value": "b6e7dce3caff86bbd931e15742e975d03cb5b55301d48787c9e04ed042ac6efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182754, "uuid": "dd1af599-7786-49f9-a930-0236c274c0ed", "comment": "Malware payload (RedLineStealer)", "value": "508e5e0427a67ff61dc2ae7484be6b1c612e951a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182754, "uuid": "cdc824a7-4a46-43d6-bed1-7b41d8a45ff2", "comment": "Malware payload (RedLineStealer)", "value": "f029146106725fbd6293b3afc7d23a008899dea4d038ae801bc667c18b68377d720c5aad6d9cf23d1a1d22980b63db26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182754, "uuid": "44189a7f-6661-4698-b631-53b37b10141c", "value": "T117652352AAF855B3DD64777468F281830B32B865A91002AB7B449E4F9C71FE0D232777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182754, "uuid": "3f6876eb-4503-40f3-a56a-0a1889c9a1fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182754, "uuid": "7582ad3e-618d-47ca-a6c8-403d7cad94a4", "value": "24576:Myqc+21SrmUYH/Nh53bdfIr01TCxtHw8Vf30AXnweW6npCPfeKFHu0wdjtWcIuBg:7qc+21SrmUYfBir01uHjfkQFTnpCOKFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695182754, "uuid": "4e694f9b-7b32-4553-81bb-ad4e363e3d62", "value": 1460224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695182754, "uuid": "f2e2752c-8d12-4d0a-968e-07069b11bb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182754, "uuid": "dec1519f-a496-4d4f-a1f2-904241d97099", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85af032f-57aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695210039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210039, "uuid": "cd1a85ae-5770-454f-8b3b-ebe0738f92d8", "comment": "Malware payload (Formbook)", "value": "e10fec549c39c3274dcda749ec3a7119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210039, "uuid": "d270f2d0-bf29-447e-a9ef-4cb6316b5bf2", "comment": "Malware payload (Formbook)", "value": "b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210039, "uuid": "b834f93f-3dc1-4752-952d-386bcc15c27a", "comment": "Malware payload (Formbook)", "value": "467eb88366dd6778937cc682f2d0793bb8b8e4e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695210039, "uuid": "442dbafb-7e32-4ec2-9e16-38e12e42927e", "comment": "Malware payload (Formbook)", "value": "f87067b93d0399dc2d23010b01a1c9ad024087a0933f783c025a6c5ea55d2ac2051e9b197eae27ef68db5f189dac382b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210039, "uuid": "5567cc78-d4ef-40cb-adea-d89aaedbd8f1", "value": "T161D423183AB48F5AD4F90BFC143414056B75CE4BF999E39A6CCAE8ED4B56B6182103CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210039, "uuid": "5217d8bb-d44e-4bd8-946e-3b0b5b6e4e58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210039, "uuid": "d45177ed-d185-441c-9611-3689b1e49526", "value": "12288:of1Qxpw8pplE3iifF2iRRv7lAscevzlfgzvulAvheD1P/wOwJ:Vxpw8CF7l9c25gzvulAc1/Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695210039, "uuid": "d2ef0a15-6399-4eea-8a96-1190668c854a", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695210039, "uuid": "de23c378-11cc-4458-99f3-84090243c1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695210039, "uuid": "d35d0206-f990-471c-b4ff-ba70afbeeeec", "value": "SecuriteInfo.com.Win32.PWSX-gen.7437.3396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205e6ff0-57d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695227049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227049, "uuid": "4ff79e2c-c8b7-46a9-8bc9-f85006051c89", "comment": "Malware payload (RedLineStealer)", "value": "1db261e7f8d4cd79deeccebfef0eaa13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227049, "uuid": "4c888ebd-7e35-45e2-a12d-c0bee269c307", "comment": "Malware payload (RedLineStealer)", "value": "b70e3cdc93336a377fdf56755161ac8f5692e9608b44f2f9367b5d2e5b9b3f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227049, "uuid": "1ccc4052-7f26-4998-ab2b-d18e6dca6972", "comment": "Malware payload (RedLineStealer)", "value": "44b63d9dd488dcf9f681ad1d4f59fc817123d566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227049, "uuid": "04ab2c1b-c99c-495b-8c95-78e47d2f125a", "comment": "Malware payload (RedLineStealer)", "value": "0a36500da85c8bd7f2b5f35315f789147f7ae3f3bc0f83f62e7d72737a4e1a56d3d5fd474199a81a5cb5c3bc8cf45f50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227049, "uuid": "334ce646-7415-4a3d-b856-45a8b0f979d6", "value": "T18E74F2123D92C432C4E785749CB0DBE4683FB87365B5484B77642B9F6D303D2AB6A70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227049, "uuid": "98b5de02-b131-40a2-8d2f-59502ef419a5", "value": "f441e1f89e815eda74d641cd1f758949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227049, "uuid": "04cd8ae9-5f8b-4942-bf1b-d097dfb005b9", "value": "6144:vfgUgcaXBy5gK2r3cCvegD8lj5CkJWZypKfmlSrdHKkHXMc1Tr:vfRaRy5SrneO8sulAKenhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695227049, "uuid": "f47107d3-fc0a-4d1a-adc5-a0bcb1172640", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695227049, "uuid": "0abf9356-d07d-4656-89ce-5b18f68b61f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227049, "uuid": "dc4f00f7-e26a-4254-8368-c6ec5ddb035a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5192eb8e-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695199214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199214, "uuid": "85ecef2b-371e-4943-a16f-b7d3d0fb90e5", "comment": "Malware payload (AgentTesla)", "value": "506202853c23b9302f6fa4173a6090f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199214, "uuid": "87bbb724-6264-48d3-9a2a-d131b811323f", "comment": "Malware payload (AgentTesla)", "value": "b9bca44f6e2224f28b36f94303b45cfca4270c60ec0ba099cfb58e3d677457f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199214, "uuid": "23386240-508d-4a05-b639-e2d4211b9b09", "comment": "Malware payload (AgentTesla)", "value": "90c1cf7f8d8a5429182842beeee1112c21758343", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199214, "uuid": "a6252813-3aab-447c-9f5c-8a818a9d6e91", "comment": "Malware payload (AgentTesla)", "value": "fa7cb85b653e365bdea754ea464f4c19d9489b22f9e7fb8e567e422fca8d178c5f4ccc77455c40025b16911a40448c34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199214, "uuid": "008d414a-a3fb-48bb-ab0b-d1e631b93e38", "value": "T142D4121837645F46E08C1BB81850087023B59A2BBD56D7B01EC6B1D64AEFFF18B1A79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199214, "uuid": "1742796a-0f45-4709-909e-6c3c2b6ba94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199214, "uuid": "551502e0-bae3-4270-8c75-4f78f3e15771", "value": "12288:lUViQsgKBrUp/Ewi7+o8Tfj4CbF/hYB/gFkSV/ING6gIGAfqk:lyClpfCAYxRING6gt9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199214, "uuid": "28ea3408-a4a9-49a4-a930-a6f7df20a77c", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199214, "uuid": "086816dc-6d78-4fda-90aa-31b1524cec80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199214, "uuid": "adc6ac5d-6991-4edc-a2fd-a42f7bba90a4", "value": "oe9fRxYWHKjUyH5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829e1336-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695196290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196290, "uuid": "95b85f07-30ff-4e3b-9c1e-ee21778eac0f", "comment": "Malware payload", "value": "ec2a6d3f0877860809def944731f845e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196290, "uuid": "d44462d6-71c5-402d-b51e-df71f9021f2d", "comment": "Malware payload", "value": "ba709c69ec263ef09b599307e5ad4402e7bb8b49991a58cdc16ba21289112ac3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196290, "uuid": "f66c15fd-bc3a-4f37-a20a-a01ddaa28793", "comment": "Malware payload", "value": "ce213f0757189ce6a39ef9b6e4344bdc55146406", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196290, "uuid": "2a9cec8b-19ce-4f8c-ab2f-e78c8960ef0d", "comment": "Malware payload", "value": "ff9b12414f0dd5495ae085f860b4f8d87ae4d6906bc06ae54a7404dcc8bc95130639b852249f888d4d400ec822e256c9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196290, "uuid": "d405da9a-dbe3-4029-a70c-18ba2509ee06", "value": "T19C743907F943512BC03C8D72869123A5316C6D797E695BFF249E39ADBEB36B02E01D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196290, "uuid": "5553d425-9d54-428e-bd23-a5db96606702", "value": "3072:p3RvGVOqCBnVgS6nWzsmB5iBXUj51ZaPlP30tBolaG3+AsQC5RjnZJ:p3Rvhrn2S6WxHTZEf0tulqZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196290, "uuid": "956a308f-1685-4b76-b01b-3fd55d6f3e94", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196290, "uuid": "1f00b25f-f70c-4605-a36a-aff34deb36e3", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196290, "uuid": "d47edfbe-0a2c-4252-bf93-fe104e9a5a50", "value": "COVERING.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d62128d-57ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695216870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216870, "uuid": "9a640ed7-2b25-4964-a7dd-ee02d1030886", "comment": "Malware payload (Smoke Loader)", "value": "56568d8326db0818c0710d953a59caa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216870, "uuid": "a09ad089-373a-418d-8020-3bf3375bb6d2", "comment": "Malware payload (Smoke Loader)", "value": "bb1627a5e4bf452866af3a1eddebe8297be25fbc807b42a27a86fc09c64f82d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216870, "uuid": "26a51d4c-f616-40d6-b57e-c973cdbc7ef4", "comment": "Malware payload (Smoke Loader)", "value": "ff96d1d1736d648d1ba82c61fb5e9858a645e466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216870, "uuid": "80acfe2a-150a-4443-942f-ca5d1d227ce8", "comment": "Malware payload (Smoke Loader)", "value": "be57588a95b66aa7382616b2304c6147519fd431433f0a3a9cf2b30df59b188a8633942505f5caea5f68437c94ab9f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216870, "uuid": "54adb35d-01f0-4637-b6b5-bdd41f4e407e", "value": "T1DC24D0213992D472D5E781708830DBB06A7BB87367B4898B37542FEF6E713C16B66306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216870, "uuid": "eac1e607-6278-4371-ac19-40ddaa97a4bc", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216870, "uuid": "23576833-7019-4137-94d2-9363afc5c46c", "value": "6144:IjrqzhJd94I3CmwJu8rAQ/TemlnT0dyTu:IjGvd94OwJ3pvT+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216870, "uuid": "9860575e-e7e9-45d6-acbf-806f7249d59d", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216870, "uuid": "f25796ee-e1ae-43fb-8e74-ac2a650b3ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216870, "uuid": "178f5b81-7a8a-4583-8390-dbee820b7fea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd086b4f-57ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695211850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211850, "uuid": "4f57b9bf-aef5-4608-ab09-51d851c25c0c", "comment": "Malware payload", "value": "dd9fdd3bc5168486cbf5f67d800d1b8d", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211850, "uuid": "8e29ffc8-c885-4785-bb17-e0b749a72e37", "comment": "Malware payload", "value": "bb334f684c0df32136b5ee495f0d4fc12d1e5d48cfc98ea6a17892af1e4ec482", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211850, "uuid": "5a381c9e-9677-4b1a-91d2-acee5ec44f30", "comment": "Malware payload", "value": "d23a2fcad76d58d43c6c89b8e1b78d5259e1847b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211850, "uuid": "40b8397b-2fcc-4936-bb20-36599435c84e", "comment": "Malware payload", "value": "c44ffa814ab9bcdc8a9cc34b93b014d52a517ca49b10630687891bd20cf01d63b64ba92408a4adc57e7e9cd4487c8f4d", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211850, "uuid": "a7acf7d0-2714-4790-962f-6dbc79ba6f70", "value": "T12C38334DEABD0754ACEC800DBBA20D42DA9185CEAD4A2D5EF7CE60F5D574D00F1A31EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211850, "uuid": "767773de-8495-48cb-9c3c-4f2ed89a445e", "value": "3145728:KYcIw9poNm0sg01bAOZ9ZWnY2n9bIiSmeyx+Q2B2FXaI:K90NpsTZqvJNX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695211850, "uuid": "63cad3c6-12f1-41c2-8703-f622a6608c20", "value": 103804488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695211850, "uuid": "811b9d53-8708-4ca3-b154-b54e1dd58117", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211850, "uuid": "89cd1e1c-b7a6-44ad-a080-9db00550c9b4", "value": "recibo-332882139_57.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a151f1a5-577e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695191187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191187, "uuid": "4d551b61-ad41-44ae-93fd-287b8c3f8d2d", "comment": "Malware payload (RedLineStealer)", "value": "36643b03cb6781a8dba43ad0ccaaa8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191187, "uuid": "17529644-714b-4b6e-a20c-31748c524714", "comment": "Malware payload (RedLineStealer)", "value": "bba3dd9184f05c4f905d8bdade137585d874469e3d118519d6271aedd31be6db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191187, "uuid": "2c297719-0cc9-4932-8687-f979d5338fd5", "comment": "Malware payload (RedLineStealer)", "value": "48bccc5cf281ef7d2ca6def1bcdd507e4663fa56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191187, "uuid": "e94ecd17-57ac-4c05-b7f8-5319de6342fd", "comment": "Malware payload (RedLineStealer)", "value": "424b9c53b9e46750b25b53a9c1297a62109ca037766df10e4ee2610f5d1a25f5adaa2c35a9e67f0caef74ed70784dd0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191187, "uuid": "2dd7e21b-fcbf-4715-87b3-23ccae236644", "value": "T16E652392E7D8C473DA7217B048F511872B31FCB116689B1E3B41986D5CA3E84A673B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191187, "uuid": "d35527b5-798f-47b5-858e-327ade5925a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191187, "uuid": "e4fe5f2d-5ed9-45b7-abab-a35b642d5b40", "value": "24576:WyVBmnydIOoIqRiuvbSTh+3uHVxrHVCXoawWn99BQBYSwuHG2n:lDSYolvbSTs61o4F4BkGaG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695191187, "uuid": "806d141b-d82b-4d80-8c8a-e380d06b8165", "value": 1464832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695191187, "uuid": "8364a6bf-b9bc-4ecf-b41c-b1283363bb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191187, "uuid": "7221be60-53e8-48ba-9757-ab251736dc97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9eebd9a-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695194772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194772, "uuid": "c15a1098-8e62-4d44-8f38-3bbb9ad0a65f", "comment": "Malware payload (RemcosRAT)", "value": "987971ef05bbf3bee0e5f0548cb53b64", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194772, "uuid": "45d90bd3-9161-4868-af82-fccdf03bbc41", "comment": "Malware payload (RemcosRAT)", "value": "bbe10b8d55fd248651e7d483e82426fda7c4e2799461065d734858362e4bada8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194772, "uuid": "c2dce9b7-a1f5-4dd5-ac62-3972f31aefa5", "comment": "Malware payload (RemcosRAT)", "value": "8b961e75ab5fd688da06b1ade6ea1d2ed82fc3df", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194772, "uuid": "0bdc947e-f25f-4a73-8fe1-8aba984c6ad0", "comment": "Malware payload (RemcosRAT)", "value": "64f2461cbd6dcbbceeeb69c8afd31c324898bc4e2bacb803918788ac6cd014566a62a2196e6a017e103105844d137e7f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194772, "uuid": "82094f55-6782-400e-ba3e-8189a8f5114a", "value": "T1C2741288D38E11A0CF54A77793674A8944FCB73EF25541A5B4AC833533ECD3E0626A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194772, "uuid": "778c97da-3cf3-4d2c-bfff-5577514d98fc", "value": "768:jbOnDlKzboVm33/y3NZZ2sO3pv6o+qq60Vf7:jbsDUzbgmENZZ2sOx6o9q7Vf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194772, "uuid": "cd9d2ecf-4e7a-498e-b363-94eae536a49f", "value": 353329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194772, "uuid": "a520ed38-c551-4550-bd91-34f2c851e4b3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194772, "uuid": "8f5b645b-d80b-4b86-b7a0-a8c0b7d73e1b", "value": "PO4102672345.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4beabedd-57c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695221538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221538, "uuid": "d3ce99d0-afa1-4313-9154-caf959163b92", "comment": "Malware payload (AgentTesla)", "value": "58c50ef496ccdc5ce7cb50e9c54f47dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221538, "uuid": "55af0a29-556d-42f4-9c22-1c9b54a3ae52", "comment": "Malware payload (AgentTesla)", "value": "bc18ba5f02eef7081124c339f4c1010d2ae6e8c55468a6ab0c918d8b45a05915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221538, "uuid": "21477a4d-3f7c-4816-8e77-a1bd87559fd9", "comment": "Malware payload (AgentTesla)", "value": "0487ce492c622ac82d241fe8581ab2ffbf1d12a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221538, "uuid": "cc76bd22-22ee-45ca-8f68-2d75b19089ef", "comment": "Malware payload (AgentTesla)", "value": "a2c68c76a45afd1c62c2e40aee941c418da850962a96494510572a21dec475d1b8775051bb8c79a362dea0790339abae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221538, "uuid": "4d573fa7-e5f6-404b-b8bb-9a6a33b0d367", "value": "T12EC4121436A49E62D06E1F7C4830185173F1A993BC97F3A42DC5B0EF29A97A5C703ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221538, "uuid": "cd4f3149-4a38-4afd-b77f-3b0912c8b875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221538, "uuid": "51487049-24b5-42ee-baf1-924538b442b3", "value": "12288:KFWAqg5lUXBWHGcoBNtodpctsMHzkcrCELW2cEbNQwUPFpDbp:46iYWHlYtzxrCELWbEpQwqPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221538, "uuid": "f165b797-a4a9-43ea-b96f-3c7e260315c2", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221538, "uuid": "6953f93b-d412-4f51-af08-005b8c896f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221538, "uuid": "2bb87663-26ac-470c-ab94-778ae1e23d6a", "value": "RFQ#AP-68523_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f976b4-577f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1695191512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191512, "uuid": "bd5d5fb6-b75b-4098-9c8b-bb686898997e", "comment": "Malware payload (DarkTortilla)", "value": "915024b904d5e6ba6878cb70dbc400fc", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191512, "uuid": "b88a37fe-4e8e-414f-b09f-f1e59185e606", "comment": "Malware payload (DarkTortilla)", "value": "be1cdf162c0ecc91e2941464e1437b77a51cc13dd9aeb33db80cb345d0376820", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191512, "uuid": "7b66c63b-3bcc-4cea-a990-8903afb9f9d0", "comment": "Malware payload (DarkTortilla)", "value": "21b77db19dd851c16408648c20b6677b4a1577a9", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191512, "uuid": "d2c0e8f3-a253-4480-8669-d171947ee5dd", "comment": "Malware payload (DarkTortilla)", "value": "1f87bc11fe1bc93e022caf2cffd375cc3094387acd38fb10b088a3cab859b30b445e854a4cd7a0a08f8b1f3ebb5411a1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191512, "uuid": "620bab21-d7a8-43f5-a16f-ee2bfde89dfd", "value": "T11425F161F7D06591C31ECD35CA123B5493B0986A5B01F32D6DC937EA03A170BBE9B19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191512, "uuid": "78f263ef-b66c-4bfd-9513-942528282af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191512, "uuid": "b55172ee-783a-4990-be0d-995c8fdf7d03", "value": "24576:wxbClnSt4P2nL0fQ8B3axWSyU0ZY02EG5L:GClnYlL0fQ8haxWSybZH2E2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695191512, "uuid": "9f4c531a-5b4f-4560-9973-8c81fc6a61b9", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695191512, "uuid": "9bc32912-1f73-43ca-b680-b904428c52c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191512, "uuid": "c260353e-de93-4413-9c9e-cedd0af5f696", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ddf21f-57be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695218495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218495, "uuid": "355c470d-4634-41b2-97c0-d728b89b9b57", "comment": "Malware payload (Stealc)", "value": "307c1561450e05b4f89f4fdb2725cc15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218495, "uuid": "15f319b4-656c-48cd-8152-f2001e889454", "comment": "Malware payload (Stealc)", "value": "be5b835367689df1b7766dea5c2e06c74217b756b350663fb85a48fb998ccc3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218495, "uuid": "e9f66f90-dbea-495f-8a9b-f2b69b60eebc", "comment": "Malware payload (Stealc)", "value": "338b364fd1f8a2057e56cd0abfe736b260e66540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218495, "uuid": "6d802a62-0cbc-43c1-8965-9c655a408e98", "comment": "Malware payload (Stealc)", "value": "794bd8470d822f173c53bbb8636fdc2c1bd94ce537d6dada9c323885932f3d7b0b8073973dc386a709b95395040c796b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218495, "uuid": "a4b56643-7358-4d32-b938-89e45b08475d", "value": "T1D424D02139E2D472D9AB85314830CBA03A7FBC33667588573F642BBF6D312C15B66B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218495, "uuid": "012a6f2b-accd-4155-8a24-e404042f8f8e", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218495, "uuid": "e9a7c0b6-49c0-4822-a89b-74a74f6112bb", "value": "3072:bXtCrbGmbV14qsaq0OoYx7C6zil14vuTXM4IDlQ5JvjToP:zsrSeV14R90SFil14vUYDlAvjTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695218495, "uuid": "6b1e7ce9-6d02-418f-a2c5-a22d4e3f2a83", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695218495, "uuid": "c88af22c-903e-4084-aa8f-1c4c17995224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218495, "uuid": "c96018ed-0290-42cc-b2e3-095415a0329e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f74307-57a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695208165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208165, "uuid": "6927c485-f2ed-49e2-a466-8629907c3a43", "comment": "Malware payload (RedLineStealer)", "value": "b9460a40220f637e6b14091fb3d04c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208165, "uuid": "a9fb7107-f05c-41b2-a0d0-d7179adf5a53", "comment": "Malware payload (RedLineStealer)", "value": "be7f7cad13d7b9f6ca0519f08d8f729deaf721d0d72e28b629a04850375fc202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208165, "uuid": "9b12b76a-8121-4d28-80b8-6dd8c136892a", "comment": "Malware payload (RedLineStealer)", "value": "17fdc5a0000737a7483eaa4c99e2a5bddb144188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695208165, "uuid": "b1f185f9-2c1a-4663-bd9d-47b056d4bcc2", "comment": "Malware payload (RedLineStealer)", "value": "fa758f24f90d75b1b024cd2bec11348680f22b802d80c5e18d52461da2afebf0585d1551346257bee295d4f82bb9ca67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208165, "uuid": "aa4d53fa-0c63-46e9-8def-c32a66c5b180", "value": "T1F0652362EBE4C473CDB513708CFF008B17363C525ABEB6BF654458DD1A622806A3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208165, "uuid": "d2fab9f7-2a2f-4a81-a9cf-98c07f2a20d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208165, "uuid": "cceb551c-3073-466c-8643-1a631115f152", "value": "24576:ayO5xMZ/d4E29A8LjsyTg8Pk5MBVykHRResb5Z1W4ufjRJocCUmA4lPaC+:hOUZyEmLgP8c5MryqksNZuftJocqAyPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695208165, "uuid": "8dd9abe5-f879-413e-b314-d251193abb95", "value": 1436160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695208165, "uuid": "b42d1088-604e-4850-860f-d286197c10a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695208165, "uuid": "68646fdd-887e-451c-a86b-94a6c2b825d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df80fd35-57b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695212767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212767, "uuid": "a7cb86f5-f889-42d3-a30a-edab0dec4851", "comment": "Malware payload", "value": "7986e5ad3d168b3118b418e5fecc9163", "object_relation": "md5", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212767, "uuid": "5343678b-c390-493f-a484-30a62e5ccd14", "comment": "Malware payload", "value": "bf1def4e95e356aade68248de5f7eac115ab245a4c35ed38111d013d4b3e59b8", "object_relation": "sha256", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212767, "uuid": "a3e95e29-64fe-4e9f-bf7a-61f64affce4e", "comment": "Malware payload", "value": "3370efe09d6a05c0b472606c8ca5d50cda5883a9", "object_relation": "sha1", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212767, "uuid": "c2f60159-ee8c-4b0a-8f0c-0810ee49cf81", "comment": "Malware payload", "value": "d261bfaa6ae69541afc966922f91cf7c22c73c22cb048f024d43f4c4291acab9e3da65d3178dd75fb934cb341a2f0995", "object_relation": "sha3-384", "Tag": [ { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212767, "uuid": "2b900eb7-6949-4282-aac6-cca20ec76b6a", "value": "T1EC3412302BB5FCCB8988523D783F6BE59AD41CB2839CA9069E3CF279D53716127056E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212767, "uuid": "10c3fa61-3af5-4d64-baed-8024d2d9fff8", "value": "6144:6C1BsGPN/+XDUFZVhhv13wa92cJ3X9C2eBEe8sulTI:6C1BH+XDCLWa9zJ3qK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695212767, "uuid": "b4c3db28-3dd2-4e59-b999-d42398594414", "value": 244288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695212767, "uuid": "dd84285e-4172-42e2-bb95-ca443b32ab07", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212767, "uuid": "6f165db6-8b76-47be-807e-3570a0266234", "value": "PloNsIWjhuKj189.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22598c4d-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229200, "uuid": "df37fecc-e466-4694-9ab7-2f5cdc5366af", "comment": "Malware payload", "value": "dc6b0ccde40cee7b2b7bcdd0785b4298", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229200, "uuid": "53c88848-51e6-4ea5-810f-8a7b73a767f6", "comment": "Malware payload", "value": "bf9b17d5a71abbc55534108a118bc82a8d20719537fe3810e9d71d2a7fb18c0f", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229200, "uuid": "dabb8666-14e8-4198-9cfc-481ae851d623", "comment": "Malware payload", "value": "10ea6a9a3631f8210c399cf4e1b9c5f1a7af5ba9", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229200, "uuid": "c2e321f3-d8a1-4410-8659-f944443d882f", "comment": "Malware payload", "value": "3a70f80acfbcec49f50e785a1da48e98049d1964edd06b92d4d47c6bb0ecf11cc42c4e9464baf1e2295e144733e9244a", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229200, "uuid": "ce99974b-3158-40c8-8479-0f4a43423350", "value": "T199F2D09CCABE103FCA79647DC85D8CE9A68F206D429278AA20D4F5CC53B53CB524F649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229200, "uuid": "95efeb45-a01c-4ac7-a971-c474e83eec82", "value": "768:Jvm6R2fmOsJcjk6CXyL8ImELiyGVoe6FEUN7fL:M6RoA6LL/LibVuhjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229200, "uuid": "283a8083-084a-49ff-bc20-927e06ad0ebf", "value": 35346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229200, "uuid": "f93ba884-3a66-4937-8bf5-c49712043184", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229200, "uuid": "44168097-bc02-4f75-84d4-fbb1a31b09f8", "value": "LATE.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d829c050-57d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695226498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226498, "uuid": "1beba86e-7473-4449-ade8-c88149287f45", "comment": "Malware payload", "value": "ae8b975a75df6ed7d55f9d6862ae9380", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226498, "uuid": "4483b7c6-c44b-4048-a2ca-dac5f4feea92", "comment": "Malware payload", "value": "c15b8217c84075c347eab98dae3157d79949b4a65d345424ce5d4c53e280ee8b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226498, "uuid": "8b09c31e-0fe6-4152-ba68-3ac40bfd89e9", "comment": "Malware payload", "value": "693a7a94f7ceab16e99d642f313e508a09c93833", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226498, "uuid": "7b98c9cc-b871-4238-b0bc-b22969230301", "comment": "Malware payload", "value": "121d9284327ef038b341f0fb5a1545dc6a898a829aec1934581533dfcce8d520e1690425e80f1ecb46b4ead25d924e2b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226498, "uuid": "12f8ade1-1f11-46df-915b-bf54dcbf6dbf", "value": "T1A82523D19DA18FB8054C893D217E7BEED662AEB5401DC8D7F28019CC60FEA45439F86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226498, "uuid": "dc3c8527-791e-496c-a9a2-f2134009a18a", "value": "24576:XZfX3Jblr32B78/PvS9Sji09kpMSBG7BVdwtUVhBMzNQoAzw:d5bjKGaj+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695226498, "uuid": "2f3185a9-1187-452d-9e91-c6603067bfdd", "value": 979710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695226498, "uuid": "ee465cfc-1b07-4def-9b32-2dd132d4f00c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226498, "uuid": "177b2cd3-6de2-4e31-9b96-dd1d5832a35d", "value": "Yuwfuwlhb.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8e5461-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229081, "uuid": "bcddb57c-19c7-4285-9e20-7ef095dc26fa", "comment": "Malware payload", "value": "52c1493d4b7307ab4ecf1660ef7f049d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229081, "uuid": "55e3ef1f-ef0d-496d-9107-1dfa47a77811", "comment": "Malware payload", "value": "c160b31fcb8ecf9cf6d306d0dafc5ddf0ea16ff502b6125c703712d5169a6270", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229081, "uuid": "cb7664d5-38fd-48a2-b795-78d1c61537d4", "comment": "Malware payload", "value": "cf4e536fda868cd001f45d4d61a488aebdf94325", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229081, "uuid": "05297eda-9e57-4806-8467-07e0542b964b", "comment": "Malware payload", "value": "bd6788e8ffc15e1ef96e87d8bc73bc1f8872998cd6965c8bbc48e176729d21a5ffb5721825e2df9e1e5a0bc80ea0a77c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229081, "uuid": "1eb45a69-1433-4fca-bb3d-35fd34011985", "value": "T181B33DA8BFE6D5122A0DB3B7C4470768F11FF26D10F631EA281DB6183B192586B57837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229081, "uuid": "ed35dbbf-ce8a-4584-ad5d-596393aed873", "value": "1536:iYdHh7wdKWHpaQc9+/+kD/5lkNuLggiHQH:bxh7XqwImYy2gdHQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229081, "uuid": "843b0fb7-ef2a-41a3-8321-3c8ec63c3057", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229081, "uuid": "69acdfb5-a13a-4a94-bdad-2a6cfe022fa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229081, "uuid": "f4d6784f-3e30-4672-bea7-b54a57cfae63", "value": "Document (Purchase Order) PO23IMD43505 pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b83c856-580d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695252435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695252435, "uuid": "0f5352cd-ea18-41a4-92d8-1eb5d92c7387", "comment": "Malware payload", "value": "1b876d18d9e72e5b03c40da7ad509059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695252435, "uuid": "1eb91fbd-b763-476a-be0b-ff321902d9cb", "comment": "Malware payload", "value": "c24740dcd219e014f566641c26b8b67864156d4e915867fa37d93d0b514f871a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695252435, "uuid": "462cd2c8-8c0a-4b24-af16-8c38b304d752", "comment": "Malware payload", "value": "ab1643e83840c26f93a90cad0dcc4dfd580bdf30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695252435, "uuid": "a1825d71-8b81-4658-9e0f-4374e34dfef4", "comment": "Malware payload", "value": "027ac34360f9d96803d1d1c110f4ef9d5f10c6eeb502ad59bb52e1f166ae323817be8c8120498f6e0fa45eb8a9a18468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695252435, "uuid": "a1ca0759-b2b3-402f-9cfe-14154b36b9a8", "value": "T1EA552347B3D99422E8B02FB05CF30AD36633BC35AA38475B67A0DC5E1C722A49C75366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695252435, "uuid": "4407c58e-0f84-4252-9e29-62f79ef20365", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695252435, "uuid": "4e760917-f8ba-48e8-8421-c5aad4606e7e", "value": "24576:ZyVwLs0MAnC1UckHU3AhYNX30BSuPO2w+xw7FbWSzc//kf9H15J:MVwLdlnCsU3Ai1OS7iu94/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695252435, "uuid": "3a3cbcee-2b0a-484f-9fe9-b002dbd5ed09", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695252435, "uuid": "cfeeca06-f980-4f2c-bc6d-c0da4873756f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695252435, "uuid": "daa49d01-3f92-4be1-b33c-ff8eada76b09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a815e6-5753-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695172785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172785, "uuid": "ca541007-7aa3-4e03-9167-284c3cdab87a", "comment": "Malware payload (RedLineStealer)", "value": "069d8d5f7354818e95d5e64fb362540f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172785, "uuid": "c165a87d-e627-4a56-a116-b2a05fec9030", "comment": "Malware payload (RedLineStealer)", "value": "c250df9fe08d7917f7c944a1a3b73d04e6a09661ca1fe91e84e6bc509bf0711a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172785, "uuid": "f1d40225-9f36-4b0e-b478-80bc98ace489", "comment": "Malware payload (RedLineStealer)", "value": "f4cdbbb8f350adc5c19d0040e3918b0c9997d17a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172785, "uuid": "fe4ce239-9d4e-4ebe-b770-3eec6f3987b4", "comment": "Malware payload (RedLineStealer)", "value": "038bc7726abb13a8aecb299bc43b5557f306592d10dd0b01e4d5bea0c4afd6a744ad94b953416f1afb8bee8c7592e269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172785, "uuid": "c83ace8f-584b-4809-b81c-2d6eddb71207", "value": "T19C85334167E95133D9A117B019FF439317393CA61938667A362AB40C1DB3AF0E936BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172785, "uuid": "8f86aa46-52eb-425b-9106-19998e5ac75e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172785, "uuid": "3db9e87c-8810-4491-94c9-0c9dd4e00ced", "value": "24576:uyec0nZn35qoVeFDRTAbxIxNFiQpDH7b4is3LoVBAW7wr6RDg1UdAZTktZCi1r:9en/qoVeF9MxIxhdYSVWQwGgbkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695172785, "uuid": "d50313b8-2a2a-45fb-953f-937a80522130", "value": 1709568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695172785, "uuid": "59032fa3-8184-48ab-9d55-c3aa1dfb9076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172785, "uuid": "a1a590c1-87ef-47d8-9c19-fcb956bffff2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7eaaf4-57ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695211206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211206, "uuid": "69b63aa6-ae5b-43ee-9216-2a495c92ae2b", "comment": "Malware payload (GuLoader)", "value": "699c8c9ed29350ca65761e4acca4e8e3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211206, "uuid": "c43b818a-dc01-4015-998e-28c060daa04f", "comment": "Malware payload (GuLoader)", "value": "c2bdb8031870d4c83ea3e79725fef2419b3f3ba6c9410a1152d86d6c195b29b2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211206, "uuid": "a2a93055-bddf-4fae-8633-0506efef7a86", "comment": "Malware payload (GuLoader)", "value": "68a54b2b527407f5712b68fb4c1f87a193e96d85", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695211206, "uuid": "ce8f1025-cc03-4fac-a016-8336e1d902c3", "comment": "Malware payload (GuLoader)", "value": "293b21da434a53af25a1589e294b0924b93bb7b66e1c76a80d25b06cd554311bfb00fdfd95160a817fbc41e626d18520", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "stephenmichaelsmith-com", "colour": "#4274FD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211206, "uuid": "69deee54-d84b-4b1d-a639-9cc18ca82c36", "value": "T19B032861C6C61A384A4B1BEEEF01A542C9FE853A832A801DF65C17AE615385CC77FF5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211206, "uuid": "97fe2a1e-55bf-4fc7-9840-2422e9b564f1", "value": "768:corMtwTVlHPwlR5EQi/GoRGRgg0we2mkcp6ogzAiPhySG0GCG8x:coQqPwN6GoRGRgpr2m76ogkiIB7Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695211206, "uuid": "cd04c562-f84b-461d-9db3-a66f59573b8a", "value": 41373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695211206, "uuid": "549d793d-baa8-44ef-850a-fe9769ecea2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695211206, "uuid": "d3c07ad9-36a7-48dd-94c7-8ce010011f55", "value": "PO#0200923 pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04de54a-5769-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695182166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182166, "uuid": "8c0c2714-0a29-499f-ada7-05ecff479a6b", "comment": "Malware payload (RedLineStealer)", "value": "776aba268b8e954b840024c49c146581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182166, "uuid": "fc0950bc-ed28-4446-9812-a67b4fb3eb64", "comment": "Malware payload (RedLineStealer)", "value": "c34111844b4966557dcba6e80b4a175e4c63eeb319266f545b71f9e5894df60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182166, "uuid": "12f6e3d9-0e14-40ca-9569-ca7ba4b19b76", "comment": "Malware payload (RedLineStealer)", "value": "1b52bcc85b507748b68b543628ee6deba0bacc94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695182166, "uuid": "bb42f0b9-cbfb-49f4-b249-a9b04d3889f5", "comment": "Malware payload (RedLineStealer)", "value": "7cb7a8401e2eb2015e98e9d4cd112e26800ed743f484f5730555c7918befda74e5d6260fcb7a84e97744078955a1f830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182166, "uuid": "1e1ed1c9-2825-4083-8333-4ac2cac8e817", "value": "T16B94F122B692C072E49346714534C3911E7FBC32667852DB77743B3E2EA42C19E7B36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182166, "uuid": "8a81d4c1-4ed4-4d2e-8834-0cbe103e16fd", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182166, "uuid": "97e339bf-8bd7-4d67-9c22-a227243266d4", "value": "6144:fCrXra59R65KTy46aQ3QAs1nv3nODp4IgU7MQFDUDkz2Qsy:fCrbavGSy4fIQJcDC3UoQFDykv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695182166, "uuid": "83fb90db-6a3d-4fef-b017-5d9aa1769405", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695182166, "uuid": "1fb82296-e619-49ac-82bd-57c456506798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695182166, "uuid": "9a53b72d-00b6-497c-8ef6-093de2c2cbfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dd8677-57d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695226420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226420, "uuid": "2dec3bbb-9288-424c-abf6-efbad36f3d69", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "133fa84fc38c4a7895be8a11fdea3ac8", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226420, "uuid": "0a19df3f-d596-482b-be1a-6d4f1422a72a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c42e89949ac278bf2916deaa17db98c8de5bec75f2cdcec668539c965332adbe", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226420, "uuid": "6ecd5f2a-e325-47d1-bd8a-34fadd265baa", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c947259776d97719e4c7145ca39a26f06fb9d36d", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226420, "uuid": "408e211e-6fd2-4409-b9f5-e3a047b8726e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a7e5c23b758815637c260448ccb1dc891d10b280dba04aa84ab318eeb3a6a35efc7a082482a251d6251e9afc1f43d26d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226420, "uuid": "e3db5171-f353-4eb7-aa0e-e37b757b40d6", "value": "T13D24D0217DA2D471D4A781308834CBA46ABFB873D7B5894B3394AFAF6E703C16761346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226420, "uuid": "61f28dcf-704e-417c-bcb4-d70795ce2579", "value": "f441e1f89e815eda74d641cd1f758949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226420, "uuid": "21481ccc-a507-427f-9e2f-9f7fb1202c98", "value": "3072:DX2kXdGfYZeXzw8sZHX5o64A+M5zeWx70rouOr5JU8TfEif3:79NZZeX88SJouzeq0rotU8Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695226420, "uuid": "f141b022-16c4-4ab7-a0f8-7cd1d53a18df", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695226420, "uuid": "52a91460-ced9-46aa-947e-248f28792862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226420, "uuid": "6dd6446e-c862-4482-8818-fdbff385e826", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00798c91-5757-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695174167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695174167, "uuid": "bade720c-5536-4113-a241-df28abec2da7", "comment": "Malware payload (RedLineStealer)", "value": "9277e31ac0b678af7820b19dbc749e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695174167, "uuid": "25872614-61eb-443e-ad60-65cc99874ff9", "comment": "Malware payload (RedLineStealer)", "value": "c49f023dfeb93ace97b6827d576eb0e171851e33c8e97b31269e3f66958fc8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695174167, "uuid": "5097cca0-f73b-4216-8f42-6c73726da52d", "comment": "Malware payload (RedLineStealer)", "value": "294a8fd3d1e347ea9246aa0ce3ebde243ef5dbb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695174167, "uuid": "28c9c5cd-150c-4e1d-a844-1f5be40add43", "comment": "Malware payload (RedLineStealer)", "value": "915d36cb166c64004eeab17c83d2ab9fc162b0da7e8711bc204d390466a21d317c2388ac9d609f1c3ec8cd3ec519d241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695174167, "uuid": "bb1241e3-e339-432b-b60f-9574af199a43", "value": "T1256523422BD89031DDB12BB06CFA179719397CF24D7883732746D96B0C736E46931BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695174167, "uuid": "148df41d-67b6-4cee-b383-22140e3049e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695174167, "uuid": "a6dfd72d-83f3-4614-953a-eb4fa3e942e9", "value": "24576:MydUVqj1xiJbVZaTelA7lLgiEK2kA0sKCuCVBctcNBiucEH94g:7kQItyelQ5EKzz0b5i1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695174167, "uuid": "ced2e7db-435e-43e8-b750-590e3811dcae", "value": 1467392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695174167, "uuid": "f98bf6b6-b39b-4bd7-8a93-8b860f745ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695174167, "uuid": "a7c2f734-8a0a-4b2a-a8f3-f062ea512922", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3978ad19-57cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695225802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225802, "uuid": "858693b8-6311-45b1-ad21-93966bceff06", "comment": "Malware payload (Mirai)", "value": "524ab38c38ce60b3b112ba9c24147125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225802, "uuid": "0bcb7b04-6471-484c-ba91-a1c187ec006e", "comment": "Malware payload (Mirai)", "value": "c4d46b7a2111609c29d384875eea66f5a0ebbaab812e8ba27f31432ca4349051", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225802, "uuid": "610eeab4-de73-4fb0-8a9b-daff0baeff69", "comment": "Malware payload (Mirai)", "value": "3638bcffb3d14b0f2c3165a83d9a5dbef40a058e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225802, "uuid": "6f796277-43a0-48fa-b3de-62d771d1c5dd", "comment": "Malware payload (Mirai)", "value": "e8537cb5f22b969fdf493bb81c9c661bf755a2ae7b872d510ed4d5a8d58a9be3d9790b5297a92195f089edb7e8807fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225802, "uuid": "8f6725df-1ca6-4f7c-b453-3c04d6ca13fb", "value": "T1F1C2E174739D580EC06D813F03A552B283BCBD1EFF8486826B5699B4D9823354EB88F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225802, "uuid": "761640e6-1a17-47ef-9b72-52bf3774f33d", "value": "768:6kbASy5MKFgdD7Ityb7KW4SkkvznmonOMWS:dcSvTnbH4ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695225802, "uuid": "779e141c-21d0-49c4-bd3b-203f4da68d0d", "value": 27316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695225802, "uuid": "a9b7b115-d843-4dda-b351-d1f1a56f8843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225802, "uuid": "13be3789-fd1d-4a1b-b19d-6e41e123fba5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ac0f73-5786-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695194518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194518, "uuid": "1ec0930a-69f2-4dc6-b2d8-5d9cc4014670", "comment": "Malware payload", "value": "e5bb739fcbaf947852d96f768e6ef83c", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194518, "uuid": "e432a93c-01bd-4342-9b8d-b892c1bf40f1", "comment": "Malware payload", "value": "c600fab7b32c6c108dad586fce3e15cf04274d8c14c45cbf3783a290a447d6b0", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194518, "uuid": "6efb9199-422f-4f3e-98f2-260c23b327fb", "comment": "Malware payload", "value": "8d2c3817f61a706e4820659614657dbb4aba2df7", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194518, "uuid": "f85216c9-738f-4b6c-856d-77443ef1f28b", "comment": "Malware payload", "value": "43ec6dc2dd09e549c64e73f643e02bfac4989ce134cf04da3508db511284c98cbc373298930a9a8a537b7f541db76420", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194518, "uuid": "fd3ec6bb-ce15-41de-a147-6fcd98cba39c", "value": "T1A9C2D07FA3056E11D17BA0FCC26408F8304E9635EA4AF99E6CA4FE6012551D3432FAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194518, "uuid": "605b78c5-139c-4f0d-bc3b-098546cc60a0", "value": "768:J8VBPTfpn7GXy6dMR90KVIKiDx1oprikXeGm:J8zrp7GXHKR9VPLFXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194518, "uuid": "823ca1d6-c485-458d-a35f-4a15f73d8361", "value": 25979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194518, "uuid": "11ea60cf-70bf-444f-8c2d-4568649b6b95", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194518, "uuid": "9decc639-d257-4125-b651-91247acd5c7f", "value": "microsoft_office_excel_worksheet1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f245271e-57b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1695214516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214516, "uuid": "f8b6bb7b-fe22-43c4-867a-c209d699a9eb", "comment": "Malware payload (DCRat)", "value": "12a23b1aca8967581c181de6f9e1b26f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214516, "uuid": "d9a94eea-b2b0-4c61-82df-eacc918724d0", "comment": "Malware payload (DCRat)", "value": "c606d2754a716b12da08782bccc728476b71505df9dbda63fb09742e0a065d64", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214516, "uuid": "43bac20e-0c74-460f-8381-7ef98450d439", "comment": "Malware payload (DCRat)", "value": "2d3ce03db5055cd44afa433b4642aaaa52eb1189", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695214516, "uuid": "be224e26-0684-43a9-b361-db8519d05ec0", "comment": "Malware payload (DCRat)", "value": "79cbede1f7125e961658aa578ce0a36473d53bbc684e48d809ed8b8ab0046c466ddfb7e4bbfca302a99d249b1a42517c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214516, "uuid": "ea160b05-a640-40a4-b467-40612cc5ee69", "value": "T1FA4549027E44CA89F0095673C1DF420847B5D9516AA6E32BBDBB73BE15123A73C1E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214516, "uuid": "3369b08f-b3a9-4e8a-83de-ea9f09c7c55f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214516, "uuid": "336ba760-532c-41b3-9f80-6f509dc6926a", "value": "12288:AlyjJorbX7lFyeekpCtq98qWmzAhzm6MOCOxOe+/3I0bmT+7KTyR/aE2+2sMmVlW:PebX3deV6oZHOFfWc4W2B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695214516, "uuid": "1768a421-e5e4-465e-b438-9ce126748eca", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695214516, "uuid": "304b9566-6c7d-45c6-b44f-7a7afcf2d4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695214516, "uuid": "0249b984-f330-4147-80ec-dbc347d5caad", "value": "servercrt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fdcfed-57e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695236203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236203, "uuid": "851ca1fe-8bcd-4272-97c2-287d9a7b4440", "comment": "Malware payload", "value": "8ac9ece7b02943e19c179fe991cf3974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236203, "uuid": "d8a7f8bf-062f-4014-891f-1c370b409cf9", "comment": "Malware payload", "value": "c67adf05e1ee2d42432cdaae69285693fbd425cabba14d698f4fb456c5ecfc50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236203, "uuid": "c66b176c-d8ac-4540-9f71-b3474689f91a", "comment": "Malware payload", "value": "329dc346a02f77ac67ce2a06e9fa9e111f0e9f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236203, "uuid": "2eea173d-aa71-42a8-af6f-e6f35d7d9d7c", "comment": "Malware payload", "value": "4f9c846743b4cd7b3d402fde46023d1db40c6ba596095cfd1146942f2c17ec20f1fadcf3deb8d07f0f9f081609495ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236203, "uuid": "1866df55-922d-4bd8-b051-0f1cdfc19ddc", "value": "T172438D11B7A0C427E5F60F314A7697E75FB6F81054209B476B80AF1E7C32690ED2EB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236203, "uuid": "4ad7a324-49f6-4deb-9883-cf62cea369e2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236203, "uuid": "466a8903-e926-4820-b0f8-134711ecf6b2", "value": "1536:B+nQc1w4vuFv0hEe2+bO0DEtaub4Romu/TEoki7Z:cn77v00hEoDEtaub45o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695236203, "uuid": "80f0ab20-4d27-4e5a-9449-dc5ce71e73c9", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695236203, "uuid": "5306336c-ec16-4ac7-9ed2-6376586c8150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236203, "uuid": "b2d29772-3fe0-4f4b-a16b-66f3067050f8", "value": "recibo-332882139_57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c53aae-579c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695204128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695204128, "uuid": "924d22be-8986-48d7-b98e-d97fe218c39b", "comment": "Malware payload (RedLineStealer)", "value": "40f341fa54f5ea1bce347b4a21eb9fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695204128, "uuid": "5dd1c6e1-14a5-4f69-9909-b070cab8eaca", "comment": "Malware payload (RedLineStealer)", "value": "c67d184ebb311b03e899221b24fb4dcef5f1473c17d9595d8f341eb86151f97a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695204128, "uuid": "916d45fd-3ddd-4b58-82e9-f8ffecd91b1e", "comment": "Malware payload (RedLineStealer)", "value": "11c6241502c7a6a5beabb263392a39dd33d26132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695204128, "uuid": "4c110945-00df-4d63-8a29-c346d680077a", "comment": "Malware payload (RedLineStealer)", "value": "08b1a21a89eedd7c1a12fbcd775c759244fea25755014f0c7f9b7204fa57e6fb591612092caba5ec10179695555e35f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695204128, "uuid": "7b1030ee-8df2-443a-8d9e-a7f8caffdced", "value": "T12084F11174A0C0B2D2A54179886EDBF4BA7BBC765D354E8737842BAE2E353D3AB15303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695204128, "uuid": "e99a9c0d-06c4-436b-8af1-96c9cc055d81", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695204128, "uuid": "5e65c276-666a-47ea-b488-70f515c4c07e", "value": "6144:BiOorse7jZzgm0vJHzfLNne2A54ofzknX3JruKI7v8Pyijcs7JT:IZIe7j130vFrxe2AuofzoRIz8Pz7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695204128, "uuid": "a6852672-8409-45e9-a537-03c6001729a0", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695204128, "uuid": "95a07c44-a387-428b-801a-a91ad0c081e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695204128, "uuid": "bd103916-3e3c-4272-a526-bf8a35429801", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c5544e-57cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1695224236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224236, "uuid": "5fb26e27-f2a8-4f36-b239-700807e426bd", "comment": "Malware payload (MarsStealer)", "value": "bc3cbd915ff8541d550a7a389cd7716a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224236, "uuid": "5fca67fd-0884-474d-ad03-6d71ab09af2a", "comment": "Malware payload (MarsStealer)", "value": "c81fa46b63a77fcabb07e917378f7df25757a771ff3d4d3c2f789d17107836b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224236, "uuid": "aae2fb4a-ae1a-43ae-a83d-6d04114050d5", "comment": "Malware payload (MarsStealer)", "value": "db5215e8890f726c7d0688504cc7771c936c18e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224236, "uuid": "b02c9496-16ba-4bd4-b3f8-ba40ab800d82", "comment": "Malware payload (MarsStealer)", "value": "b5ed8efda2fb7253eec25522bd848808dfdb56ffabcd5adb306f75ba3170f23cee9368b9d0c2fb13a42c3e23de68fed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224236, "uuid": "c35924d8-3c10-465d-b58f-e1ef8fab34a1", "value": "T1FD24D02175A2C072C5A785344C38DBD0697FBC335679899B33A43FBEAE313916B62316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224236, "uuid": "0ae05f57-7bd9-4f81-977a-ff85d971e5f0", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224236, "uuid": "e0840130-450b-4203-acaa-25d17a7042c2", "value": "3072:JXtSanqKBzFBjlMqZNARKo1cDEDg0kseF3l5JgU3Tog:twgnBzF4q/41UcgseFhgU3TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695224236, "uuid": "167e3e5a-9502-480b-858f-1f60aa469bd2", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695224236, "uuid": "a5b68f70-1d4d-4a5b-9071-141535bb77c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224236, "uuid": "378aca33-9b76-4aa7-9b8a-77d774db7ae8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661a86d3-5753-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695172620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172620, "uuid": "0a3ba82c-2c61-4a22-bd9f-d2b6eb5bd684", "comment": "Malware payload (MysticStealer)", "value": "5a7cad52183f52612b8d9e94521709ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172620, "uuid": "a9c7be7b-dfaa-4fef-be6d-4f76cf2d2c9c", "comment": "Malware payload (MysticStealer)", "value": "c857c6583fbd82b7df9f633fb345bb859a5fb7911a8564a07a0449148b9c9869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172620, "uuid": "9f3247ab-62b9-468d-a35a-9e9f5a2b39fb", "comment": "Malware payload (MysticStealer)", "value": "811cbeba4e12034337d4d80343f8e26741a7e3fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695172620, "uuid": "46799db7-35bf-4b38-8e89-2c472f1e887b", "comment": "Malware payload (MysticStealer)", "value": "f8b356fe3273dba8bd289e08fde56b50405050473e9d0ca42f20296e416dbae798478c7673902426ec6c0a857f5f0b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172620, "uuid": "7fe49699-864a-4439-9238-47c41b671d95", "value": "T1A2F39D41F7D28072C47714350AF0B3709EBE7AA046E98DAF5FD40F7E4F215A892359AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172620, "uuid": "33591c41-66c2-4bc5-8698-51cc2a80bc8e", "value": "7a83bc8f14d32c8af61627070a00e36a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172620, "uuid": "ed28ad15-9271-45e9-94e8-97f19e851e51", "value": "3072:BkcCnOhy5t4nI5Qdxl2Wbyl35JL6cTQ+QrX3JeMp1EPmCvPbZRi8A:kOhy0xoW+3C+Y5eSSPFRi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695172620, "uuid": "a534d912-d063-4081-97a8-89dd76f8794e", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695172620, "uuid": "da963785-75a5-4723-b452-dd7d8d0cf66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695172620, "uuid": "b603a8a4-8fe3-40b5-aff4-d31c0f09d797", "value": "dump_curved.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46da61c-5751-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695171973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171973, "uuid": "7407b2b2-8c19-4d50-bd15-e4cc31c1df35", "comment": "Malware payload (RedLineStealer)", "value": "13a8b948a7d9d4afdb272d809e7459b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171973, "uuid": "3c889444-fa3b-4fe4-89ac-0e77f6c9996c", "comment": "Malware payload (RedLineStealer)", "value": "c8ad50ee532a819d118a331f7b452cb698fd24cc42c9edbba2d364cc492f9ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171973, "uuid": "f49d1a3f-4811-468e-bb2f-21f2b346bbe1", "comment": "Malware payload (RedLineStealer)", "value": "09c705e60bf3b7bb60c6ef10884db1743cb36e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695171973, "uuid": "b24b903b-c687-46a7-9f6a-b5ba2fbec054", "comment": "Malware payload (RedLineStealer)", "value": "980d2d57709686360f2276f601266fbe150f801af17d65c337a02b9a91a72465ad8be7d24e819b1170ff9a1235a8c54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171973, "uuid": "fc4675f1-3a10-43a0-a811-04630bf9c782", "value": "T1E8940131B793D033E09355316476D6703A7B78326AB4849B37C4AB3D6EB42C19ABA353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171973, "uuid": "0809c622-febc-4c80-9471-d1f750c02ad5", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171973, "uuid": "33bb0f95-b959-4790-be2b-8a82a27fcca3", "value": "6144:B/rnra9yR6rKs5sVPRygnfT8hIwuDPjb2KyQojmRqvmnE2P+cHAHcMdG78:B/rraEsl2P1n8IwMbKmqmn9+cHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695171973, "uuid": "6f1aec6b-5ffd-4b69-bb88-fb53f5e17f11", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695171973, "uuid": "99e1d03c-49fe-4c13-82f4-4e6d0446c08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695171973, "uuid": "a9fcc3c2-6d68-4128-b935-cfe243f9305b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207834e7-57b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695216312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216312, "uuid": "d7daa03f-32b7-43f2-a786-2026f5bacd23", "comment": "Malware payload (AgentTesla)", "value": "adbab90ec4ed7de9cb3109f6e9d97e1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216312, "uuid": "d0ae25e1-9bf0-4e9d-9fe6-75d9ef83a86d", "comment": "Malware payload (AgentTesla)", "value": "ca6bf5e2b44c0d13975103dfe264744e77e92602a7639d4d2c19467f2134fc75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216312, "uuid": "cdd50ae8-bdb9-4386-bc3e-fb5f556db35d", "comment": "Malware payload (AgentTesla)", "value": "bd4ab39a7468ddf7a110ef132232abb6209eba61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216312, "uuid": "00ea9860-2291-459e-9fc6-05790133cbbc", "comment": "Malware payload (AgentTesla)", "value": "e9489695f5829731d617df24944928170f170b29c991376d82142acca8d266598edc375341a5ac63e472d42441033085", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216312, "uuid": "b564c4f1-dd0d-434a-a2cf-77296d933746", "value": "T1EA2523100E35BEDFC7BCF738313B3E0B2AF543A9581859FA0790A488546E587CC5AE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216312, "uuid": "6c490596-7ecb-4a37-8767-518e89b50522", "value": "24576:PUvLX5TvihYk9QCIBrgFo6FedE3OzuDK2dCJ:PI9jqYk9QdlCK2dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216312, "uuid": "369a6f26-b022-4c0d-a794-07203b9c8c5f", "value": 1043312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216312, "uuid": "68ea548d-3ad4-4383-8a3a-923bd7b4b912", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216312, "uuid": "34f54e6f-5ffa-4267-b439-c0efa02109c3", "value": "P.O 2023-039.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a955deca-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241881, "uuid": "aaeaf9b7-1455-4c51-8b32-2078abd1cf19", "comment": "Malware payload", "value": "bdcb667350d2d1e4dd71fbddf78b0f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241881, "uuid": "40b3d59f-b692-4836-bde2-6c7f3d2ec0be", "comment": "Malware payload", "value": "caadb922b4f0c4d16b73a40ad38d2d0e201cd74a00b5bcf33fa12721fb920632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241881, "uuid": "2dac5484-98a9-4ed8-a06e-8df0b52025c1", "comment": "Malware payload", "value": "8eac6d3f9a022a6317bcb36cc7031eb439c0449d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241881, "uuid": "d9500787-4f8e-4477-9432-8d83fd7eb56f", "comment": "Malware payload", "value": "204e16b6b7aa5d2bf09ed51269ca918a7cbfe41953292e748c6276e56e5533e662ac3360706eb8e492a0417f01cf449d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241881, "uuid": "eca2b2e6-fc53-4adc-bbf4-d14ae6cc3b52", "value": "T165663302B14480F0E7ADF6BC5EA2A640435318A91DEC3C2697D4C6DDFDAB1D84DA63DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241881, "uuid": "b1e3b6a5-64b0-4b81-b117-fcaaeeaba34e", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241881, "uuid": "f138ab0f-6b71-4675-a9d1-12dfde53ae99", "value": "196608:gQq0EUEG16AHksUo7CiihFa+hD05vk67ekoRtV2:aOh19HksUoOiihFaSDik67yRtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241881, "uuid": "ef52991c-6951-4ab3-a3b6-9044dc452d20", "value": 7032928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241881, "uuid": "b88b8260-8fae-4038-83d2-d727aeea9907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241881, "uuid": "0053b7b0-63a4-454b-9602-2ea9e0e6d415", "value": "SecuriteInfo.com.Backdoor.Agent.3866.30182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590cdf5a-57b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695215547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215547, "uuid": "b66206eb-c4fd-47ea-97fb-1f6b3b920611", "comment": "Malware payload (AgentTesla)", "value": "c6d4fd1fb18619a4d9f2ea30ceb9ddf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215547, "uuid": "6452851d-4a4a-4d33-baab-eb1866629270", "comment": "Malware payload (AgentTesla)", "value": "cb14301d9cedde41b3f49da3fbae2bb23515bf83efcf31cdb4b96bc28fc991b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215547, "uuid": "35f6358f-b62d-4ae9-8542-d856bf04f3ea", "comment": "Malware payload (AgentTesla)", "value": "d39a7e949a713b11d093dac93d20ad6032f8cce0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215547, "uuid": "6613536c-1a7d-479d-a0bf-d421b91a5b06", "comment": "Malware payload (AgentTesla)", "value": "86e1d1f360ddfcee36705899317a4d690ea9580a9cf5456a0e07a66b977e759c9ccd79afcce5fa7ac2757200c67e2ddf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215547, "uuid": "9f722875-14de-464b-bda2-2d73814b64ea", "value": "T1D2C423AE9F3D3B406A9408BCC5260A7B7FC0D7250327B9DD3AA31759407B776A490E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215547, "uuid": "66ac9a06-e684-47a5-b1ef-a90475a1dd39", "value": "12288:05UH7ryVwoLNfJjB5M+jPccRKmqA39x8NhqWTSQZMdfnJ7aEsg++tnNra:SUuLZ5M+bp44fQhTgBnJ7FDBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215547, "uuid": "5f0e2895-bc0d-4aac-ab70-342d2c4fc820", "value": 593897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215547, "uuid": "4739581d-3a4f-4992-b607-fd625b62a027", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215547, "uuid": "c0b74b5d-7f69-45ff-8a7e-96020cc36052", "value": "PO - 753172 00.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f75114-5781-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695192596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192596, "uuid": "3798cd19-c09e-4343-bedf-e41435323d3b", "comment": "Malware payload (AgentTesla)", "value": "9f80bbe66476971a9d8bf96c01d771e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192596, "uuid": "5d88cad1-1e25-4f6c-8124-3ec0cd96d407", "comment": "Malware payload (AgentTesla)", "value": "cb8994b3961d8007cb410289ee2e686168c1ac8baf10b861e445923c5df1e410", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192596, "uuid": "26b0f9e3-01b8-4a19-b864-7d61339c8387", "comment": "Malware payload (AgentTesla)", "value": "97da6ea882057ef1759811891ac4facf007fa4e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192596, "uuid": "dd4ca276-d887-4964-a2b9-115b12c36f45", "comment": "Malware payload (AgentTesla)", "value": "10f3ae1777130c52606a68d78e16b538d7240e2fb907247b167092639ba95d4ea82e0575a30a781289e662ff33a9d461", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192596, "uuid": "9af19947-96e3-466a-bcec-1fc3c32b7ed3", "value": "T144D4331EB71801A2F0EDC111DC2659E8AAE1036A67BEB98EB14DBC91579F388D7D0C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192596, "uuid": "e08b7235-9bca-4e76-8f76-72d4def07539", "value": "12288:Ov0eddwMVo+tqN/G/5XRcauLQ18M7hY67kUIN1IRGP5Bk9oWelMUAJqD:M0cGMVo2caqnUkUQIcTkoW0MRJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695192596, "uuid": "faa50ebf-b3ae-43eb-bc1b-0432c2fe17b9", "value": 636020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695192596, "uuid": "fd98018c-5273-451c-bf91-2d0e5aa4ae25", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192596, "uuid": "55be634d-388d-4d8f-8046-36fe62f02d71", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33d73ee-578d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695197687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197687, "uuid": "c7388e46-a1ae-46cd-a1bc-a3f3ee645cac", "comment": "Malware payload (AgentTesla)", "value": "9dadfc8f01d8b789ce9267cc188591bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197687, "uuid": "824f0b9d-69f3-4b2f-97dd-231ade945cd8", "comment": "Malware payload (AgentTesla)", "value": "cd49b022411c34b834f765d874611467fe327f58a0d3c83cf33d78fb3989e687", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197687, "uuid": "637ed97d-224a-4d72-a5ee-89f91a7a0905", "comment": "Malware payload (AgentTesla)", "value": "79f2fe21dbd9f4618a60d9421b623b6cfdb6d924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197687, "uuid": "46a314df-35ff-4249-aa33-d0cf2c9c35f1", "comment": "Malware payload (AgentTesla)", "value": "dfaf58a144e4c73ba19b4c317629ce1c3152c36ea3d9a211bdc2b4e9e2c925b22bb19e1fd647d3d30335a8db23ade269", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197687, "uuid": "b20b651f-34b3-46e0-8af6-ca5637b6bf14", "value": "T116D4C01531FF6E46C022FBB50BE8EDBA96DAF1F6121EF73A3F8506424318940DA42975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197687, "uuid": "dee02ba6-c6cc-4cd8-99f3-66ad6c3f14e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197687, "uuid": "4ff13f8e-f227-4475-9695-e50f2f62eefc", "value": "12288:zpUTErRtZC/CY5fdwZ0uYlR8gdV0Vj28EERjnd/gm5TD:NUiZC/CY5f6SHlR8gaj28Dv/gm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197687, "uuid": "14d6e220-96e3-4032-b7c7-4ab442abf70d", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197687, "uuid": "03b8ea9b-0977-40f1-97e6-45cfd9253467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197687, "uuid": "c37a9c31-0d2e-43fb-84fd-09765960377e", "value": "9dadfc8f01d8b789ce9267cc188591bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebaef12b-57b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695215793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215793, "uuid": "108dcd74-d428-4969-a243-e3b79d36a0c4", "comment": "Malware payload (AgentTesla)", "value": "c33a2dbb6676e2a27b1ebdbc94251892", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215793, "uuid": "06debec4-de39-4d72-9991-0e4e25af7f72", "comment": "Malware payload (AgentTesla)", "value": "ce0e3ba378497ad1f62209c0c63bd6d10e2a93648164d49b94dae0264f94ce9a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215793, "uuid": "a72409e3-f687-40f5-ae25-f1b91e48fd89", "comment": "Malware payload (AgentTesla)", "value": "e1439776116b758f0d83556d58c3233bb5fd8294", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215793, "uuid": "1742ed29-7293-4e0c-bc00-18aebbab5a27", "comment": "Malware payload (AgentTesla)", "value": "f6d4ad5eec34dda333739cd2224c44ae6c1d5f8a2737a55a657c2fb7b4e760afdea2f20b4baace9cdb12d2a6a20fa288", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215793, "uuid": "6191a217-f11e-4452-a54f-cf08d9647b1a", "value": "T167C42342CC0A1083AF7C552D9B5168AF0E4CD3B98F63D52113EAEBE66783A1DCDB5871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215793, "uuid": "799c3b3b-9e7f-45f0-a84f-b25f3268c88d", "value": "12288:bCoWCs3nc5DO7CuSBURh5EOibTypjQ5GjMTkq9+zo5VkVh2E5eS:bCoWCs3tcBURhjHg0o5Vgh2EcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215793, "uuid": "dbff708f-a90c-4604-9492-c8b846298cce", "value": 571073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215793, "uuid": "739f7318-0214-4ccd-a4fd-b689718242b2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215793, "uuid": "c24c3c9c-7160-4d40-bf4a-bd7a08e9d03d", "value": "Purchase Order-jiecang Revised.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfca496c-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1695229088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229088, "uuid": "04624248-db0e-42d5-9169-32d53106ab9c", "comment": "Malware payload (GuLoader)", "value": "99d6e04e53a055b08b181cba2c8d463c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229088, "uuid": "c8f6c163-6abc-46a4-ae7d-670a4e65cac2", "comment": "Malware payload (GuLoader)", "value": "ce43181bd1101df491002b4fe79a299bc4b851c7a997531722c6b8de8d6db37e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229088, "uuid": "175a61b8-71ae-4b26-8674-840dc4ec4fc1", "comment": "Malware payload (GuLoader)", "value": "7a0c22d78f4ea83ca24c4cc836eee22abae1dade", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229088, "uuid": "76319314-d90d-4f7e-a060-2e30b93a8172", "comment": "Malware payload (GuLoader)", "value": "25a95309e182a8fc4bf816f44c5852f4e0e8375a08a2a68e6463787c55ca9ba6918819f9b283548f5b879f89ca225b45", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229088, "uuid": "9a817493-ff36-4d2f-b596-fc26901a1d10", "value": "T1FD0328A1C6D60A384A571BEEBF019542C8FE853E8325815DE69C176E21538ACCB3FF5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229088, "uuid": "86c7744e-dd1a-4ba9-95ba-7628f266f78b", "value": "768:corMtwTVlHPwlR5EQi/GollXgg1y2mkmpnzAiPhySn0GCG8x:coQqPwN6GollXgQmFnkiAm7Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229088, "uuid": "8e43335f-709f-48d9-af16-2afd8ee98423", "value": 41088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229088, "uuid": "8e9f4e36-b263-426c-8605-53a853fc5c17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229088, "uuid": "f88d31ba-3ab1-4614-9425-6a789bef5c61", "value": "DHL_1x20LY036449574.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd02b78-578d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1695197674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197674, "uuid": "216c2e2a-adbb-444c-8f85-9d46d616da10", "comment": "Malware payload (Fabookie)", "value": "41484c18078fdced5621a0d209d91911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197674, "uuid": "2fe508a4-2d20-4e88-9d76-9018bcb1d3a3", "comment": "Malware payload (Fabookie)", "value": "ce6ddf38ddc57698642bc07efc9088f66f1a6fcb421851fe668b84e7f1169726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197674, "uuid": "b44d69f0-3b5f-4f12-ac48-2f22d1bc10e1", "comment": "Malware payload (Fabookie)", "value": "6cd4ef47e7f9408a18a590d86401f4c3769e2d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197674, "uuid": "277a7ad0-fb89-43e3-9149-4760a3908fdb", "comment": "Malware payload (Fabookie)", "value": "3e5972488c9e0b24b422b37379c2af06808fa8c807dbb27255db9099abc87ab4c1f3e0eea683c475032feaf34ef7027d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197674, "uuid": "5a8282c2-563e-401e-a597-46d254b89f45", "value": "T149941849FB7408B5D096C531CDBE8376E272BC831B25930B8641FF5E2FF362169A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197674, "uuid": "b9ec7115-9c8b-4c71-b0bb-8429e004886b", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197674, "uuid": "84199f6b-008f-40b8-a554-ed262625af4c", "value": "6144:TyqO7oQLwFiHMmoiT4MKBz3I8JDGxerEhgVIXFM:TlwUFA9VrKi6+erLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197674, "uuid": "3050a507-838a-4638-8d53-704fc9039026", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197674, "uuid": "6e35075d-4d33-495f-80fb-1362364ca130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197674, "uuid": "085b8c80-a5da-44ad-a292-4feecaf17aef", "value": "41484c18078fdced5621a0d209d91911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51702f3-57fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695245015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245015, "uuid": "103feef7-0434-4f61-8754-56a1dcb87858", "comment": "Malware payload (RedLineStealer)", "value": "1dcdf006b05e9f5b45251b1972100e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245015, "uuid": "59fda787-3deb-4c56-959d-c1d56ad54c90", "comment": "Malware payload (RedLineStealer)", "value": "ced9c05b372b3e69b698086cd26f570329d887682fdf6bdb0d963e29b50635df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245015, "uuid": "f8aa68ad-669d-4619-ba64-9ca914aaa534", "comment": "Malware payload (RedLineStealer)", "value": "98a682565af68e77ce3930c927069c781bd49b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245015, "uuid": "df03ddb2-7822-48c2-88d2-0371bc372071", "comment": "Malware payload (RedLineStealer)", "value": "7965ddefc17b896774985be2dc9ff7c5216fa5e1df3688b6758e0a5edc598b3118873c2a178466a57bd9a1ae4b413f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245015, "uuid": "b87ba389-1219-4ad8-893d-172467c0e34d", "value": "T129552382B3E8A1B2E976177195DA57D31B317CE159784ABF330AA00B0E72180D176B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245015, "uuid": "6c2d7aed-f4ed-4d62-a77b-f66c693d33db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245015, "uuid": "8da81455-f51e-492f-af10-60d9bad8af06", "value": "24576:7yVbL8rrNs+k+HvBibGa6q+xFTllp54gig+l71GEQgUQI+BTz:uVErrNs+k8J/rqcllpiLGPJyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695245015, "uuid": "24af93a5-607c-4643-9ff4-634be1502b93", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695245015, "uuid": "47df7759-ba37-4b0b-ab41-1a205516d879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245015, "uuid": "78cd598c-0996-4f40-a95a-5f083c18c4fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd99624-57fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695244359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244359, "uuid": "81c4a750-8587-475a-aed9-539cb951ec09", "comment": "Malware payload", "value": "b1529d81dd0a6951c60334332e3f1e05", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244359, "uuid": "100a254f-b718-434d-adb7-fbf86af28bac", "comment": "Malware payload", "value": "cf090b1eb09845bb70f08e9dbd531460d22a1e53861b3e20852e2bdfc608e55e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244359, "uuid": "0bc75550-637e-4517-9164-be01e0daf257", "comment": "Malware payload", "value": "f61958a4358a2bcb390d447e4b6039d861786c05", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695244359, "uuid": "31614040-82ff-4724-8326-4e78c67dd0b5", "comment": "Malware payload", "value": "f948d74b238a55d32f681f95dec8acb12c0501c69031742a3c40289738de1a4767d91b6b9b5a9e3bbef1fa3b9a7043b2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244359, "uuid": "1f7b7d18-49ed-46bb-8726-a86788fd41fc", "value": "T1EB16BE87F789982BC8F3A7B5867A13B151271C258743DBC75A10B63C39B76D48F29AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244359, "uuid": "02eddb6e-a4cb-4bff-b113-07268b1e2572", "value": "98304:KzuSbUgLCrOUPisoyoTuMOzyhHeKkYzxMCkb2MKRs4h:K9CPiDpTuMOziHfIb7KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695244359, "uuid": "e2b36ce0-7965-4045-b81c-021fa8057fb2", "value": 4380588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695244359, "uuid": "8aab305d-6ca7-4ac3-bcf0-46a29c9ad3b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695244359, "uuid": "46df3782-154a-4253-8ea1-7968536e9d85", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075f39c6-5787-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695194795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194795, "uuid": "5993f18d-315f-4632-aac4-4531f9e72dfe", "comment": "Malware payload (AgentTesla)", "value": "8c6c7585d5657a10204dee25dfc16961", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194795, "uuid": "16627dcb-76ed-40ec-9ac0-8e455741d2f1", "comment": "Malware payload (AgentTesla)", "value": "d02df95ca48a3149b722cf65d7a0f8391aabd2230ad53dbecbf46809262f8b8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194795, "uuid": "7be61bf9-d6c5-4a54-b0a2-aea622b25dbf", "comment": "Malware payload (AgentTesla)", "value": "c65bd2e6730f0e508e8ea0cd02c22cdd713c98a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194795, "uuid": "2a59210c-cb91-487f-8330-86e00c68f008", "comment": "Malware payload (AgentTesla)", "value": "c69f189e04d03d2318962687a364ef4775d3a896f0eebf39c8d6a20f09163b45dfa3fcadd1e9cea0e70dca2aad96289f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194795, "uuid": "521223d2-d23f-4a74-897f-83f7eba029df", "value": "T1A4456BD35CCCBA82C71942B7EB16F9FD097BFE0D948564C63072EA4A292319D1C7A439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194795, "uuid": "4642134a-95c5-4709-965a-21a00ac8b514", "value": "24576:LWQmmav30xSZy6w6VH6NvBZyew6VM6NmEa5SdQ0TIx5Dfaw0A:qQmmQ306+6VaBK6VNRVd7TCDSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194795, "uuid": "31e606b4-9f57-4839-86cb-9ea408657e0a", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194795, "uuid": "6407a78d-0a2b-4e31-bd95-2cd40197903f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194795, "uuid": "d333f444-2b96-44cb-b799-5c673df3946c", "value": "Docs & Bl.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b201b29-57cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695224544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224544, "uuid": "8f59c038-38b7-44c2-a797-6cf26e274bff", "comment": "Malware payload (Smoke Loader)", "value": "f7bc22d313ae08a8736abb1d64d50b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224544, "uuid": "7ed9136b-a4eb-4c04-bebf-37d9f1d92ede", "comment": "Malware payload (Smoke Loader)", "value": "d1f62ef5a5159a98e939e092c949ab90a88a2310de6ff42e9923377e90cbbbba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224544, "uuid": "2ef9de38-8e55-4052-b24d-c6ea9003bc63", "comment": "Malware payload (Smoke Loader)", "value": "ab098d54236fd504a0ac0562ae5979cd76aceeba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695224544, "uuid": "105e6872-9e94-47b3-9eae-6a02e1a557ee", "comment": "Malware payload (Smoke Loader)", "value": "ab675447cdeb9e21e21e041707962d0ab4e939b927d001c739bf12af55e711e683bcc01254fd075a7cae54479d9ce30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224544, "uuid": "fc69bd62-6838-4edc-a620-216cd8ebeddc", "value": "T18924D0213AE2C4B2D4B749389934D7E02A7FBC735275895B33A83BAF6E313915725306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224544, "uuid": "010f0189-0431-4fcc-a764-81876a1ebbc1", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224544, "uuid": "2d89cd2d-3156-4983-871c-efe78f420608", "value": "3072:eXtqr/GnwXp1SfBZKe6m1NFT9jkHTTvUHWjJnkq45JeFToc:mQr+nIp1SfBYe3NzYHv6WTIeFTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695224544, "uuid": "c1a0d417-7520-4807-b361-9f933f234c04", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695224544, "uuid": "9869d318-a329-4d82-9b87-a5a54fbc55a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695224544, "uuid": "cbb8538b-0bf8-4f5e-b6a7-bec84976e5d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c09dec-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229204, "uuid": "ed7ccf99-8084-4183-b4e6-26d0227c18ce", "comment": "Malware payload (AgentTesla)", "value": "946d8e7f1e43898ba7fb6a16576bebc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229204, "uuid": "b4acbf01-fd69-4855-8ddb-c4b6cbd63c91", "comment": "Malware payload (AgentTesla)", "value": "d230e72c97b5441cd8ecd184b7c058f1da5f20df317eea274cab3a0d05fd5b7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229204, "uuid": "bb777345-b0ea-413d-ae0d-918a27bce38b", "comment": "Malware payload (AgentTesla)", "value": "fad1dab9bc0885b33f746c930bc77fe1a927a28d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229204, "uuid": "9f203b4f-431e-4fd4-8ccb-68b06a8d9bff", "comment": "Malware payload (AgentTesla)", "value": "c818dde037491d9aa0d3f0e56964497b010f9d44b20451af7d6ca072c5187ce936e7f534eecad83a4902f6599aeb5902", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229204, "uuid": "a0902ab8-8f34-4497-8176-5e231e28fb94", "value": "T1D8F433D7A3318661D1E6E871B190A6C5793BE16C28F86274DB74B83C67C8267F8C0B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229204, "uuid": "53814cdf-37f8-42f0-b7ac-cccb6591a260", "value": "12288:BJtXP1lIJ/RTJrje0GLf+o2yn0JvO5EusEtNwockCJO3rxztn:BJtUtRTY0Ga6n0A5XsEtNw1kCQzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229204, "uuid": "3e1317b2-ab8f-47f5-a950-b34771ccb992", "value": 748259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229204, "uuid": "1a246fe0-b377-4c91-877c-292426519404", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229204, "uuid": "b943e05b-0356-45b1-bb2b-7a3fa669c026", "value": "PO-4501336854_WJO-003.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5416bf-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1695229059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229059, "uuid": "8480ee07-e829-4fa4-8882-9d5f396e3e5e", "comment": "Malware payload (STRRAT)", "value": "3105a413a55501f7a7a878643cd37b33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229059, "uuid": "f7f973e9-b5b5-417a-a198-bb015fa7800c", "comment": "Malware payload (STRRAT)", "value": "d25ad4df124b1f69972d1e09520ffecf979f89957ca296d11aaa4454d2922a97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229059, "uuid": "84b640eb-a743-465b-9342-bcc30a63bd53", "comment": "Malware payload (STRRAT)", "value": "ab276a88e6a6be38aa3ff28aa97a8b1f8a55ff92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229059, "uuid": "da050fa7-80d9-40f6-93db-8a0380d324a6", "comment": "Malware payload (STRRAT)", "value": "df9e17546397db32da641654785fdca1dae2dd4fda1307e10cc59e63ddfe8eb1c43b34cc559fe49ef5c145d905e95e5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229059, "uuid": "4ea0a374-5ca0-4dd1-af1b-ff35101ab1a9", "value": "T189551AC82F55764AC76AEE24C315A313EC74F92F29972DEA7D803E0D2EA5C540DEC660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229059, "uuid": "21df31e0-eebe-43c5-a689-8c984cf12df7", "value": "6144:MQJdZ/vlGYLDTYNpHI4DCQwZEauZnDjhLkoNety1CHrD2dDcuNoKlk7JYlD8AbdG:X/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229059, "uuid": "e0764a76-8166-4ac1-9b23-e690db8f66a3", "value": 1390308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229059, "uuid": "12689426-38af-4c0c-85f4-afd9cb28a290", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229059, "uuid": "556f8bd5-83f8-4d35-b9ff-804c9a780385", "value": "CA22197-08082022 PI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5ca102-579f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695205381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205381, "uuid": "a76555a7-116a-43c4-a426-fadebc83a38c", "comment": "Malware payload (RedLineStealer)", "value": "ea7403aee65886f2eb0f84a31fbaa661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205381, "uuid": "7eeee1a6-9c07-492b-bfe4-2d81d454021e", "comment": "Malware payload (RedLineStealer)", "value": "d32e6fe9f699c0065727f1e3aa8e9a97c887d9d9be96471e263ce4fc34bd74c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205381, "uuid": "21caf910-0cc2-4959-8562-0ae57d8a1566", "comment": "Malware payload (RedLineStealer)", "value": "ea2ade183bf8c34781972452244bc36f2aab16d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205381, "uuid": "bc48a5dc-3e02-4052-9cc9-509b9f034331", "comment": "Malware payload (RedLineStealer)", "value": "e1a24f76ccec8cd02a294614202e4d38a723ad3759875fd2d2788f13273c367abc0217004f343a8f22f0124d8e20729f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205381, "uuid": "781b6f9f-5772-41fc-87e0-a8eccbf94686", "value": "T1B0652347EAE58437DEB0277058BB02C71E347C9565A4976F26E3DA6A0CF3BC1582036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205381, "uuid": "5ab0ee28-a200-4faf-ae70-62bec8c10a1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205381, "uuid": "68c9c1be-9eb2-48f7-8442-126edc8bf0a4", "value": "24576:HyDG6ipxEXNJrooW29Y20VI0LLlo8Ug46AVEK5gJ64ube7L6OnFyFfA+Magvg:SD3ipxGJr9W2+bVJLLl0g8De6J+GOnFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205381, "uuid": "0764594b-9bec-4450-bfe2-9f418f4f180f", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205381, "uuid": "01b3fff2-f227-4d4a-9075-ac6e575cc088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205381, "uuid": "94530fa0-89df-4d59-afc6-a7abb719cd59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316616c3-5780-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695191859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191859, "uuid": "98a666e4-9ca9-47f1-bf89-98c5c3c72c9e", "comment": "Malware payload (RedLineStealer)", "value": "03faa4878a6e8c775534de8cac913865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191859, "uuid": "4dcde6ea-d840-4acd-822f-b2af674a993d", "comment": "Malware payload (RedLineStealer)", "value": "d5361752e2bc62a1d7a5e29d109d6d9ab8ebae09566b03ab9f465b970dce0781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191859, "uuid": "d1b1c9b5-7a26-4a8d-a140-497cd938eaae", "comment": "Malware payload (RedLineStealer)", "value": "7548c52394da12074a6418b5a3820b8894aa0d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695191859, "uuid": "80e8ded1-1c68-4b89-8efd-eb0e44ef98e2", "comment": "Malware payload (RedLineStealer)", "value": "0a3671bf3ed0a4863ee6f340b3c186c6365381bfdd69408f0eab0201d984ce187cda380d2fd6298eeb3ac05d36d61e36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191859, "uuid": "8c45e5c8-979c-4178-a636-2e949c1b4530", "value": "T15B6523166AED5022FC71073088FB0642063A7A91EDB0565F036EBED90873785DABDB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191859, "uuid": "434ff889-61f8-418a-8e76-35a1803e17c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191859, "uuid": "db0717aa-9fa0-46d5-ab9d-f1f90b9e75e5", "value": "24576:myEQ5nEl8/Pdq3DNT3YB1A64KJUdrvI74rwga8ral0RDOc8JKGp2Ex1ShPrMZ:1EQ5yA83DNT3Y8iedDIUM+raq38QCn1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695191859, "uuid": "d8845bfb-46ba-44ad-8062-ddea4bbde4f8", "value": 1470976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695191859, "uuid": "8aef5a46-9b5d-480b-b969-cdd2ad481ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695191859, "uuid": "5faf47fc-097b-4d07-9376-a9fc5bcb786e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34cf394-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695229094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229094, "uuid": "edcd5d33-8cca-422f-8492-c3e2815fae67", "comment": "Malware payload (RedLineStealer)", "value": "513f509f29c2f9fa313626c3db3c7e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229094, "uuid": "9b9c7065-e25c-4272-9380-5c7111d7ae02", "comment": "Malware payload (RedLineStealer)", "value": "d57da4fb80fec02a75a10f76cfe0cf55a476676bed9f9c59ed88c5ab419e47f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229094, "uuid": "698bb004-c830-455b-b811-8d76569b8e66", "comment": "Malware payload (RedLineStealer)", "value": "38f768ba64c5fe7143ef6a1bb79654335b6e48a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229094, "uuid": "858c076c-fcd4-461e-b3ce-5bfc7b00ba82", "comment": "Malware payload (RedLineStealer)", "value": "63806570a0482aa0eef0bda9a9faf101a19df0dba883091bd56103b294f9246c52044ed523636bd3082f272c39d243d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229094, "uuid": "037c9737-6ad8-4672-9300-f49a0819888b", "value": "T1AC652303DAD99A32C4F617B294F613D30B367DB51C64530B3686EAAA5CF38907636363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229094, "uuid": "a4f7f0ce-7a0a-44fc-bd7b-32205083610e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229094, "uuid": "dc13cfa4-5a91-49a6-b206-3bf8e500bbf0", "value": "24576:0yfTHEVkTyQlZ2KV0DX2/Lnjqi186hkDbos16Um30SR8K:DLHEGPL2KuD8njN86hkDMc2ESm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229094, "uuid": "12c27b1e-6fa6-4ce2-9084-5acd0ea00e35", "value": 1432576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229094, "uuid": "2b7f8bf4-c5f2-43fc-9023-e8b462f1bcc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229094, "uuid": "067ef032-682c-477d-8078-c63b5bbb0507", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059d5e16-577d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695190497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190497, "uuid": "6db62917-3064-4ae2-b85c-e92f7aac5664", "comment": "Malware payload (RedLineStealer)", "value": "7b73eabef337a2d2f8c49aefa52dace1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190497, "uuid": "603450cf-c1a4-4437-aa46-49bf179e2bde", "comment": "Malware payload (RedLineStealer)", "value": "d6c85cd4e7034b10d12e1385e87a2c22f41d3f1c6a93b2b73eef5399aa40cee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190497, "uuid": "3364ee2f-1829-4d7e-884f-f40c7b24aa57", "comment": "Malware payload (RedLineStealer)", "value": "d9631a13eaf8e76e45f60544a2f3907a0dc1e389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190497, "uuid": "74b31282-49a6-4440-a55b-8e19bd36a3e7", "comment": "Malware payload (RedLineStealer)", "value": "3a98c2caacc97e20359cba604c67d502d95ac84d626e28972d99dcd3e5d2fd8265b6b5c9f33f8b45e7e1eae58a2d0501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190497, "uuid": "b8890033-f48b-4b5c-b124-a5cfbeddad2f", "value": "T193652355B9F88426CEB14B705CF653933F39FC628968975A2351E82C0CB7190BA7633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190497, "uuid": "d9b646e0-f5b3-4d28-b244-ffdda08d5616", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190497, "uuid": "898b9a87-7441-40b2-be68-57277b76b49a", "value": "24576:+ynbDUFjg0MkVmUnz+UQfZKJkIbHOpYTpxdxYT7axMWqQHofLFzMN:NbWg0Q3UQxKCoTnfLIfhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695190497, "uuid": "7c482274-8644-4981-9855-8bb63822f81b", "value": 1469952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695190497, "uuid": "eebf2aea-8b48-4cfa-852a-a0fad0fb9c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190497, "uuid": "81736440-83a8-4825-ac37-a5d0bd905d15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe29af73-57e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695236440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236440, "uuid": "8efb2ff8-2ff7-4879-875f-a1823b318e71", "comment": "Malware payload (IRATA)", "value": "fb719f4c7e6f06e4bc0975b938505ef0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236440, "uuid": "d8ea4efe-a98a-4399-ac2c-746f40db5a97", "comment": "Malware payload (IRATA)", "value": "d7332d12c567521884600b334a7480665030463af9d044e022c955d710d2225a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236440, "uuid": "5908dc7a-988b-4214-8148-8a7d7c693896", "comment": "Malware payload (IRATA)", "value": "c42c3802f949d05530ecaef2ae0a9c888cf887e5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695236440, "uuid": "b8160423-7f3f-488d-bfb7-749d6a906332", "comment": "Malware payload (IRATA)", "value": "3140ba122c7c333e600433dae21100fadffd26540186c7e1f66ed94779f44ee30e735c02927e83712bbedf913351c8e8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236440, "uuid": "31c78fb2-6541-44cf-be4d-7119629f66fd", "value": "T1B316CF86F31A996BC8F7933345B51A31515B4C668F83D6872924B33C58BB9E40F89BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236440, "uuid": "492923af-c84a-41b0-bac6-2686934e9d60", "value": "98304:VLw2lzZ86D05Wd8d2ofrHlbetdfssR8L93KoCwmvlSV:VLw206DvdfsGa3KR9SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695236440, "uuid": "bb70c58a-4e15-40c9-9c51-a7da8e4aa65f", "value": 4047638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695236440, "uuid": "8ba7f52c-7165-4260-9045-965b2cc4b34a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695236440, "uuid": "6af7ef40-6063-444d-9508-de3a1a103c42", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238e460a-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229202, "uuid": "f7d2ed4f-bd84-4c8c-9c92-a6d55a75d0f3", "comment": "Malware payload (AgentTesla)", "value": "1db728298b71d0766b6e7cdde9f2dac7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229202, "uuid": "c6c04c17-6e1d-43ec-8d72-35d8b22f7fc3", "comment": "Malware payload (AgentTesla)", "value": "d787f0dc0cd1da4c6da20750aea9ef4533e3669787671e4648b4b7b08c719715", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229202, "uuid": "78d8b0b3-ffc3-4956-8162-c51c29d65a21", "comment": "Malware payload (AgentTesla)", "value": "cb06b42bbacf271840f8aa84bbaf74588a23cf2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229202, "uuid": "f37670fd-302d-4829-a0f6-93b3e00474c0", "comment": "Malware payload (AgentTesla)", "value": "8803faff327b5a92a5d923a6801499ad76a5232d6a088baa07c88364722a3105e2b9c1218293270212a02fc86ffca1c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229202, "uuid": "e60efaa7-6257-4e5a-a523-b9f7efdc2cc1", "value": "T1D0D423D01545DC1B87186CFCF098A6532D148714DE676FBA0B2ACC2AB42A77F168FEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229202, "uuid": "62d6a5a3-7eee-4331-aad7-79725ad2dbf7", "value": "12288:fBEoiHNrLGDv6kOe6bdlTtYEYS7As03jHwMhvdSCvaV6qROTXqfeTNw6DrQ:p4LGDv6kOe6bdlTWa7k3XfNv06PT6fXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229202, "uuid": "966f9554-f606-45d2-a362-476512e37c2a", "value": 656869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229202, "uuid": "7d963fa0-69db-4f2e-937a-e39a515d5b8e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229202, "uuid": "183f12ba-19bd-481a-99b5-0d164a32afb7", "value": "23IDEOC2308-088562.pdf.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8f1397-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695199206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199206, "uuid": "82345285-0446-4dca-aa1d-5e1a172684d0", "comment": "Malware payload (SnakeKeylogger)", "value": "c6f8afa65badddd3590c98f05c766c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199206, "uuid": "de3f1de5-d5b6-4dc9-aae6-79e9ce530f11", "comment": "Malware payload (SnakeKeylogger)", "value": "d7e0001b5c8e59c77d4f4cc467847498f7754d6417e7dbd592989ef73d90c5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199206, "uuid": "148a2bab-f1db-4f8b-ab40-41bd66688ea4", "comment": "Malware payload (SnakeKeylogger)", "value": "cd6a7f7ac3bcdcf9dcaf95235169a5c705559f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199206, "uuid": "5b237448-03f1-4a55-8f35-0300bf3e61a6", "comment": "Malware payload (SnakeKeylogger)", "value": "3f743d31dc7769f49148f46c5ae705dbdda2ff9219b159cb07add1fc2884ae9719bb61830a6e1222010c59ced7f0832a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199206, "uuid": "398bc387-3c34-4132-b0c0-ffae4b99b136", "value": "T1D8B412183BB4DD83D46C5BB90430028167B2CD5AFD26D7A8BCCAB1E60667F61C61678F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199206, "uuid": "ffb395fc-c497-4868-aaf4-f5f3a1412d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199206, "uuid": "5930a7af-e428-425e-b606-0b24f1971add", "value": "12288:+0K7h3BwuJAK2lVWCG7FyODeqBRBCre9GFxenN97uKk:kbJWXEd6mBt0FxWRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199206, "uuid": "e0f8f9dd-a059-4d02-b7b8-0c673bf7487f", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199206, "uuid": "26a916eb-9bc0-4b20-9b3c-1de28b1edb4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199206, "uuid": "eb2a7003-af27-461f-a4b3-e03a08673908", "value": "c6f8afa65badddd3590c98f05c766c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a8b111-57ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695223830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223830, "uuid": "430e8761-4622-49f8-a7a1-43b3ade64629", "comment": "Malware payload (Smoke Loader)", "value": "1b99f4577c8adaf228be516c1a3fce6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223830, "uuid": "b1e10a26-a31a-469d-a721-f4af04023583", "comment": "Malware payload (Smoke Loader)", "value": "d81750a716e631f5506195bff20d3cff4d18e124db80e36a9318a1e1af2b94cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223830, "uuid": "b94ea011-543d-4fea-b16c-70b2aadded5e", "comment": "Malware payload (Smoke Loader)", "value": "dc79fded5351741e1dcb3581fce1937571dad87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695223830, "uuid": "3c9c51cf-e1e5-4e39-a70d-ed87fc54e625", "comment": "Malware payload (Smoke Loader)", "value": "a95293ba73e368a51873772e99c00ff33265c9a3dd520b3be0f46e696eb071ca208ff52861b5e7c62509f5f38abc7dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223830, "uuid": "d997d20b-67f9-4ba2-90f1-e2b4dd815c88", "value": "T10524D1123AD2E472C5E785344830DBA42A7FB87357B9454B3F643BBFAE303815662B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223830, "uuid": "f2923897-9fe1-409d-8b9f-b943fb2d68cd", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223830, "uuid": "9fe06682-0c89-40b9-987f-de5368919ac7", "value": "3072:VMXtDrQCMOidx/Cqn7kqJDXoZC8Nqv+sYtInpDRtMtAbwJ5JngToc:2JrbpidUqDmZCdv+sYtInpDRtM/ngTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695223830, "uuid": "fbb4199c-4bf6-4e05-8577-9be689495e89", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695223830, "uuid": "a5b8b2d8-b3b2-4563-bcbc-13909896f60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695223830, "uuid": "840dfd9c-bbc6-4498-b732-40d6158af143", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbabf873-57b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695215310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215310, "uuid": "64ae44fe-d73f-4896-b2da-9488f677fa15", "comment": "Malware payload (Smoke Loader)", "value": "e413ba615d242f32f02e33cb8b3afb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215310, "uuid": "99232692-1eda-4698-9c55-0bdea997b507", "comment": "Malware payload (Smoke Loader)", "value": "d87d1d32a5239ed72c354788a64836e720b68e5f87c46a8793fbbaf3c2857955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215310, "uuid": "1ae35f54-9287-4835-aadc-ecaa541fe5c6", "comment": "Malware payload (Smoke Loader)", "value": "b671ce0e460a412fcba62cd5959290ecb3e0b65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215310, "uuid": "cbd932af-87d4-4e9e-95b9-cd6800e9254a", "comment": "Malware payload (Smoke Loader)", "value": "9ba2cd14b65d59ca1abaf83c763a604f7a9dd250e29dbd0d7d7100b5a74e3bad229eb1f19396c507394a1fd270a6f24b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215310, "uuid": "1d10d188-c36e-4d81-a9a1-87a89f11464f", "value": "T14034D01235E0C033D56746394825CBB46A7FBC3269398A8B7B842B6EAE353D39F15346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215310, "uuid": "2490f215-895d-4fe6-9314-c6134c44ee4d", "value": "c9420ade60b1def8d80cadba5c09306a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215310, "uuid": "9c6fcc1b-596c-439d-8214-dda923e58aa9", "value": "3072:u/ch0pofVTnn7VCWOoFIH0EaGSuv0wdtS1XuH+v45vDlmTzj:rqITn7cWZyH8WMwd06+SxmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215310, "uuid": "5e8cc73d-8f06-47c5-b3f6-c812abed3ee5", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215310, "uuid": "f68dfeb2-0af9-4c7f-a593-6208dbbf3387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215310, "uuid": "7cf0314a-df9c-440c-a7ed-7d8c1c0ff7eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5fbb8e-57b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695216147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216147, "uuid": "4cf74737-d956-4f4c-b626-175da7ef854c", "comment": "Malware payload (AgentTesla)", "value": "4bdfe31a28c97a3522eb879d11e3d801", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216147, "uuid": "90643fe7-e7f5-4627-9e6e-4d6a1222de85", "comment": "Malware payload (AgentTesla)", "value": "d8d2face6e4faf0d4306f70d500a7351fc98ee6386ebf9336869b82179996c28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216147, "uuid": "b464c583-5bb4-4b54-aff7-d0b1084a8526", "comment": "Malware payload (AgentTesla)", "value": "f9f445487151615e4438bbc9083229172171e60d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216147, "uuid": "b66fd9e1-5b50-4fad-9880-79f91f806c91", "comment": "Malware payload (AgentTesla)", "value": "65ad73b9e9c2e2a1b2205c7face4d051905b453422ae0cc63cab59cffaac2885b978e7409627e08e9b42ca99309708ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216147, "uuid": "5d634cf0-5590-4009-9095-9f5cdcec56d2", "value": "T11B35BFF875047DE66A6F576BCE96ACDC13A62B2389CBA4CD8064B7C30563375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216147, "uuid": "08f475d6-fc3e-4318-9f4a-27f4dcac9fa9", "value": "24576:G35y8AeXHLoRwgOcDFITORnOYg/tMUGa7U4pMlCEwDk+bHmc2/1:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216147, "uuid": "7c51c22a-026c-4dd3-be89-622ea3a2c67d", "value": 1080015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216147, "uuid": "53ed84c6-efbc-45a1-a2d6-d8e2ff3acc85", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216147, "uuid": "6501ecdc-2803-4a1d-a738-d03a0d2a9976", "value": "OrderVerification_Drawing.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab953ef-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695196545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196545, "uuid": "1608d0aa-82d5-48c1-9b1a-1ed88703f43a", "comment": "Malware payload (Stealc)", "value": "3d4e0dc6f80820315996f16eb5a5f03b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196545, "uuid": "50bbb99d-420f-41f3-a6e9-55d028c764ea", "comment": "Malware payload (Stealc)", "value": "da1a209778c07fc37e32841c3b692f446f11181eb76d788f046a4861142086da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196545, "uuid": "b3b62200-0ab2-41bb-9a2d-e2b7b7cf3e14", "comment": "Malware payload (Stealc)", "value": "ebb9789f96c265828c08412d89d4f85805a5ec35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196545, "uuid": "20cd6338-cd5c-4159-99e3-8e1e33ed0121", "comment": "Malware payload (Stealc)", "value": "e6dfa2ddd30fcd25d630c045a4863c94009ba6788d6b0fd2603711b42e2dd32ff837cd5e3e5455ebb0d7d269c0a926e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196545, "uuid": "36cc4933-b8f4-495b-a6ab-99a187ec7e75", "value": "T1A434CF1135E1C432D2A705384860C7B06E7FBC7779659AAB3B811BAEDE312E39F25346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196545, "uuid": "473e7800-5998-48b8-9a00-052a04d8b373", "value": "ebb1ad55f48b70b0a48dee8a767738f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196545, "uuid": "81e832d1-4124-44b3-bddf-def16759cced", "value": "3072:1SRi0uSPlDFGOcfYHxkxc7kWqHt103FVP8JZphhDrvD5/exT1a:o7pFFGOeYHot1YFqprvJexT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196545, "uuid": "8a359251-5ace-4dd0-9576-88b5a16f359c", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196545, "uuid": "21d6a9b8-19fb-45ba-80e8-5c8c865cabc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196545, "uuid": "e0b399c6-3d4b-4fba-a508-25e409b99a10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9181cb-5755-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695173516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695173516, "uuid": "a9dc258b-e5cc-4381-b9a4-98fdbd47b798", "comment": "Malware payload (Smoke Loader)", "value": "a662f8b0218462048219336e0dc8fa63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695173516, "uuid": "f9ffaf78-c55a-414c-8b35-f385e871c85b", "comment": "Malware payload (Smoke Loader)", "value": "da9b0ea42080dd56377966cd75b50624e7b0e7eb8efa7f72364ce74832a839da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695173516, "uuid": "33580573-c7c4-4c53-9cf2-eced84342cb9", "comment": "Malware payload (Smoke Loader)", "value": "dae6f7f0c32980a311a7118ce115e5c6c71498a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695173516, "uuid": "e94fb8d9-b112-4aab-9369-790f2144517a", "comment": "Malware payload (Smoke Loader)", "value": "1b89b0dffb043476244a36f6e5e234c33941a6aa0b2ba17301908f79e7ed2ae71f215982ff4ea8edbdae8096c8654968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695173516, "uuid": "33a495fb-c16f-44d0-a53a-25af3d3310e9", "value": "T173652312AACDF473C47643F089FD164319773EC686984B2B23465B856DF2BC0A5B236E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695173516, "uuid": "8f759836-7af5-4b8a-a1d3-4be8ae87645b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695173516, "uuid": "4ce34a8a-2353-440d-a0b1-833fd217a59c", "value": "24576:0yhq/w68Cubd4x7cIaYgs3orP4fEWCo6zLuyUpu1Fyb6V8eE0i1+9STW:DDTb2cYdYrszH6zLuy5Tvud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695173516, "uuid": "2df16cd4-ca4f-4bfa-ac09-deb2e91f6eeb", "value": 1468928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695173516, "uuid": "ae1762b5-26e1-4104-9d84-acfa44aff1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695173516, "uuid": "2e812d48-f374-4ab5-9253-8cf7713b0411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b7b9e1-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241879, "uuid": "e4a95c89-3576-4ce0-b494-d6734807ffea", "comment": "Malware payload", "value": "d10db6ddce48da8341181e52b8d61bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241879, "uuid": "e28ef572-247b-49d6-9ed7-54e8c902904f", "comment": "Malware payload", "value": "db049f954b46b3a560090bb8df9e0649ff77a77051f441abb19b96723ec820af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241879, "uuid": "2b14e29d-3210-45cf-8364-654a26f90363", "comment": "Malware payload", "value": "249c626e0826795b564f8191cb8417306444c9ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241879, "uuid": "413d28d7-0ee3-463e-bdd1-91a56cecad91", "comment": "Malware payload", "value": "ae97aebca2a69cf85dec3b7fe61187a714df1ce569e820277651c08a0f4234c04cebf257775e2ed159a5e98bdfabedb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241879, "uuid": "366e518e-f3f0-436f-b153-d6d23734d150", "value": "T1A0042A671F48FE32E3C051B0B521E3A58EF3CE441A7B86529175392BF5B8A91ED0E162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241879, "uuid": "1011b300-a5fc-4893-b6fc-48132a78bd55", "value": "51d5f507286fe9a2db75f423fbc06a61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241879, "uuid": "d1a344c5-2aeb-403f-a1d2-0472c21ba94e", "value": "3072:QdISdlDZDdzhR6QTTTTT0TTTTTHTTTTTTT8TTTTTTTTTTTlTTTTTTTTThTTTTTTq:YdlDZDdzhR6ySSWScGVGbeQ0YviSh0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241879, "uuid": "05164695-1a57-4538-aaa7-009a24a3b9d8", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241879, "uuid": "232cc906-819c-442c-a677-56aa6e754690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241879, "uuid": "819696b5-8060-4a0c-8edf-0922c7e8104a", "value": "SecuriteInfo.com.FileRepMalware.21548.25860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2627304-57b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695215778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215778, "uuid": "22cfa6da-6eb3-4e1c-ba92-381c642ee82a", "comment": "Malware payload (AgentTesla)", "value": "2f70718a263220d2f9f3b4bd76ba2b68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215778, "uuid": "08b888a1-bc15-4698-8881-0bc4d8606d43", "comment": "Malware payload (AgentTesla)", "value": "db588601834bc74c9ea1b97b455c5fe3f39fa8e88a4a35982c3030b643d0aed7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215778, "uuid": "d97bcc70-4cb4-437d-8511-ea4c87005fd6", "comment": "Malware payload (AgentTesla)", "value": "5140cf09d92117e80eb8210c95b4ebf8b6e908cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695215778, "uuid": "92e37af4-dde3-4f79-acbd-45a40fc6b3e1", "comment": "Malware payload (AgentTesla)", "value": "f045fcaac0838fd42c8504bc255fda5af3daca3c78ca72ec5992cb825bdbed8e6c4d6a1f69af56fe1d89b5af0b0d71a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215778, "uuid": "779fe4f4-5753-4550-93a1-8749a6fd33d7", "value": "T1AC059D0431DB1C61C836E7734BE4E8678E9EEFE1579AE73E2BC136865379904CA42931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215778, "uuid": "6b0afea4-ec30-49b0-b877-4fb14d6372e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215778, "uuid": "e2040669-70b9-4f0a-a40b-77b71978c172", "value": "12288:+u2Es3nc5DnICuSBULw5EOibGyjTQ/tLMaDqC+zo5UkVqyoDAgvxwr:r2Es3/cBULwjQ0Co5UgqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695215778, "uuid": "b51bf873-3d15-4d20-ae80-086e7036ad97", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695215778, "uuid": "9442003f-62c8-45b7-8635-570c42d00e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695215778, "uuid": "078e6ed6-7ee4-47c3-92c5-12635576c345", "value": "Payment JIECANG.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c84be7d-57c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1695221244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221244, "uuid": "f8f21f9a-2e71-4787-892f-18aa14cf97ea", "comment": "Malware payload (LummaStealer)", "value": "e5255bc73c6538b3a88b5683995f55c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221244, "uuid": "cb9bca48-2dfb-4ed2-ade9-10fb7f4a008c", "comment": "Malware payload (LummaStealer)", "value": "dcb21f8c085ca8b001e2a7e5926ac1ae908e638c594ca48bc3622f109407e0e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221244, "uuid": "a7fae6af-07e5-4b26-8baf-cb709e14735a", "comment": "Malware payload (LummaStealer)", "value": "1813e9af18b13e97165dc483a5f9b4f80ef6e1bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695221244, "uuid": "205a650f-cbd2-4230-8e8c-7e5b3461e4ae", "comment": "Malware payload (LummaStealer)", "value": "500120f58484051390158e20a9207e7f862c711ee2323f4d7b0a5802c8b2080c88a4519cabedad4511f108da5ddca35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221244, "uuid": "ccd2c2c8-f1c5-4bb2-b504-911774d24081", "value": "T197940111B9F1D471D69B90709471CB902EBBBC33A539468737606BBEBD323812A7A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221244, "uuid": "a3c7091c-6d29-4c0b-aeef-a90f7e33c088", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221244, "uuid": "c424e636-9473-48bb-99fc-3caf9c35aa19", "value": "6144:aRz+smTIvG143bSxxoTNVzskiU/NBSf+2WpTsWDzIcCz+8GCDeqeIKyWS9kiBCPq:aHmTcGOuxmP8eC+9pTfXIcQNGWWO/Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695221244, "uuid": "b3e4960e-e157-4537-a292-f09689d4605f", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695221244, "uuid": "9406b576-d4bb-43f2-856d-f7c3d3dbccaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695221244, "uuid": "32629853-ea42-4ab3-a31d-2b2ec629b637", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0b408a-5782-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695193002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193002, "uuid": "f63dcc75-924c-4d0d-b344-f8c9156e632b", "comment": "Malware payload", "value": "736f8c7459170ca6818e5ca06c440711", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193002, "uuid": "17363066-8438-4b3f-93ca-a8332db2fee9", "comment": "Malware payload", "value": "ddb93981561e8538fc75eaec73506f5498b2b0bd504c79ed079ed223b13a63c4", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193002, "uuid": "1e4debe5-ab6d-43bb-a654-a7a6a0af0d27", "comment": "Malware payload", "value": "330d836bb60d50b9b6d5769f9e15579fbb5d8834", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193002, "uuid": "4ce04e99-5124-474f-a272-579d3420d5b5", "comment": "Malware payload", "value": "2e45183a4ffdb62d446ffaf8310198300647ca268c5351ad0ebe9f09869ea1ddf248ea685ee85a0ceebc4ac5ecc68dcf", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193002, "uuid": "d7c1ef9a-7edb-40c4-94ef-2e5117f5047e", "value": "T12493CFA0911D7CDED68A87C2172F3C4D320DB1B6B8C45AD12B79E78A4631A7F852784F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193002, "uuid": "5712e632-a824-4514-a0f2-f5920ea03095", "value": "1536:Rpn0U3n9Fbeg81qMBrm4yVaVl2bIbFIbWbdb9cPzRURxNbRR/RS6hSvVa5gnzJbk:n58Xl2kqSJ4v6F+D05MCaci2wwfw8RxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193002, "uuid": "5f8d2b61-2929-4afe-883d-79467554dc3e", "value": 94332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193002, "uuid": "6a49b8d3-0f70-4251-90b8-f55b3d949f15", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193002, "uuid": "b2042040-2b39-4ecc-af7f-906671bd1cac", "value": "736f8c7459170ca6818e5ca06c440711.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67822e7e-5763-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695179494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179494, "uuid": "a4d034a9-d431-4b5b-b88e-438445d61000", "comment": "Malware payload (RedLineStealer)", "value": "56b6847923e8705d0e53c18cedd081b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179494, "uuid": "f6fd8d17-3e15-4b3d-8845-9aadb3aa597c", "comment": "Malware payload (RedLineStealer)", "value": "ddf80c905896909531e54e2ad3a748e4b01f7baee199b79a182e36fd78d16d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179494, "uuid": "f611a8e2-58d8-4756-b948-e6f4b36ed786", "comment": "Malware payload (RedLineStealer)", "value": "af24afdc7f98b96fd8b4d775e4a555a6f815e5c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695179494, "uuid": "2a6e13f4-46b7-404c-be83-9a7ccf74c346", "comment": "Malware payload (RedLineStealer)", "value": "d686158034c43a9dee203244353a85720c843c9810fd8b8d8481b84dcc0b6f0f209d49fbc8333dec7e675b7b59f5d2e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179494, "uuid": "45cd6272-2710-43cc-b08d-77717eece3f3", "value": "T16E743AC1338269CDEC4F8AF2A961167A8A70D852E147BB537C4FACFB3C593459E051E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179494, "uuid": "4c146e82-0dde-4e1e-afee-a069d522d27a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179494, "uuid": "6eb4162f-1e52-4b53-9c8b-b10448c13b29", "value": "6144:33qapm384JCfCOXE3J4uSbJN3lEN1aPTi:nqls4B2uSbJN3lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695179494, "uuid": "d7130c01-df2e-4431-91ac-bdc73bc0d718", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695179494, "uuid": "a7e279b8-9734-4a64-839e-add98332f747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695179494, "uuid": "98a5f384-e9f9-4514-9681-1d309270f003", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beda4c07-57cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695225167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225167, "uuid": "1a46b7b5-7283-4c5f-bb5e-d6214f735d8e", "comment": "Malware payload (RedLineStealer)", "value": "97373c8d4eec9b90da288562b1a6c539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225167, "uuid": "15f49b6b-8cfc-4898-9d0f-5151721cd9de", "comment": "Malware payload (RedLineStealer)", "value": "de913cc20e1153df8eb9bc911eeede1f1c25358e71013592a12d0099b54ac192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225167, "uuid": "bbb8c898-ae40-47a1-b18d-cedef70ab1b7", "comment": "Malware payload (RedLineStealer)", "value": "b13cafc3fc8bb9035aaffcfe4a87aa80020302ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695225167, "uuid": "e5c1106c-2740-4a6a-8255-dfab4ac6b273", "comment": "Malware payload (RedLineStealer)", "value": "722d3c6fbd2f8613d3839c095326f87bc3fb8c3d7a3194314c06cea5cdcf176d2bb53e1bfc6efab9c400205ce2f9f112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225167, "uuid": "24270703-8c6d-4325-8306-e343c33339b8", "value": "T16A74012174E2D072D6A782315432DBE0A67FBC736C68854B37503BEF7E313929AA5706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225167, "uuid": "5530ec0b-5eac-437e-b608-e8da8a57988c", "value": "e1f9f27a83d13d8b0a5e72b935d02f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225167, "uuid": "15289bab-97e6-4c16-8158-ca423530cfbe", "value": "6144:Yn64VUBIvTO/nAJIR+2Ys+N1DFaaRKHtFXCbhMASuBk0bFfTWl5GTZ6:YnmBIYw1rENFyb2buPFfY5+Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695225167, "uuid": "9039664e-852e-426f-8e47-acbcf8718ea1", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695225167, "uuid": "5c806eae-0ed6-47b4-8754-6ddd449e8df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695225167, "uuid": "3d0136d6-3a15-486d-921e-1f4f2e901420", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14237f42-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229176, "uuid": "7659b246-de8f-4b09-82ae-213056f95270", "comment": "Malware payload", "value": "4518b473032a549e3314714f91dceb57", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229176, "uuid": "154b4812-11ab-4fb4-8a03-7f5ace90cb7f", "comment": "Malware payload", "value": "e0151a7929d3bc048806c5d9df0ccc33565abb97c09f2f7a146167e66c4c0f34", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229176, "uuid": "434e8858-3199-41d1-89c6-35f6dedd5aa0", "comment": "Malware payload", "value": "6581a67e6ac2ab58223fa1af01708baa13bad270", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229176, "uuid": "6d6c617a-58da-417a-ae64-c417269cad56", "comment": "Malware payload", "value": "21b356e230421813f23a9193971a5e1ba444494ac87eb70565e9b4a60630e4b1620260113ff5508605e287326a00ac8f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229176, "uuid": "7cd98e38-8a4c-41b6-9579-e192f937aad0", "value": "T13BE423F464B1A9F9DDEE2CA8D444E8164823FDC7029FA67ABDB2F39C171B3089127541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229176, "uuid": "9d6b7ffe-c95d-4cfa-9055-c1ac5f52c84f", "value": "12288:ND/h/BaxY0/mEvfszhCgUbYx/v7FkNVKUFgqXBAx2MRg2jCFbXk4Cfo386fIl:H/oeDE3yh2YNSw8K2M2bPyoM6fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229176, "uuid": "f229ac48-abbf-4696-aa13-59f15919861d", "value": 681258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229176, "uuid": "0017f6c2-2b51-4cc8-b234-d1b40ba50c72", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229176, "uuid": "8a48588f-df64-439e-ac62-acd8454d0dfe", "value": "lIDEOC2308-088562.pdf.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ba59a-5782-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695192763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192763, "uuid": "bbec6730-c106-4d5f-8788-e7d371f4932b", "comment": "Malware payload (AgentTesla)", "value": "e1c50f5b0c5fb41f89ea7ca750f517e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192763, "uuid": "45ff3d8e-31eb-4bbb-9aec-735c881d4900", "comment": "Malware payload (AgentTesla)", "value": "e108137aa0469b5a1affc9d86a92e9e844a9540d9082ca5511b67de114310f88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192763, "uuid": "8eb48adb-90bc-4e63-9782-d6bd55231efc", "comment": "Malware payload (AgentTesla)", "value": "6e0c88ab37021ce9d6eb9aae458fb1176537a195", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695192763, "uuid": "aec26d21-e87e-48c2-b38b-9cb67175b5af", "comment": "Malware payload (AgentTesla)", "value": "c70076ed20d16ffde8ff99ea8bb52df764d651c4caab94beea15c1e185521668e10302a02198c5a65233ac2f9d7f41aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192763, "uuid": "45d1337b-0dab-43d5-bf06-acbdb71448c8", "value": "T17ED4022272DA541BE6BE16B841B480146777BA4F3761D6DC4C8060CE1AF2B879BC3F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192763, "uuid": "134d51fa-27eb-4c1c-a5aa-5b456c64562e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192763, "uuid": "4a6087e1-3a82-4907-ac77-d0b7c7e24386", "value": "12288:tb+XsjfJw1UT9Qde0riZ1MCdbth4I9Q3D+vq3z5MvE3e+Co3HC2Oedw3:FxBwE9OBCdp4zQq3zivMe+b3HC2Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695192763, "uuid": "2ba0e735-c992-4c0e-b633-9ac5db16f99c", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695192763, "uuid": "c1c133eb-75db-4c59-9a06-a4f2efaff320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695192763, "uuid": "f2b1c609-3231-48aa-a36f-94c1f5140a1d", "value": "PROFORMA INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bd0582-57e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695233041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233041, "uuid": "3db12b73-0e19-401b-972b-96379fd69760", "comment": "Malware payload (IRATA)", "value": "f4b8b41156a0ad5237756fe81d88539b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233041, "uuid": "e7ac6e41-5e21-43f2-8b18-f929918fb0c1", "comment": "Malware payload (IRATA)", "value": "e1a2df175e6b092bd6a288b021816239756419ea4f27eeb32b8de1d7d6866651", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233041, "uuid": "b9d39be1-75d3-4bfe-84b5-dd4076b1555f", "comment": "Malware payload (IRATA)", "value": "de1b64994573ec4968e517c9932d27a09c02577b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695233041, "uuid": "b6dd584f-af27-412c-9886-f2dd16fa3ec3", "comment": "Malware payload (IRATA)", "value": "2f5d960eac9f49c0a1b88a5e0e7723977d6715650641fb1fed05a2b5563dd2aa794cb64ecd272b18d1393023f8c72049", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233041, "uuid": "5e4c1741-8faf-4c12-ba9b-a93de711f3af", "value": "T1F6A53393F3B2E02ADDFBA6B250145780A27B5D558F23412BAC14327E15B3FFE0B15296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233041, "uuid": "dacd572d-678e-4caa-a2e8-0aeabb87956d", "value": "49152:AEXLCQCWFn6f8pkFOIHaLJPZsH5NDQQOQXMEeRq+2Tz:AkLCQDFn6UpkFOIHaluDMREteRq+2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695233041, "uuid": "f76d0c92-d8e0-4798-9563-c1cba667e997", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695233041, "uuid": "639ea79e-94b2-4432-8fff-e0a1f8492527", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695233041, "uuid": "aca1900b-d97d-4786-b485-f0dba8b75097", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d9c4ad-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695228997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228997, "uuid": "f8d122ca-3036-49e2-819a-af610b477f24", "comment": "Malware payload", "value": "695d279ff2204e57c4a97d0842a146da", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228997, "uuid": "cd0ccb4f-dfe7-4862-8c7c-1af799675884", "comment": "Malware payload", "value": "e1cb3994f6a83b68870aa3b00f6d507d851868e3e5ea9eddac9b466174d89916", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228997, "uuid": "f663bb67-1a1f-48ed-bebe-f251099c9ad1", "comment": "Malware payload", "value": "715895f885353d98687ff8267f416c99e7fce9d2", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228997, "uuid": "900918ae-00ab-43d9-af99-d1f04d256976", "comment": "Malware payload", "value": "cd8f14d7da07d3a76d02c896808116220f2e81e25e3a9b818de90e26c6db97b9a907b55e4496ebb302c7c656484d7da3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228997, "uuid": "6d2bd2de-e936-4330-9e45-850e91dcefd9", "value": "T12D855A15F006C62FD79829354CAAE3FD77B87C466E899643314D732E3EBBA80CA46741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228997, "uuid": "ffb68ccc-e44f-4e2d-9ae9-5f102faa6bb6", "value": "24576:nT9+hG2EGuZuk0hnh4Z/t8qzZuM+nuYqAuFFFmwRWrnR6IwIvlteqFnlzIOI+lmE:nTklEG3P3q/aLnYADwRWrnRbcfKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228997, "uuid": "0fa67a02-f90c-4afa-9aaf-0e7b0d9252cf", "value": 1751040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228997, "uuid": "28231c04-4cd6-4fbc-b724-0f0f4453e353", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228997, "uuid": "aa192cfa-02b1-4983-ace8-db4598ac9526", "value": "VAT3_Return_P051372662D Aug 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5182cc8-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241874, "uuid": "1701407b-8d1b-4be4-a657-7abb659b6e61", "comment": "Malware payload", "value": "4265973418d8ceb57a09874080124bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241874, "uuid": "9c13266b-1a6c-4f2c-89bf-4cae1a9186c7", "comment": "Malware payload", "value": "e1d4bb21d92ff97e94b21dc94cd96aa33adf11cda9d40ca5ed1973982cd40fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241874, "uuid": "456888ac-0af9-4634-8b5c-51ec8b9664e0", "comment": "Malware payload", "value": "70eabfeccc3a073de301a6da86d73d855719f823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241874, "uuid": "020cc050-43a5-43c2-9539-764af907023b", "comment": "Malware payload", "value": "593f99e58ea27161abc3a386d3f34cd65671e7365ecfa3ef1ec2596bf1ae40fa45ee89480caa1809b92c34215b7bbe70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241874, "uuid": "b6261ba9-396b-410b-804f-6bb76b125f46", "value": "T1AFB23A62E8D288B2E22D49BC1D1DD538D43E3A353F18A1D3EBAF1D5ECD152C60B69271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241874, "uuid": "361b78aa-bf99-4570-bd68-ba43efc7c6c9", "value": "384:q3HqsREnZX3Qt02g2D9ZgNEVXR3fEyugibF8YLEwLEXpDsmCq33sjP3Gu:+KSmX3MVD4GXZEyuhhq5Db3Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241874, "uuid": "fcf2d772-8d17-4946-827d-a1b66baa9d0c", "value": 23718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241874, "uuid": "b5152b91-3e08-470a-bf78-0515c763d1bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241874, "uuid": "95c8aaeb-5687-4d89-9d6c-eedd96a428b7", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.32606.3338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c4f854-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695196345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196345, "uuid": "8ca5daa1-f37f-4bcf-981c-66e9aead88a8", "comment": "Malware payload (Loki)", "value": "8b4e0b87572717cfd3f2ae76df8bb81c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196345, "uuid": "42aeadff-8edc-4ca5-ae02-f9a9504bd95c", "comment": "Malware payload (Loki)", "value": "e27d7f51f333c66888b58f1baf06c3055787212fd0ff90b2a52de6e221ee4a7c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196345, "uuid": "6acf2dd6-a96b-4134-82c0-2937cfcc4d84", "comment": "Malware payload (Loki)", "value": "40ffb77814149ac091e855d05efa3ae0c1193158", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196345, "uuid": "cfb4adc6-1be8-4ad0-ac79-8c2fbcbef58f", "comment": "Malware payload (Loki)", "value": "d805da169a81128164668f0a15d3c9c0ecad1e84db2544b3a89b18868f389e95f72c1fc533e0ea651864e7f639ddcd70", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196345, "uuid": "a225102f-9aad-4d42-8249-45bc6d0338e7", "value": "T128456BC35CCCBA82C71982B7EB12F9FD062BFE4D948564DA3471EA4A297356D1C36039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196345, "uuid": "476458eb-9e1b-4594-8338-7dc5d59388ee", "value": "24576:FWQmmav30xSZy6w6VH6NXFZyLw6V56NHsz5vVQcTAZeiyfSwIN:EQmmQ306+6Va1P6VgaVVrTgyqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196345, "uuid": "2b169c6f-2ff6-4804-9f81-275efdbd5c48", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196345, "uuid": "e46d1400-9250-4636-a68f-48d57d3af170", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196345, "uuid": "dea90d99-2db3-450c-9031-466aaeae9344", "value": "MV SEA CALYPSO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bbdd15-57bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695217495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217495, "uuid": "0008b159-8bd7-4f0c-ae40-98a2649f488d", "comment": "Malware payload (RedLineStealer)", "value": "f0663a24bdfe5537728e18ac96228eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217495, "uuid": "44681cd1-b751-400e-808b-0c16c55c0653", "comment": "Malware payload (RedLineStealer)", "value": "e38bbd40978188c3684204df1a2767b81b3f062f2a432924401abc455ccf4ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217495, "uuid": "960e96a4-5738-4fba-8d66-a84f5f6b4c2e", "comment": "Malware payload (RedLineStealer)", "value": "9ae146136368d9054fe1b70573603606668258b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217495, "uuid": "2823ddcf-1d60-4000-8704-a7e5b66cb7a2", "comment": "Malware payload (RedLineStealer)", "value": "104aa17905a70d82356098b307c6469369d270793bed18f8c2dd69dcd8413261cefff6aea0e1a6b88f81900f4790683c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217495, "uuid": "22a00aac-3179-47fc-b586-2514e390476d", "value": "T15B74021179A2C0B2C5D7C1344533DB606A7FBC336A6589AB37A42F5F7E31382A96530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217495, "uuid": "f3f1489b-e58c-49d1-ae76-0bc4416e1ce6", "value": "d91386b9c0657f46a0e0fccbb7bb540a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217495, "uuid": "20de49a4-52c1-44be-8f4e-1bb3508c9163", "value": "6144:DHSX4U8AnRUAwY6xWwJ8FxL9WN+WIaD652+3z8r6zfWAxQyiDJKjnTu:DBU8A1wYJWcpDWLq3+gADYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695217495, "uuid": "7b176e14-3f63-47ce-9492-4fef5d39de77", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695217495, "uuid": "0e5fc4bf-1433-49be-9e5d-31d3ca36e929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217495, "uuid": "91cdeac6-6cab-4da3-88ad-f2919d60e59a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a89626-57c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695219461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219461, "uuid": "32a4edf3-eab7-47fa-95f2-7c72db526329", "comment": "Malware payload (RedLineStealer)", "value": "11e4ff765e4b89de70a720cd4f1f1e56", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219461, "uuid": "af648fbc-3bc2-4ecc-8e32-287b17d4f50a", "comment": "Malware payload (RedLineStealer)", "value": "e41491e0e5f83b43948fb6688113af954e297e7b2ed86218d41b18efd16c3c22", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219461, "uuid": "dc7768be-2136-49ad-9e36-7faf8b81b770", "comment": "Malware payload (RedLineStealer)", "value": "f96501e5245b3e0219519ca9f588e139a4f538d7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695219461, "uuid": "d27129d2-2ad3-4944-ad09-3bade286cd0c", "comment": "Malware payload (RedLineStealer)", "value": "65451913a384b072173d28dac994063ee8c5994dd773aceb31cf3cde6c26df251c726ee05b215a9f7295de3ad00c0bf3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219461, "uuid": "d78c2d60-5b06-4c16-b595-e99b4a8b4c07", "value": "T137141289EE1D15C728161C7E1A7A41C959E44A20AC332B4DB08782DFD31F94F39B379E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219461, "uuid": "8486f345-4cf6-4e26-a371-8ea78c86cf26", "value": "3072:4wCRUKMCP987zASVkw7OnCL7aYZCmLBwKGEF6ZNOomYPLN1IsAxWmVTV2Qdqv:4wbKX9Ez7Vp7OhlAwKF6vuyXI/bsQds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695219461, "uuid": "60530038-be35-46b4-bab5-9dab22c29a14", "value": 200299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695219461, "uuid": "113f34d7-3ca1-41eb-9f33-a8de0528ed65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695219461, "uuid": "489e4699-667c-4b95-8dfe-ff712c70c79b", "value": "Serain19092023_nueva_transferencia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d620881-5791-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695199207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199207, "uuid": "77878ed6-a587-4174-ab0f-0510fdb1512a", "comment": "Malware payload (AgentTesla)", "value": "0ddfc920f96032fe88083317dc5d109d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199207, "uuid": "6f93fdd4-27fc-4c08-a699-6cd9e812fb87", "comment": "Malware payload (AgentTesla)", "value": "e4b46a390ed3597681b12b1834985a5a8ddaf4cae96ff14ed8c2ed0d1784c11c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199207, "uuid": "bb95f7a5-fb2d-41b4-b159-efb0ee868f64", "comment": "Malware payload (AgentTesla)", "value": "4717cb135554de5f00ee23394d90e94e48140785", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695199207, "uuid": "0636a1f2-ce84-4a46-a33a-7400dc3d6b44", "comment": "Malware payload (AgentTesla)", "value": "6d99943306a1664dbf71ef6276fe44bf4ff080918c557cee431196d4be1c4c36cf766273e9095af72f15330f224a3531", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199207, "uuid": "3334d2a5-668e-4e1e-b231-75f1ac195ade", "value": "T17DD4125036B08E4AE45F1BBD0420059137B84A8AFEF9F7581CC6B0E5572FB998613B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199207, "uuid": "d0c4071c-0cd3-41ac-aee3-4a2ca34c43c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199207, "uuid": "c720f8e4-182d-420f-88cc-74af8dc21807", "value": "12288:uLfb98HzxK12vOGGzrn4PtDyTmbOYbZGqgUgMse4BpN:kbeTxU2vOGuaDyTmbfbZ0UgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695199207, "uuid": "c95406d4-2860-4499-a14f-5c1cd28cbcf3", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695199207, "uuid": "003da3ad-eaa4-45e1-9bfa-77b556f4cdef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695199207, "uuid": "d88aff6a-ef05-40c8-9de8-3534c8ce02c1", "value": "9oKJD6f1zhp0faI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d228f32-578a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695196281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196281, "uuid": "4acc95ba-55da-4296-937d-7cd1b198b6a9", "comment": "Malware payload (SnakeKeylogger)", "value": "9978b4e89a86b7e659e6d50737a5a2e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196281, "uuid": "7498aa7d-2cfe-4c94-8914-72304acf9a9f", "comment": "Malware payload (SnakeKeylogger)", "value": "e74eac907deb295455e5856a2f4030c175a134dd3f2d681cec2d59ebb387c275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196281, "uuid": "c3f18fb3-bbcc-41be-86fe-fbe3d32afe2c", "comment": "Malware payload (SnakeKeylogger)", "value": "ae5553562926cdefd411108d898fed36ed69bede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196281, "uuid": "946f6a3a-5530-40c4-bfc1-4073818ec227", "comment": "Malware payload (SnakeKeylogger)", "value": "7e7a8b5261a932df5bc0dce9b522dc1f3e557a8d9df18a7d759bcb53debbadb09465b0a518143a41a5755ea4d35a306f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196281, "uuid": "cf86e1ab-672b-4396-98a8-31b012ba9f05", "value": "T10163F677BE5987F2CA8C4735D65B48100374DF82B2A3D75A75CE33621907BEA990904F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196281, "uuid": "b18fee5a-90ca-4eb7-8db6-e82c684cfcc4", "value": "768:m4GpAgE5/XuIHDI0w7yrSAllWoqEqRyflqFwH9SKzaDq/qTplPWrFDF+84PB0/tv:aAgkuOuyrzlhl8c/ti6GCKoqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196281, "uuid": "990ae60f-f703-4c56-ba12-f07c371bb6ab", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196281, "uuid": "92d92a9f-c4fa-49e6-a76a-bb9714ab4eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196281, "uuid": "da8c32ef-539b-4d33-8fec-b7bcfeeb1a7e", "value": "Commkkhwb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883ddbba-57d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695228082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228082, "uuid": "b0949f9a-1087-4e44-8741-082b94872f9d", "comment": "Malware payload (MysticStealer)", "value": "3910dc0ce139ce0eef00292b37bbf59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228082, "uuid": "1fcb82a3-57db-4be1-a463-40eda9cabb69", "comment": "Malware payload (MysticStealer)", "value": "e8702ab87212b08e09958c604a9e039aa5c403888edafd401a29abc4cbb864fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228082, "uuid": "3d213f06-710b-492e-a000-55cb0f924642", "comment": "Malware payload (MysticStealer)", "value": "d1f8971cb3c186f0f087f44f1229c20b01f3cebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228082, "uuid": "bb627bbc-6a90-4d51-bef9-21501ce6d5bb", "comment": "Malware payload (MysticStealer)", "value": "4027b3e27db391493f560e4a0fc371e4bc57841bfb70c933bb32566c91aa8a46af6d22a7f8243949f5ec99f4cc8d8c99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228082, "uuid": "7ef53f4d-c082-48b8-8ee6-efa0953c8332", "value": "T130359E21789091B6FDE220BA43ECFD35426DD4F407250ADF1ADD17FED6606C26A322B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228082, "uuid": "d78bb152-9690-4f5e-a76d-ec20d291970b", "value": "275c1ac8a0a90e452d90c6b023f705b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228082, "uuid": "e0031211-227d-42fd-b8fe-aad159cbcd56", "value": "12288:lEFd2dAHOvLBwvJ5isrqJd0xSFzX6Z4t9J2X2NluGw8M8DacqpcicxUcLwopPPX6:Cj2dAHOvLBwvj5SmYYGvDaYBUo9Xr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228082, "uuid": "d3d0a7a1-9ab7-4037-9e9c-3aee29cd2a6b", "value": 1095032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228082, "uuid": "487a2558-e624-445a-8763-142d61121470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228082, "uuid": "2e160944-6289-41f0-9246-fda9c2323fd6", "value": "3910dc0ce139ce0eef00292b37bbf59f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6389abd-577b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1695190041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190041, "uuid": "77e7ba96-4713-43d6-8d39-a5876502c428", "comment": "Malware payload (njrat)", "value": "8aa083b7b4bbacee83baeaac0d8b1a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190041, "uuid": "dd8af7bb-1d47-44d7-84a5-b32bccefa50f", "comment": "Malware payload (njrat)", "value": "e907e4145bb52e87613beb5fc9d33f8d2204ed62df170ed80dd22f842ad9dc45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190041, "uuid": "3db50f64-e808-41e6-889f-439011bb38b2", "comment": "Malware payload (njrat)", "value": "7bfacce909426dd486f486e28d1acdc94c88c1fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695190041, "uuid": "ca2d5c79-fcb1-431a-942b-04e8d1a0d10a", "comment": "Malware payload (njrat)", "value": "87a0e9a7ecb285595f57d1c0283db764e22d7c2b9e24067234e76b7ca1fca7692697b9d0d1824861b9563eb067502ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190041, "uuid": "293c1a89-daa6-4f31-94b8-5bed49957527", "value": "T1D1E208067BE94215D6BC5AFC8CB313214772E3838532EB6F9CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190041, "uuid": "cc4939c4-849d-4588-99d8-aae9b50a7827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190041, "uuid": "6b58122a-32d4-4475-8cac-4b3515503aeb", "value": "384:B0bUe5XB4e0XSOxLw0Q0mS03AWTxtTUFQqzFqdObbt:aT9BuRC55d7ybt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695190041, "uuid": "ed202c35-934b-4e74-a3be-a0ac30e099f3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695190041, "uuid": "35a64d58-0f35-4bd4-b199-0530d06d11d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695190041, "uuid": "f6e4a2bc-2ceb-4501-a9ea-259bb67cdfce", "value": "bPVt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8741feb-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695228995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228995, "uuid": "a479b2da-8842-4bde-9f31-cbe56d8de4c4", "comment": "Malware payload (Loki)", "value": "de8dccb1065c19531df50171d73ed6be", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228995, "uuid": "6878025e-a44b-4564-95f7-31766c0511a8", "comment": "Malware payload (Loki)", "value": "e96b78b304d36170a18e1aaf50547133ddf8ab10925da128946136ce87e02cfc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228995, "uuid": "4ad59b73-96b6-4433-b5b7-f3569b59a07c", "comment": "Malware payload (Loki)", "value": "460332fa5c184a49e4d2a6012608a5b08004b4a8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228995, "uuid": "4a5ded89-6aa4-4b82-8bed-7dfabdcba7f6", "comment": "Malware payload (Loki)", "value": "87389f9543bb70ee98678ef6f1d5a9b91c9cdd3bb46defed7da4168f68f97f079530886a42bd20e774337cff500ff741", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228995, "uuid": "0e8735e4-86c3-4d0e-a4f2-9f361dbfe60d", "value": "T1A083BD6DD34F01A98F5253379A1B0E8442BCBB3EF24551A134AC537933EE93DA12A27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228995, "uuid": "ffdd7504-2f6d-4eb7-a4d7-73936d924a46", "value": "768:kwAbZSibMX9gRWjGwWgmbZWoUpEcU5igQc+B5Sr82lQXvuc4F:kwAlRr2EcaigQc+B5Sg6m4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228995, "uuid": "091b1d5c-4c7a-46e3-955b-46d19e3c11d9", "value": 84264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228995, "uuid": "7f0002c2-28d1-4c82-9fb7-cdf1e2711037", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228995, "uuid": "3975823a-1c53-43ce-95a5-1b1c9733515c", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf97b9f0-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1695195963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195963, "uuid": "41a9c330-276e-4a33-bd8c-58a72b6b0cb0", "comment": "Malware payload (DCRat)", "value": "1e3c187b5fed8acf3551143b9f7e4984", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195963, "uuid": "59f9e151-970a-438e-8718-4ddfcec46d06", "comment": "Malware payload (DCRat)", "value": "e9cab57867d919263c281a7e265804edd58e15c310d7f057216d28d9eef9c5dd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195963, "uuid": "c4b7e24c-237c-43f7-9381-32f6e306b00c", "comment": "Malware payload (DCRat)", "value": "4ea8775b219c1bb1bb6e4a0b70f33bd12e6eb110", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195963, "uuid": "ec6faf4e-d59b-4440-91e9-77d00265229f", "comment": "Malware payload (DCRat)", "value": "a81d4b0b345e7097c294d7440dcfaf9fb5c5a7ea914de0ed31768240d5ce7dfae27319277d4f65980c280b5017d4ef68", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195963, "uuid": "0a2453c2-8cea-4303-8f3f-d40b11ca136d", "value": "T140F533407ED305B1D4A21C372A357B222A7DFE616B7ACEEB6380562D0F716C0E635762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195963, "uuid": "df35aed4-f1d6-4a3e-98e0-f5cd18d902e5", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195963, "uuid": "0fff4ffd-b7a1-410d-b79e-83f11c40427f", "value": "98304:yUkoOGcm1MntLlZbdfAP82JvRfazM28rVSjNF0h1U:qEcmCtLlY8zMvrE5F0LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195963, "uuid": "a9134b42-fcbb-408d-8018-2e7ff6363ccc", "value": 3651246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195963, "uuid": "0150e475-5c9e-40f3-9fe4-dc289977bfc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195963, "uuid": "140f5225-5c89-4d55-ae0d-199f1587911f", "value": "1e3c187b5fed8acf3551143b9f7e4984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa09122-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695229195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229195, "uuid": "64a7f37e-7e1a-44fb-943f-44041700aa82", "comment": "Malware payload (AgentTesla)", "value": "005e8c25629dcc12b108fe095cc1cc53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229195, "uuid": "a4932ffe-3f3d-4d77-b694-4afb94bf5cad", "comment": "Malware payload (AgentTesla)", "value": "ea00a39d27021c79cf23c4af361a98707ca96f93f0743e51a0f7910c579eace9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229195, "uuid": "de2b5f29-b6e5-4ae6-9652-1566ab7933a9", "comment": "Malware payload (AgentTesla)", "value": "aa6d942c45ba7201b4c5dd3cde5e636a91ab7535", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229195, "uuid": "3bf1ebaf-f19e-46ab-a4f2-ab6b9bff2592", "comment": "Malware payload (AgentTesla)", "value": "eb7a0b6974c5ae3d2cd377936f14a685d4e574316308a3259c5fce12d01831ab648dff73c6983e336a63d242d3c9026a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229195, "uuid": "3bcac4d1-0787-4be9-b966-6234a5ff8806", "value": "T1C1F4338ECFD32B1F521F106593EA6681A56884E41B0F8F21F6E2AFC1151EDE1D742B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229195, "uuid": "966909a9-173f-49e7-8a36-a7e61d6e7311", "value": "12288:UEYsA8ZLjjNFwJo41SS3K1lSdQ6Jm02gK71a0bo7g3diSSdR03ovnd6KO5LFkBRB:UbsAWHNFx4PK1wQ6JrqaF7g3Czvd+yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229195, "uuid": "41f8cebb-5721-4cc2-b995-e53631a04137", "value": 759605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229195, "uuid": "2645e0d4-ffba-499e-8bf9-bd0a6584cd56", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229195, "uuid": "1dfa2742-c492-434c-a7d4-e0a47cb003d6", "value": "Purchase order 1500013452.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dd7380-57ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695238391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238391, "uuid": "873742a8-1708-4923-84d6-e793a0916312", "comment": "Malware payload (AgentTesla)", "value": "14f95a9216cfb77e249291e3899f69ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238391, "uuid": "8f515f33-8365-450e-90e7-dedd886a7020", "comment": "Malware payload (AgentTesla)", "value": "ea76d84bffa9794fe86505016d0370dd29db84fbdff79a26bfee30be32a7a0a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238391, "uuid": "45257161-9488-4393-ae83-2b1308cbae11", "comment": "Malware payload (AgentTesla)", "value": "9b9dd12cc2ad58c362411b8326c974d0cbce4a66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238391, "uuid": "254af4e5-6dfa-49cd-8531-3c92d4f5fa40", "comment": "Malware payload (AgentTesla)", "value": "13a021c20a88bd3ee86d13af37a798b8b920f00aedb63121be3b98ff048d7063016b06b26900dd2282e65fdba8aede52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238391, "uuid": "d06e62d4-73dc-442a-aeea-b21b02ad4bdc", "value": "T104D423124EAD49E3E0EE1B37183519E96333305B3E60F6C46DCBE44D2B29B16C726766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238391, "uuid": "9b6f3600-b2da-453b-bd38-47063765b673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238391, "uuid": "9ecbb37e-c343-4a74-8df3-73a2ae35bd47", "value": "12288:wtssrNQmar1b9IeczV6hBgv8HFl8mvNmUO6eETpw5YFS:ksZj66hBge/xfTpw5Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695238391, "uuid": "ab9336df-ea02-4601-9772-932db3eba833", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695238391, "uuid": "5b914be3-72e1-4972-9c56-a128e58c8318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238391, "uuid": "1645918e-fa72-4921-ac1d-487b79feee99", "value": "SecuriteInfo.com.Win32.PWSX-gen.1320.5695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5a6d8c-57fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695245534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245534, "uuid": "daf2a7ee-4be9-4918-87ee-7d92c7e56cd0", "comment": "Malware payload (Formbook)", "value": "accd49056a71495f54d8d83ac2a3e901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245534, "uuid": "c5eb1d92-d02c-4a84-8836-f901e8662ad5", "comment": "Malware payload (Formbook)", "value": "eb793e35af4458eb9591d27e4788f34f4d6babcd866879a71b307842bc68fdfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245534, "uuid": "2c33014c-7097-4778-8f8e-97889da701ef", "comment": "Malware payload (Formbook)", "value": "db64a0f588e606a7aa3edfa253ee29e7db2d344a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695245534, "uuid": "106f736a-65df-4710-8461-8dc50d9741d1", "comment": "Malware payload (Formbook)", "value": "5638d6fad2c29b8d4bc0a927f2b5bfcef32609b5d063032d569573d0a5480d9c22bb4bf729df0f51ddaa7c406cb01c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245534, "uuid": "6a4f0bf9-277a-40e0-99ef-fb9a61cf9207", "value": "T18E64233A9190C57BF9A19AB355F9075583A6F4193D384A9B5380CEACB932C838C6F371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245534, "uuid": "ae8b935d-c8db-4a52-aef1-4df18bdf3b1e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245534, "uuid": "e310c5a9-fac4-4afc-b675-a4827d4bed2a", "value": "6144:/Ya6+H0ub/yBxjqO5lhnZPQUMB8gqATNzelxXtl8CZriV/eSB:/Yo9byBsWxPQUMBgCzelDqCm/eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695245534, "uuid": "ba32d365-e779-47e9-a683-eb85b9a13219", "value": 335428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695245534, "uuid": "bb3af8b4-fac8-4906-807e-b6bc32922b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695245534, "uuid": "a65ad858-e173-4734-a3f8-04010b6ec94b", "value": "SecuriteInfo.com.Trojan.Inject4.61235.12113.20285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99156135-5789-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695195898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195898, "uuid": "f8046b7b-a06d-4fa6-b02c-35d2dc9c6e44", "comment": "Malware payload", "value": "1e678c57bf3f6ba695b0a68a16211b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195898, "uuid": "1b96ae8d-1548-4ab4-8b45-8bd0d6299de0", "comment": "Malware payload", "value": "eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195898, "uuid": "8d124848-66ca-40ae-b0c8-cc5e0451526a", "comment": "Malware payload", "value": "03e41e6d97b40eccf237d3b01108b0b44fcd85ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195898, "uuid": "e1b237b0-2255-4031-b01a-48f0565fc4f1", "comment": "Malware payload", "value": "dd6fcb7067a46d9b37e1dd02092ac414559829b7597f62678660f24389b45c9616bb8ee07150458843994a398d64a6e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195898, "uuid": "7c670ccf-e0fd-4b02-accb-9cc9ab165d5e", "value": "T13A95230277C09EB1D4A318731A76AF21AA7D3D700B7A4DCBA790661EDD361D0E631B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195898, "uuid": "cdbef6a1-028d-4639-a282-67db8e690167", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195898, "uuid": "fde058df-3cde-4058-ad55-be4d0b0ea869", "value": "49152:HdgfeYRUHTBeIGGoSntswWSSG+9UFibEBs/F6:HmPRSTBcSllSG8UFibWs/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195898, "uuid": "4a49f764-6044-45fb-84db-06bd831aaeb8", "value": 1923174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195898, "uuid": "5f04e3e1-6258-4660-965f-0f861fe0884a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195898, "uuid": "7e56041a-daaa-4437-81a0-46109ca6648a", "value": "1e678c57bf3f6ba695b0a68a16211b33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e562e09-5788-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695195289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195289, "uuid": "aedbd450-dfbc-4e36-9bda-eb90c2d76d76", "comment": "Malware payload (Formbook)", "value": "7ff646fbaa5bb955d1b0cfaffaf61cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195289, "uuid": "b9aef4b2-5d61-4738-872d-bc2c06737728", "comment": "Malware payload (Formbook)", "value": "ecd04804617988e39d5f075e021f6403a33b688ef388f75b897e4c4f7e21e466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195289, "uuid": "790f0958-5000-4802-a1ae-5482e12b8d1b", "comment": "Malware payload (Formbook)", "value": "91f6d86cc0cb5ef9860752d10315ce65a6b6fb3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695195289, "uuid": "dcec9bf9-5f5d-4e5a-be8d-817684741f7f", "comment": "Malware payload (Formbook)", "value": "ba41a2e55134449d123b6e409a625b42a3f19e68cc3f9fa09080224847e1123da1aae106a1523811060e22b4cb553de1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195289, "uuid": "a6964b62-74fd-4cc8-856f-d6026f26906c", "value": "T1476412687381C0ABE9670B720D7921650EB7E76328791B1B27105B4E7D1EB83DA4F732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195289, "uuid": "9a16f271-bf47-4785-8341-5a18ca024ed2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195289, "uuid": "61794d53-d6dd-414b-9d64-c624240374f9", "value": "6144:vYa6iwngrjoJm3rXSpywnBRwA6QfGO4LiC6aAV4Fii6RhUCpOMLILE6cv3ciy:vY0CgrcM7XSpfBRCQe9ujRRlTOEZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695195289, "uuid": "fe4d71df-f4ab-40bd-8c30-35c665befd86", "value": 335202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695195289, "uuid": "433481be-2593-48df-b644-1fb420163355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695195289, "uuid": "7273408b-f7b5-4e0e-a6ba-4e45fc39097f", "value": "SecuriteInfo.com.Win32.PWSX-gen.14586.8892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b62c5d-57d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1695227623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227623, "uuid": "76a081f9-434d-4444-9572-aea2c779ff26", "comment": "Malware payload (LummaStealer)", "value": "c098332ec27956c434ac64d9a8a0b40f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227623, "uuid": "b5f32b98-cfda-4e9a-af44-f0a6f64fc144", "comment": "Malware payload (LummaStealer)", "value": "ed018ef0a763e00215748a3cae77a50da43c5f6535c38d3cef8e9da891103231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227623, "uuid": "9f5b1242-44b9-4aee-abda-f18e07e69236", "comment": "Malware payload (LummaStealer)", "value": "6ad068b059ef9b5d784d626d89ab5900154b55fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695227623, "uuid": "8fa3ae00-0872-43a8-8f85-ff14b92df728", "comment": "Malware payload (LummaStealer)", "value": "46ebd45c157c8c93ddf2f1cf6cb84ab6602cc9ed91051aef7773e308aed7dd1d07764cf3f24bcdf4c4b4b4cc4f937350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227623, "uuid": "22e81d47-da90-4b07-86b2-00324d0c0fb7", "value": "T1F6E4CF4574C2B0B5DCE72D7242FCD632AE2CD4350604E47F2B63CFB9A994E826D28796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227623, "uuid": "b8e4cf6f-1493-4737-b135-5dcda054b5c9", "value": "de0e1cd3f7f230a08b0c0eaa01245c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227623, "uuid": "7103d9be-0361-4e18-b00e-6f22a41ea564", "value": "12288:w3KoMJX4S3v5/xZSQYWeJsQUaWj6d66LlYnXAc9dV8C+P+6+tRGOEmjdv82l6KBA:w3TMgjDBPLaLVnAXmG2QVfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695227623, "uuid": "b82212b1-4b1b-471e-8bed-b34f15eff2ac", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695227623, "uuid": "5058b8f3-f1c7-4495-aaa5-5d60e42a4180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695227623, "uuid": "51761050-14a6-4f66-a44c-f8d9bd973f2a", "value": "SecuriteInfo.com.Win32.Evo-gen.8395.4192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e69af01-57e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695235689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235689, "uuid": "22a872bc-f659-4f84-a1cc-0d619d78c7ba", "comment": "Malware payload (IRATA)", "value": "28d0ae582b42ea1ad2c529a5b4d92346", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235689, "uuid": "5261e32c-abed-4186-a44d-704464273c59", "comment": "Malware payload (IRATA)", "value": "edbc924e7f9794940b43b5cbdb44df56d1ff1eb61248ce3c6fe89bc339857d85", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235689, "uuid": "9b707077-288e-4c7b-a5cc-f44cc17a3f04", "comment": "Malware payload (IRATA)", "value": "c09962db554c6281cb01bf7d597de7397a64ddfc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235689, "uuid": "fba776a7-6005-4f53-b944-702914b11024", "comment": "Malware payload (IRATA)", "value": "88cbe13177e8e0985651dc7a9f5fff71ee6422880587ad8fa2b5509664ca76f2bea8a0069e39f424ced5faffd43a8e38", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235689, "uuid": "ea2749d7-dd4e-410a-b61d-9073757eef18", "value": "T11DA533F7DA21C015CADF92B0A075A25059F73E220D63995B35D4B33C29B2FFE8399A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235689, "uuid": "6a214fc4-4716-4591-8ab5-a536ac046bb6", "value": "49152:AEwz50/yWqc6dse+I/hdDcm4KofyLpc856OEb4DKeI:AJ94TD6Ke+I/X4Kp/c1kDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695235689, "uuid": "3d266484-bbef-4ccd-bfdd-4b2e8bb728fd", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695235689, "uuid": "945f3f33-2e8a-442c-9e00-f0989a67c011", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235689, "uuid": "ffb4c383-71bf-402a-8658-e74952b4cf16", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163d36a3-57d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695229179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229179, "uuid": "3a80469d-5902-4d1d-ab5f-8cc9ef7d1c62", "comment": "Malware payload", "value": "74b2f7699f498477bf0e757add334de9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229179, "uuid": "02c2b7e6-98e3-458f-b62e-361fec49e2e6", "comment": "Malware payload", "value": "edff0c21aa1e97501ebe009d4cc81f83c1bb6222a628be773a7ec0fa8e0dc711", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229179, "uuid": "462a09e5-33d5-44cd-8834-7cd502fbcc58", "comment": "Malware payload", "value": "c95e27b2b7ab0074b6b2901d41fa33365cf5c2e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695229179, "uuid": "bceddb29-e960-4563-8bd5-ae7183a4711d", "comment": "Malware payload", "value": "1510848fc580d774e81b78a22f6719db3d07e2ae4f4c9dc6414bb8672c582bbbf6d2d76ef7a9ca03694a13de2ed89f60", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229179, "uuid": "5f8ccfdb-40d4-4617-b7f2-f76e983e817f", "value": "T1F8E4231EA82A84B5AFBB735C121F6DD07A275E6B991F014997E1F30C88C46AF07D0BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229179, "uuid": "0d6c2196-2477-4b62-9620-150ccc709d4b", "value": "12288:ePTaLpvVbk7lSs5uGP7Kpvt7n1NGuYf84sGYuNHs93v4a8XJFoEWaMwkq2M0kOWq:cTaLJVhs5Uvt7n1NGuMseU8ZFoOkTMsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695229179, "uuid": "8bd4173b-4b05-427c-903a-780a68ca0362", "value": 697687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695229179, "uuid": "76e92ba1-020e-45c8-bca2-738a448d94b7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695229179, "uuid": "9d605c32-372c-4c09-9082-3fc4750debc6", "value": "Quotation_091923.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcfae4f-57eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695237832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237832, "uuid": "eb5ecdc0-3f12-4e91-b3d7-188ad790f694", "comment": "Malware payload", "value": "47b71dd381f7c798944b0f137803f3a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237832, "uuid": "5397881a-8ccc-44e7-867f-ed846846db10", "comment": "Malware payload", "value": "ee71c06dd3be0dc446332865efe81e5433d9b1a679cb8aade839a17379fda5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237832, "uuid": "b0f8c3bd-59c2-47c0-a0a9-57c6bea59e52", "comment": "Malware payload", "value": "887714d31fee90b70fb6adc2598a5d6ba110807d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237832, "uuid": "8d8de58d-0fc1-4246-821a-be332033b9b6", "comment": "Malware payload", "value": "976d79c8773ca55ed52a21cfc8304c0e943d4384105fe50ee3f203511987baa41cbe9eb3ba4c67d56cb49493713a267f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237832, "uuid": "0533295f-fdb3-4085-8fc1-a7752ea474f8", "value": "T129552347A6D41811D67883B1A4F212C31F33BDA25D34AB2E379BDA6A2C721D02277377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237832, "uuid": "44ff4412-017d-4dce-b605-7d6279250911", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237832, "uuid": "24b6cad6-48c8-47a8-867b-d84bf1f8a622", "value": "24576:dyZpEwtiE7hgnY5c8l8Ugdg2GxKf13RMElW6R+Ie5M36bZ7GRT6GrOiGI:4ZpEwtr715c8CFiA1BX/Be31Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695237832, "uuid": "ed36365e-98e2-49b0-91e3-e6ae97fd7fc7", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695237832, "uuid": "be531b6d-5f26-4787-ab41-c366809a5dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237832, "uuid": "eb96ef13-1ed5-4418-97db-80b016b6b4bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa1972e-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695241884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241884, "uuid": "2fe3d551-d1d5-4bd0-9948-bd66266d7d3e", "comment": "Malware payload (Loki)", "value": "c9073e82ea54dc807fb8c89d205ef7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241884, "uuid": "49d9338e-f9a3-414e-bfb3-668ee215efaf", "comment": "Malware payload (Loki)", "value": "eed23ee8d7612d037ba0bd6873b8fa9fc3a9cab674b408c0f7c8be84e9297a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241884, "uuid": "29051db8-1df1-4aac-b05f-dc0d13ec402f", "comment": "Malware payload (Loki)", "value": "148111789603406502edd1206b3eff3ac99c48d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241884, "uuid": "776b6f0c-b087-4a38-853a-6178132bbd28", "comment": "Malware payload (Loki)", "value": "502103d4f33b6c15f3abedcead9055beb662cf55b317a49c111c3392cdd17ab27c4f6099357318cc5ab5aae46c42c82c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241884, "uuid": "f085fea8-8555-45d8-b333-3c978a3c5762", "value": "T1EC94224B6B489AF2E1E637B8251608857776B6C37836C36C8CCF615C1FE1F019B5A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241884, "uuid": "5809fb20-727e-4141-933b-2ab6a5bae517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241884, "uuid": "0048ed0d-e390-4ef1-bf4d-fefb1cae4f43", "value": "12288:37zrz1kfaYIgGsj0/9xc2tZtzMHAXF1+yrQIkXT:LzwaY+u0V5tHME+oUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241884, "uuid": "ef179657-8be9-4c9c-a0dc-69a01d586dc1", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241884, "uuid": "468223cc-565d-4c2c-b2a7-79aeb9b6a6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241884, "uuid": "c9e1c759-ff3e-48fb-95fa-b2997e6e8f3b", "value": "SecuriteInfo.com.Win32.PWSX-gen.30995.30350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11180da-578d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1695197683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197683, "uuid": "0f0536fe-ea19-40ab-bc3e-a5cf5ed5c371", "comment": "Malware payload (BitRAT)", "value": "18e07c4772a2687ee06a434ffef9572f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197683, "uuid": "d3302758-a3ee-4abf-a074-bce5f46e6041", "comment": "Malware payload (BitRAT)", "value": "ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197683, "uuid": "c3438dea-61e2-4a04-a392-835d5ce83534", "comment": "Malware payload (BitRAT)", "value": "ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197683, "uuid": "6b32a1e3-40bb-4216-ab6b-241d61193758", "comment": "Malware payload (BitRAT)", "value": "e2883eb44604b3b9d88eb43245fd835a7290217e23774bdce7747c0c3cca5bb5f764213c3f83c5073a6fd2048c2b725f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197683, "uuid": "6199d3c6-f3cf-4694-a947-9ba930a65328", "value": "T15F863397B424F3D4C4968977C5D08AF162912DC35683FFDB39CB3D44A92B6E0CA610AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197683, "uuid": "abc86d00-8495-455e-b92b-de695568ee1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197683, "uuid": "3b837b43-b762-4371-a110-34ce3ba7d9e0", "value": "196608:eMoIG1kQ7PENK4JQp9ny9MK07ZMCmPSxF:gJB7PGqKMKeBm4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197683, "uuid": "e9c65b18-de16-4604-90a7-dbcad5670e34", "value": 7963648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197683, "uuid": "9b69c187-ff3c-4029-a5de-836d5546e87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197683, "uuid": "a53a109b-904b-4e8e-a1a2-ea5cf58d1cc4", "value": "18e07c4772a2687ee06a434ffef9572f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8038437e-5800-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695246966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246966, "uuid": "af5c98c9-abb5-495a-ae1b-1a26310ffefe", "comment": "Malware payload (MysticStealer)", "value": "a97c8dfc5e061cfc5e2e6817b7c76c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246966, "uuid": "2b695095-f758-40e6-8c72-e13819af2837", "comment": "Malware payload (MysticStealer)", "value": "ef838597447eff451405481eeefd6cff4d9d8f0b2a069e336253482b522ea83b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246966, "uuid": "f4e15dc2-a33e-44e9-8443-27107c664d10", "comment": "Malware payload (MysticStealer)", "value": "a78dbab8b472e19a5dc9cf9757963e7ba81d1eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695246966, "uuid": "8b82cebc-ad21-447e-b2a1-49037e087c0a", "comment": "Malware payload (MysticStealer)", "value": "aeb9bd36098c433c0a4f99ff547cf1ce3d62d0aa9bfd05ea9e7ef914a9ef0fc5770baea79772aa83377ce3091a2e998c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246966, "uuid": "361bc101-a696-428c-9ba7-fe37dd3276fc", "value": "T140352323A6E88873E870237559F7438709327CF09635A76A3781697C98737D5E63232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246966, "uuid": "b5bace8e-464e-47ff-89f8-4395e994d2fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246966, "uuid": "12430fa8-d164-4e00-b7db-89fa1ac35e52", "value": "24576:Ry/nw5UwS20veuyvtELz1F19e2Nx0dUiLWlkJx2iwBkhDN:E/nw5V0zyK02FMSkEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695246966, "uuid": "d3bee10c-6ad4-435a-b6e2-06eff54d6618", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695246966, "uuid": "01eb4acf-7121-4be4-9b84-7df7652badde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695246966, "uuid": "3b476b90-b353-460c-9ef7-b92a5a0c55bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb982b3-5759-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695175426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695175426, "uuid": "668f9a3f-9e3f-4880-aa7c-6e3630128414", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "fba0d6851cc41322f01b38a3ac5d9cd5", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695175426, "uuid": "8baf749b-32c8-48e1-b0f2-d4915b663b95", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f0bb88d1a9cdf4824c93c47de1b3553bc0752d5e34c34ea7ca3c28cc566b086e", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695175426, "uuid": "1a65384e-4988-450b-be7f-f867ba9a91ba", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5c3abb11ac55f81b6870399a7fa79dee0caf9685", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695175426, "uuid": "35c1457a-21d2-4831-b3a4-8a03ed545a9d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c97c4f18da9345c8dbafdbc009905c527392c6d7f7d3431d643feef524e59371105614262d7fe9b0a8203754b62e26e9", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695175426, "uuid": "e88972e4-6c37-4375-8dbf-eb16894eb664", "value": "T1E4652303BBD065B3CDB12B7059F713932B317CA24F34926B5B81E5AEA172180F574BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695175426, "uuid": "9b759b85-8abb-4a96-b164-abbffb14ec97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695175426, "uuid": "85fd384e-a001-4baa-b752-c636d5fab726", "value": "24576:iy+AUUmLhEPLgj9FDp+GZbpIDAZO3cradOHyIpc+/iRFdKjbCd4BRGixhK:JbmLmPsj9JN8Qyc2dOHfpc+KMjbUS/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695175426, "uuid": "0bccffd2-57ad-487d-a802-54210acc4262", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695175426, "uuid": "62d4f897-b670-4f46-a15c-715d51f67cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695175426, "uuid": "8ed99b3a-868c-4ff8-a112-85590dae7fcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d17b758-57f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695243445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243445, "uuid": "5913204e-8521-4d25-a264-7b06e3e425db", "comment": "Malware payload", "value": "316b3cd64660deea5c399f6a015e8cb4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243445, "uuid": "58d54b60-ccf9-4078-9ad9-d95568c239b4", "comment": "Malware payload", "value": "f10865396cbc2c28ae06f1006169e42ace0fe112ac590a580396b54bdbc2c558", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243445, "uuid": "fe3ee347-34ac-46bf-9847-01b124e495f7", "comment": "Malware payload", "value": "5044818e062c36f386f9abba25845f95ae9c2b3f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695243445, "uuid": "146c6c31-6d68-4b0a-a214-be8ab0552d88", "comment": "Malware payload", "value": "fa5e86ae5bb1872ca04a9fb5b60731b8a2e5f681a36069714af6b4a19b56ef031449576bf6f25624611dd2dc151f93d9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243445, "uuid": "752af03c-d07f-4137-9161-202dd17d2954", "value": "T19B951213F652A86BC4F1D33221B9163220764D288B43FBCA3E5977B928F79DC4B916D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243445, "uuid": "ef60a497-f866-4897-9585-af39ed70140f", "value": "49152:I/ZS24j8hrC8sBw9p+7Ub4Ym3UHBmiGw0:WI24jNPup9mEHB6w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695243445, "uuid": "51aeffe5-1c1d-4c9c-bd6b-e671c8219763", "value": 1991406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695243445, "uuid": "efe30afb-a581-4742-80fb-58a937be65e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695243445, "uuid": "906b9664-5441-42d0-9297-fd024f76a105", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6137ad5-578d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695197718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197718, "uuid": "ba91c7fb-c54a-4b95-b2af-2aecc63c8f4c", "comment": "Malware payload (Loki)", "value": "75b192f9b810dedde93595a8a1b1dd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197718, "uuid": "9734209d-f46b-4a9f-b89d-b18360cef633", "comment": "Malware payload (Loki)", "value": "f1ea8c37671f60ae1dde6ef3ad770e623eedc7a2c06eda822708533b52f2c2bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197718, "uuid": "f74c4ece-9978-4f83-94eb-edfefcc6556e", "comment": "Malware payload (Loki)", "value": "be1fc2476135c94ab30e1c0f48e97417066ec26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695197718, "uuid": "d170c571-0dc3-4d7e-816f-69ef6799f022", "comment": "Malware payload (Loki)", "value": "1c3eaf0e6c0ff361b20f4356cc42af869feb98f7e83c184ce8cc56f9f201411ea2da5f60ec56c56dfc4b365eb9c272fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197718, "uuid": "db718c72-1635-4ae7-b8d2-a8903246c0e9", "value": "T191A4120439640B86E95C0FB9097028552770FEABF866E7245ECAB1DA4E56F79C30378F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197718, "uuid": "3195d4f2-5d60-4deb-b528-100de903ddf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197718, "uuid": "9cf55823-4953-42b9-baf3-5ecdb5b425e6", "value": "6144:5f4NOk8oV/BR1z/8XICVmlBFEORDX+dSHEQLq5XrwM2/76trCqi1FOtbqvzlMRNZ:oB2XQLq57CorCqijOYvzlMRTKJ/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695197718, "uuid": "1fdbb073-0850-431a-b8c7-ead594e0aaee", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695197718, "uuid": "916b7bf4-d901-4bfa-964e-babc0a4ae51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695197718, "uuid": "e80de9f9-eb27-47d9-8b27-df1f457c2618", "value": "75b192f9b810dedde93595a8a1b1dd8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cc08ac-57be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695218418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218418, "uuid": "f128b73d-10b0-4373-9a61-0f5ac19eba7a", "comment": "Malware payload (RedLineStealer)", "value": "1c9cb19f72b337353fab5826b145b2f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218418, "uuid": "918a9181-fb93-45e3-a8a9-45b1d1434961", "comment": "Malware payload (RedLineStealer)", "value": "f217f02bbbf1b37386d8611b2ef07dd562d33dc1b31d84a260e11decf082b66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218418, "uuid": "c7bd4f37-f097-43c5-aecc-bbd70eb4f4da", "comment": "Malware payload (RedLineStealer)", "value": "2fe6ddb2fb7fc0082388904ffddb5902c520179b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695218418, "uuid": "39b50c32-dcd8-4584-9d78-b94d08bcab8a", "comment": "Malware payload (RedLineStealer)", "value": "0f29a8b86b94ccbd03bd300053ce914d1384a33425c6a02b40bc7fed49ebaace0904297f3caf912b9206f4b6d3eab862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218418, "uuid": "da23d1d6-181c-48df-a34b-392095773c1a", "value": "T11565CF183A84D985C1A9633EC5CA04284BF4BDC32772ED1F7FDAB7AC64117D6680E4DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218418, "uuid": "593eb53f-c31d-407d-a64a-1f60ce90f139", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218418, "uuid": "f51d2ed9-ef71-4308-bfe5-159e50be4c90", "value": "24576:Slu3eXnSurrbe0DUBB//rAMg2aUqC3qRo/H/:SqSSCXe4ULOcqRC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695218418, "uuid": "a9f2fa87-c729-4b5f-9a36-08d58c3ecf51", "value": 1429840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695218418, "uuid": "884072c7-2a7d-40e0-8411-31ba22ca4c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695218418, "uuid": "4d540a99-e2f4-4e0f-806c-4b43a0d6e131", "value": "1c9cb19f72b337353fab5826b145b2f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44638a84-57b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695212936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212936, "uuid": "89ec8810-0157-404c-add7-89d58e063369", "comment": "Malware payload", "value": "f263efb1b579cc33a0f1024c2a18d03b", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212936, "uuid": "a3b7e5af-2709-4f59-8bee-90c5344083a5", "comment": "Malware payload", "value": "f2732f9e3a87d874a3108f8ff0be200bcab9d07fe77b02aaacd94da1efcb3963", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212936, "uuid": "7a5859a5-c41f-42ef-9551-1d82cd194911", "comment": "Malware payload", "value": "e9dc916b6d4606ba47e30787387dcfd490bafc56", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695212936, "uuid": "5cc5fc98-1196-4e4f-bfbf-db7763745b6b", "comment": "Malware payload", "value": "eec10822717a87f92142de106d5ca65a760be5ab49d9fc6e67a5c218ceb8ec04c41c815c1eabbdbd406189dc4c53df01", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212936, "uuid": "8bf68fc4-3580-4a47-98b4-c7fb77c4d2ff", "value": "T16AD423401AE90210FABBBF7858BA00866576B327CC97DB9C554A152C4B3978FCD62F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212936, "uuid": "55ef452a-e565-4ebf-8d9f-a46b9a908b76", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212936, "uuid": "c47870eb-ecdb-4ea6-8269-e77c8f698a00", "value": "12288:F+RkGrbk/x95DR7XZdfrXg+JwuKt/S/60pR5kjo5Bda7EptO:okyk/x9L7Xfw+Jwz/S/69k5BkApt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695212936, "uuid": "c49e2813-5e34-4979-ba54-c10ef91e9ca0", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695212936, "uuid": "6091a2a8-ffda-4833-9cee-d21fb3d8fd5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695212936, "uuid": "331c58b3-6faa-49d3-b4b5-e3102a080408", "value": "WeAreDevs_API.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b52a3d-5805-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695249229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695249229, "uuid": "b42780b1-58c0-4222-afd5-2626e9bf7d5a", "comment": "Malware payload", "value": "2a84e38f867c90f884c679f077bc30fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695249229, "uuid": "254f7fee-2649-471e-8daf-905f373af05d", "comment": "Malware payload", "value": "f2d7edc7925c6833f74b5a354f0b0a8edc82cb6adae7e8779ef36bf3250e3d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695249229, "uuid": "a060db7a-ee06-4b42-be1e-9d8668ea942d", "comment": "Malware payload", "value": "c4feee3eb509e06ebc943078d2e48f1b30062b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695249229, "uuid": "71c3f4ee-7e98-4f9e-8eaa-b9075f2323da", "comment": "Malware payload", "value": "b38ab1ebc7f8a6826b9b09f6a4643be3b68133ed0c3c2cf0c79b62620b880cc385d7093f00767e17066d1285f5f21fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695249229, "uuid": "39bd6719-ecdd-4dbc-b345-4ff17e48641e", "value": "T1C7552342ABE4A1A2CEF6277529F912836B3BFCE04D34876B41457C9608F32E12575B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695249229, "uuid": "d02e8660-13ec-4c3b-9140-67b4f754333a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695249229, "uuid": "16aeb941-c765-46e6-a343-0bdd10a5281f", "value": "24576:XyAMkE/zI/qRlZWyQxXgGGqbhnQZi4FtOgAqjDqwdNvGBcBvzM0h3OmboFcxvnd:iAu/zI/ylw/txbhQi4OgTD95GUzx3OOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695249229, "uuid": "1b66771a-663e-43c7-8fca-744b446cca64", "value": 1358848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695249229, "uuid": "f41729c4-5876-4d27-b851-667f28274fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695249229, "uuid": "e51505a6-059f-42ef-b88e-74eddc342a94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110a20d9-5787-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695194811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194811, "uuid": "f1f4e254-fef9-40f1-9872-a3a318ddf042", "comment": "Malware payload (AgentTesla)", "value": "5f794bed7fe4620ecf5f348acb9c126c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194811, "uuid": "0a54737a-ee4d-4fec-9f86-67bdb7e61530", "comment": "Malware payload (AgentTesla)", "value": "f40634df7d95e40866241f72fc2f1c36cebe90304662b81fa4332b0c19f81f0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194811, "uuid": "8675b7d1-e48e-467f-b89d-a1d540f35147", "comment": "Malware payload (AgentTesla)", "value": "ab9d0b014eabdfcb46480882bd0390db14d39565", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695194811, "uuid": "691c40fc-c725-4293-84e1-d97132b6412d", "comment": "Malware payload (AgentTesla)", "value": "67a05f47849c8e4cdfd5ab83b285e0b3b6af1ffbc19db61f3b348e0498da21b83de41c776fc146aa454c74e886acdb76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194811, "uuid": "52ed893d-edba-4d6a-bd82-8f50864dfce3", "value": "T15273CE6DD34B02A98F5253379B1B1E4542BCBA6EF38552B1346C433533EAC3DA1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194811, "uuid": "f3779b6d-b259-40c3-b625-cfbd2772ff24", "value": "768:ZwAbZSibMX9gRWj/C0+vqACfHaJniz/y0etRUF5xcDKhSkDEJKbi/:ZwAlRvZvTnizK0B/TSkgJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695194811, "uuid": "b65b40a2-6306-4558-981c-5e39f5f7e4c0", "value": 79537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695194811, "uuid": "69250855-675d-4558-8822-525eec6a8134", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695194811, "uuid": "db49351d-acf7-40ce-a0ee-3260fdbeaeaa", "value": "New Order doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a315406-57b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695213509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213509, "uuid": "f48de703-6132-496d-8455-e0cf190f3b47", "comment": "Malware payload (RedLineStealer)", "value": "36333ca9f17b0a7d01f74c5d26a997a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213509, "uuid": "d852777d-3ddc-4a76-8efa-b799271abee4", "comment": "Malware payload (RedLineStealer)", "value": "f580c832301b75fab74e341f233314129465e26a82aac5284d427c76f9c4ddff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213509, "uuid": "f165be82-8e0f-42a0-93bd-38bc840e8db7", "comment": "Malware payload (RedLineStealer)", "value": "e2240764ede6fcc3f2f437a6d5e48b994dd4c4c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695213509, "uuid": "e4c292d7-38b2-47bc-9950-df5aff864ccf", "comment": "Malware payload (RedLineStealer)", "value": "0989cff7071389c25d08b39d644b3dec9464667c8f19b565a96a3221f29a5fa22de44aa7059616536c3c411d0e9d0993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213509, "uuid": "ff309d70-ed1c-409e-9c56-107ac720f410", "value": "T1EC652366E9FC10A2D8B61B710CF903932B34BDC645341A673B87A86D0DB36C8A57573E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213509, "uuid": "81082e8f-5dcc-4851-ac4a-0e18a512a98a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213509, "uuid": "757f6581-8da0-4749-8b0a-1ee1d4c4f4ae", "value": "24576:kyglFhrHbSzxId2v5c8VuhxdVHJEzC7JNtFUTL3To4Wc9ibB3kMAcdmKN5mbSX:zglFhDbSzxId85crvVp0oMLDo4FcbBRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695213509, "uuid": "78934003-93e3-4dbd-9f50-2e5979550e30", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695213509, "uuid": "b92423ea-24aa-4e23-92ac-73f67b536126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695213509, "uuid": "a09e8d73-ae47-4a86-9e93-0373f0834ca4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d744e348-5783-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695193425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193425, "uuid": "c3d181f7-4536-450b-a5b0-8f651c36a05b", "comment": "Malware payload (RedLineStealer)", "value": "130863064893bacd6109bf899c5da50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193425, "uuid": "a6493853-2466-45c7-b025-452fb78715f4", "comment": "Malware payload (RedLineStealer)", "value": "f6cbadd1b54e99b4555c3db5566df1c4a0fb50ef8b198e020126ce8006dd6b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193425, "uuid": "96361348-9287-49ce-aaa9-6db43033a9c3", "comment": "Malware payload (RedLineStealer)", "value": "b6134ba3a1b0143065dc6ae0f0ea93969bbed04e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695193425, "uuid": "6ad4b1b9-0729-44f4-8d3a-30b6283aef2f", "comment": "Malware payload (RedLineStealer)", "value": "e93c5eb06f5c7cba1567f2d9c6367b22ad56a009060912cc1bb22cd782b7c38c84af73ae047c3a162f291df7921f2b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193425, "uuid": "70b70a43-997a-4888-a471-71aac5e2df78", "value": "T1F22523529BE44073E2762B7128F612D30A36BCE66D785B5B1304A99D9CF3780EC35B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193425, "uuid": "5e5626cb-2e05-4b6d-a9a0-85b344fc6111", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193425, "uuid": "ca81f334-d53d-47ad-9370-6d46d40aa262", "value": "24576:YyNpWniIIb+ikIn9YzecWtDZWdxMV0hmyn+aWsWP:fNpWni5+bI9YzecspVKT+aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695193425, "uuid": "b044fe2b-1c66-4500-89cb-3cf25977ad8d", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695193425, "uuid": "36cdaca1-a56e-4000-be77-893bcd1768fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695193425, "uuid": "cfade40b-3a2e-4e84-a21c-8ccc4760044d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb935ab-57ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695216765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216765, "uuid": "285aa771-a10d-4983-b14e-c1413a9fc211", "comment": "Malware payload (Formbook)", "value": "790fe61107ab269e5bac5a605f3c4df3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216765, "uuid": "7c7e89b1-bb3f-40a3-b90f-5ff2fc36614a", "comment": "Malware payload (Formbook)", "value": "f6ed00024799a0805589a69c72076a74d27a8e00d044802f34d51f4192649a9f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216765, "uuid": "b6fdf85b-3c09-4361-bbd0-41e2d68ed4a9", "comment": "Malware payload (Formbook)", "value": "bc624029c96a388e3bc2e1bd4f9cee8ffbb1a3e6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695216765, "uuid": "139db457-d01f-4ef1-9533-b005cf7a7197", "comment": "Malware payload (Formbook)", "value": "4fee5a5664f6109fe1e7f83a4fcf5844a4b411d9021bccd5ca2811d4fb8d519051479e3199686ec1aadebe25a80d9b5c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216765, "uuid": "52a24358-3563-40f5-a3d5-741214ade245", "value": "T1D8E52D35727439C6D323C2A1824FBD466218F8C7F3E65E95834EDAB41CE5DB1AF01A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216765, "uuid": "088b2b88-8a95-4943-b0f3-cd54c84c1f43", "value": "12288:+3FlWO5hmPjC38EkmY//9ofM2btVRymY8nYckZC:+Vl15hm2sTobhym4ckZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695216765, "uuid": "10171c1d-2a2f-4570-afef-77d4ad29fa4f", "value": 3119829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695216765, "uuid": "2a2a94c7-80d7-4aa4-aefc-90241c14d3dc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695216765, "uuid": "a8b876a9-d4e8-4536-888b-28ff6c12dd7e", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.23183.4839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e9d6ba-57f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695241872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241872, "uuid": "f0a9771d-1376-4f36-9f0e-bbe5bc8225a7", "comment": "Malware payload", "value": "058cf84acb4878ca90f5f5802ed02014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241872, "uuid": "e70b92f0-3f8d-42d5-be18-b313365bb165", "comment": "Malware payload", "value": "f82b40c2b0834eb5503a020d639bd0f5d4d27d3d360c7a40df422c40d5b486a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241872, "uuid": "4d533c61-13eb-4bf8-a891-5fa103911d86", "comment": "Malware payload", "value": "2620f5f4f7c4b1c681f36a6a936977b20a351486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695241872, "uuid": "92f1f3ba-f4cb-4a87-bf82-42a2f6f4002c", "comment": "Malware payload", "value": "6c081e6c3a3d7be0808e835e4473d11986b5d99d2782d6b8366e3f6cf95dd3dff73b6347111000778f251487c888f8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241872, "uuid": "a1158448-e032-4f8e-95a9-841d3874bc9c", "value": "T17A038D25E9C38872D26E56BD4D0DD638D83A2E213F1871C3EBBF2D0DCD256C61A19361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241872, "uuid": "72788e93-9177-4227-b4ef-1bb99ab26d30", "value": "768:+KSmX3MVD4GXZEyuhhq5Db3QHGVkK/8KU6s47O:vBAp5XQHGVkXKGYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695241872, "uuid": "a63fa502-b61b-4180-b55f-a4e3b097ec17", "value": 39590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695241872, "uuid": "fcf93303-5e72-4c02-a880-6f0d54d12fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695241872, "uuid": "af58dd18-fc23-4415-b761-28ebdd7958ad", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.24340.23828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0aa5dd3-57cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695226110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226110, "uuid": "c177df1a-3a83-41fd-8467-d072bb23a5c0", "comment": "Malware payload (Stealc)", "value": "14b157cd17919b72329ce956ffe3ec78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226110, "uuid": "e3d38f96-1c71-4431-a955-fb9eb1ab4281", "comment": "Malware payload (Stealc)", "value": "f8d3bcd5cffb3aeb677c57c43240368c39886d19a2b6180cfe9f4cd0ad960b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226110, "uuid": "d6e389bb-8f07-4f7d-ae9f-66298b67bd9e", "comment": "Malware payload (Stealc)", "value": "592732746456fe9a0b6bceb408848cc598001617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695226110, "uuid": "bdcb93e0-3cfc-4df5-a771-5ed7256b1ebf", "comment": "Malware payload (Stealc)", "value": "2e408ddedc050d8ea1079ebf717f29364a5a89a5254c33df799497b57b2c130fd707da0037230338958f14658d2ce3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226110, "uuid": "df2a0807-5e23-45ee-a05a-b46edc920583", "value": "T12224DF1135E2C0B2C5B745347870CBA0AABB7C739774894B37642BBEAD307915E66327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226110, "uuid": "72f2f21f-790d-4747-a01a-cbd338c3b8e0", "value": "f441e1f89e815eda74d641cd1f758949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226110, "uuid": "55796eaf-4257-4004-8209-187ccb84a967", "value": "3072:DX23B2yaYWSBD9DMrQxiUfDp16g4L3M5J7+qTf+bif3:7iYqWSBDVCqDruE7+qT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695226110, "uuid": "80ce49f0-c34a-432c-af7c-1e75c246e042", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695226110, "uuid": "9408eaf4-ac02-497a-bc01-680f5691df59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695226110, "uuid": "3077fb9c-142e-46ec-88bc-23e497537061", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08871f04-57a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695205963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205963, "uuid": "e267c3c2-7530-47be-9215-3507137fe5a2", "comment": "Malware payload (Loki)", "value": "ec1b1e9118b85599e702620abf7e9301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205963, "uuid": "2f380e3e-7fb1-4dc8-aeb0-ef2598d17ffd", "comment": "Malware payload (Loki)", "value": "f8e17678a05033140083776cde158aecc2126bb3d0ca09fed9c2cb413cc7b002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205963, "uuid": "f8dcd09d-a55f-474b-8f22-2824c8669305", "comment": "Malware payload (Loki)", "value": "c0329c13b794364e46b2789d0237bb79bed5b95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205963, "uuid": "e62de729-0917-4f38-8f44-f4d1e4faf58c", "comment": "Malware payload (Loki)", "value": "606725b8838ff852453032ca7cd30a433a7385f555df4ec4389101cb8e1707cf73cd91262cff4d857c0e5b7b28ebafb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205963, "uuid": "602c80dc-4471-485a-b2a5-1369df919184", "value": "T1DE44C01277E2D872E4A345705870CBA12E3BBC721675C18B37E42F3E5EB12C19A76762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205963, "uuid": "3b89ad6c-60d6-4b0c-a741-5093b649ba8b", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205963, "uuid": "1af635b3-7969-4bd7-9e40-66558066b054", "value": "3072:+EXJxr5PgrVGlr+t3m2bvTf03jHbGIdo1gggBWNNrEdcmvwusCP:LjrmrElr+pZbvTej7G71fOWNpEZwus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205963, "uuid": "60c9b1a4-afe7-43a8-9f94-9f87e7d6668c", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205963, "uuid": "8bc15c2d-41db-4650-8f3c-62e5e4fee5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205963, "uuid": "f4ac7c9a-36bb-462b-a44b-550bed0cbf6a", "value": "SecuriteInfo.com.Win32.BotX-gen.2931.3760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24421081-579f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695205151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205151, "uuid": "d349d467-df84-4421-9b03-528ac11d4709", "comment": "Malware payload (AgentTesla)", "value": "d630d40985a9dec957e4bc6b0a6044fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205151, "uuid": "c6b95cfc-dfbe-4fa0-b141-761d880eed0b", "comment": "Malware payload (AgentTesla)", "value": "f95c7b22daed958ec9e957bc06ba3fa1b8c4973e57d8dcd3c89d3ad0c2dafaa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205151, "uuid": "c860b76d-accd-4b20-af57-3261baffc4ed", "comment": "Malware payload (AgentTesla)", "value": "ec4033801c22381fe972d9169b7e4cb1fad5b11d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695205151, "uuid": "ab5bcb0b-8fb6-4c76-9d55-38b1a762b783", "comment": "Malware payload (AgentTesla)", "value": "37a2d88d8d2b5ca026b2e09a3e6d956c3ed7a6223f41ffb68114520e08965e5f25ae4234dda7ef2b7985dbec64f45869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205151, "uuid": "682d66e9-5ae6-45a6-a5e1-9fdff35ecc23", "value": "T157D49E2572EB1646C37A9BB10BD1AC6E43FAF567532FF53A3FD114864B21E408A02772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205151, "uuid": "2adc9aa7-1ab4-4b2c-a68f-059ad29ad3c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205151, "uuid": "83d98410-aa7f-4ca4-8e70-ee4d3507e698", "value": "12288:zKRa7aLYFgtCUxqmf1pfYXExxbJfk0xrzgd/oeTEBr:c4aLYWkrWKUHb21A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695205151, "uuid": "b19d994b-92ba-4aef-bf79-4d57de144069", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695205151, "uuid": "a61ef700-f064-449e-b5c5-43bfbeaa181c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695205151, "uuid": "a14b9252-eef0-44d7-a8aa-85bfd63be1bd", "value": "Revised Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c24ae5-57ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695238488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238488, "uuid": "4e9377b8-ed09-434b-9d94-b2d1a8ddd11b", "comment": "Malware payload (RedLineStealer)", "value": "d6f1ffa454b8ba8e77176d147b0df30b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238488, "uuid": "937bcac8-89b3-40c9-a27d-a59b53967818", "comment": "Malware payload (RedLineStealer)", "value": "fa583b821101e18da1b8bc386ea46a31505501fada69f1a6b18087178c99bb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238488, "uuid": "a794f5e7-c516-43e5-9b4a-e4cd94233389", "comment": "Malware payload (RedLineStealer)", "value": "adadd0cb096367d7fc426590e3af616a9110b003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695238488, "uuid": "964cef72-a506-4fdb-a7ef-26de63e99386", "comment": "Malware payload (RedLineStealer)", "value": "6bf3ae8b7c12d16e6c9c22cbf9135c63604d879dc59b36068cb017392cdda369610aedd6fe12ef5b3b3f760e6e9eb4c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238488, "uuid": "824e10e9-f862-4fc0-90bf-082cb623e911", "value": "T1C5552343F5D5C462DDFA1BB004F60B930A267CA75AAC87A27BC5E94949B3240F9313B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238488, "uuid": "f6f9f048-cabd-4fef-917e-bce46895e4c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238488, "uuid": "48d23595-17d9-46d4-a555-19172427bc2e", "value": "24576:gyTwwbwuxshAQkIlYmCi+qPojNMKP9rxvk5Gz4SR5OCrs05hcxDViUb2H:nTwwbwu6nf/t6NMKP9rlk5GzAa5cxxit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695238488, "uuid": "9de35c3f-6506-428f-879e-c9ba77c68792", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695238488, "uuid": "6e0d61e2-e63a-4ffe-a12f-57812d3aad03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695238488, "uuid": "ca2a43e0-c051-47b2-92cb-de4de3fbf70a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05deef3-57e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695237196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237196, "uuid": "dfaad526-4a6a-4fca-9988-62741b5c5602", "comment": "Malware payload (IRATA)", "value": "e854ab9d92b7dbe398b3bee858a2b896", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237196, "uuid": "b4fdbb90-f27a-4737-996d-a9751d1afdf9", "comment": "Malware payload (IRATA)", "value": "fa9c2fdaddd3b0fa9e7b58cbe576fab5f56000551a96c86a0c3270ca8e6966b8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237196, "uuid": "1f6a9754-1ed9-4ff0-b038-b56e6906de3e", "comment": "Malware payload (IRATA)", "value": "1ab1b31d2689a9465b6e3120558506d5719d1971", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695237196, "uuid": "f24c3d5c-58b3-4a48-803c-1e3034ca2fb5", "comment": "Malware payload (IRATA)", "value": "3c9c098df7483ea37dd5443f02fa9b6e87c25bc36c08e035d564f2aa91ac62cfcd416ba88f7238a144e88b9237cb1205", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237196, "uuid": "599578b7-eca7-4d61-8ebf-9fb672a86c58", "value": "T1C6D52293F276A857C8F5C33265B02A39553A4D1ACB03F24A351C77B96BF7DE80B84294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237196, "uuid": "edc5825b-a5eb-462f-8027-84f26e46f86d", "value": "49152:9/jsWXkkbeXfQK/V2K+8/e6SffTeFeiQkPyQ/QWvMXfsiT2sZvq0leB3xmz6h:VBXkk6XfBdZG6aekiQIyhWvMELcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695237196, "uuid": "c171dc8f-9c35-4079-96cb-2d0149a6a2c9", "value": 2826335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695237196, "uuid": "7ab5c6a3-6abd-4a46-8026-adf4bc508cfe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695237196, "uuid": "a5f34039-b2b4-41d7-b9e0-d16a6600e6b4", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6decad2c-57d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1695228897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228897, "uuid": "b0a45cf0-09bb-427f-a26d-ed0851c8ac21", "comment": "Malware payload (SystemBC)", "value": "4a94bfa09b99674b406eefa0fc0f8c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228897, "uuid": "33a12860-e0b7-4951-9e4e-1dc3a84ab55f", "comment": "Malware payload (SystemBC)", "value": "fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228897, "uuid": "62ab5824-069c-4722-bd49-2c2941bc6f34", "comment": "Malware payload (SystemBC)", "value": "583055372661a2a359586a3fc2cdbaecc951659c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695228897, "uuid": "fa1db2b2-0a77-4e02-9800-f10c42aad420", "comment": "Malware payload (SystemBC)", "value": "0fe578e4e82679bb434e7a23e5bf34e1808c7ec546a62e46136735485d2d2987cbe099980b8bf875a3d95576a3722ccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228897, "uuid": "d4c6ad02-3010-4d66-b7f1-895789d39f39", "value": "T186B41207B53A86B1C7289B7FF45622040B98C6766267C71E7D8F536E0C033E6B446A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228897, "uuid": "31805821-fe71-4cf9-a65b-988fb8bcd762", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228897, "uuid": "1f28ef45-2253-4020-872b-8ee88a87da16", "value": "12288:EndeNz+MiYZmsSOgetN5ONjUrhGkOjkLtxOqaF5:EnYNzECS4N5ONjUdGR6POHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695228897, "uuid": "3253137e-dede-4687-ac85-648207c5c77a", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695228897, "uuid": "686c5654-ae3b-4133-9225-480466b71a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695228897, "uuid": "2aa2f99e-99ce-43fd-a10f-4a4c67fdd4d1", "value": "4a94bfa09b99674b406eefa0fc0f8c5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8bbdb3-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695196793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196793, "uuid": "4f2fe63b-db6b-47f4-8017-42ddf6cc6408", "comment": "Malware payload (SnakeKeylogger)", "value": "9124b6d859035632dde3707de9ba1fb4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196793, "uuid": "f4717fef-ded9-4fd2-9d15-62106ac26a58", "comment": "Malware payload (SnakeKeylogger)", "value": "fab67cd5902f52e5f16978aecca13dfe7163cf4d7a42a5d099235c20ac82682a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196793, "uuid": "3ff7c8ec-2036-43b0-9816-88a8c82921e6", "comment": "Malware payload (SnakeKeylogger)", "value": "60303a515eb7322ed6d9c7bfa13d0d4aba19fddd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196793, "uuid": "b75d4054-b597-4589-a878-444371fa508c", "comment": "Malware payload (SnakeKeylogger)", "value": "0423e3b4562b6c356445b3ab711dd4b4b2ca8c9ee410cf0f0f6e2094d6a2dfad578a11a77db9d5a64afe7d635e484688", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196793, "uuid": "88cfa252-fdbe-47b4-9c33-106084b04f66", "value": "T1C55166184AE80325C3B28A7B956AA3108973BC02F9728F1C018CA0CC275B510F8B6F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196793, "uuid": "0d83617e-e426-4df9-b421-19bf0d42c0c1", "value": "24:8AuJ/ByUl1+feiFn5GLEzd3+/E4I0aHCz:85wFn5GoxAIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196793, "uuid": "101f9aad-898f-46c0-87cf-1978c3b15c31", "value": 2566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196793, "uuid": "6342a391-55b9-4049-bd78-a7d1f6e18d61", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196793, "uuid": "8cee203e-a783-4c84-af64-1e7dff295a5f", "value": "QRFP96725316596-ITEMS.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ac86ab-576e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695184138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184138, "uuid": "32e00617-2b81-4839-abe9-03286c284d41", "comment": "Malware payload (RedLineStealer)", "value": "5a3b9e26d0562313dc6c967d9f44c60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184138, "uuid": "f0ac01e9-368f-4847-ad95-8e7895377487", "comment": "Malware payload (RedLineStealer)", "value": "fc18db83372bbba3bf7022910d2c5e8bbec0b1fa7afaf0c63f3be478e0ae9acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184138, "uuid": "2f164539-20ea-4e6b-a7a4-36a9e04c88ec", "comment": "Malware payload (RedLineStealer)", "value": "4b8705775cd2dc3615ff0ffce5b067f4c7360f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695184138, "uuid": "7f4842d5-ffba-4073-8f75-a1d314afc137", "comment": "Malware payload (RedLineStealer)", "value": "ddf35b114834ccd1221d119429b06a6ed7fd7723b8fe4560780834ced80a7bf5be9492bead17902467ef166005f80194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184138, "uuid": "5fd9d9bd-cc9d-4948-a6d2-c8a8a9094556", "value": "T1BE6523AAE6D89537DCB013B058F706D30B747EB14CBD42673352BC5A8872980B9B1B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184138, "uuid": "a95dcf3f-bdaf-42a3-929a-30debb9c8066", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184138, "uuid": "1589dba3-eeac-4963-981a-79883d9f9b33", "value": "24576:tylrrfrV3Rq5RLRgr97S381J0zMDtrAz2gAdr8wcwZ0ixYXW5CO3sFySK/0BfNM:I1rfrV3RSxRAfezMZEzt+Q9wZj4QCwI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695184138, "uuid": "868db49d-32ad-4ccf-b041-e8029cd5a18e", "value": 1468416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695184138, "uuid": "b7007914-3797-4ede-bf8b-ac938e2ec77f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695184138, "uuid": "488c37a4-7b6a-4f74-991d-d83fe3fd267d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b792c03-57e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695235255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235255, "uuid": "86e49e3a-16ba-46d9-baa1-332f805ef24e", "comment": "Malware payload (IRATA)", "value": "930737c503c8cef8d5fcc47ca1e021c4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235255, "uuid": "1763cb02-9b29-4903-bc2d-d9d7920f71b2", "comment": "Malware payload (IRATA)", "value": "fccfcde4239437eaca0c5c3ec6d0ed2913e0efbe4d671b93111cb6353e0a8d03", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235255, "uuid": "d1efc0b5-35a9-433b-8337-50cebe729e4c", "comment": "Malware payload (IRATA)", "value": "bd9844a6d23529087ae62d042fedba658e257ba6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695235255, "uuid": "18fb7194-aa3c-45d8-a2b5-e2360a096abc", "comment": "Malware payload (IRATA)", "value": "ce76f430b3a6eaaca42235f22ba6990157c74b0e90ec23dc92421a386583be3499abfbf058222d625f0b3fea89e2744a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235255, "uuid": "92d69cc4-9704-4088-8468-0fdefc6904e5", "value": "T16DD52353F7B6A42BD831C1322505233A10574E18CA87F79A3E4D77B934BBEE84B816D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235255, "uuid": "f5780ed5-0f83-43aa-977b-78c0a90e9610", "value": "49152:2EwPNmZl3/9KKxfsoVF1XM5b4TMDWsM8zJoJXOFqRGBic0Hr/XjJokD1UtzXWX9m:2TYl3ZxkoVF1c50wDWsM8zkeFqRGBqHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695235255, "uuid": "b34f32d2-d62c-4bd6-b8d2-e453b4d745aa", "value": 2752589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695235255, "uuid": "371dc06b-4793-4549-9e83-0a4b72e1ded3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695235255, "uuid": "6b1df9de-b1b8-4c90-bccc-12e34b07070a", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77835d22-57f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695242657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242657, "uuid": "5fe507e1-0c75-4162-8a4a-4c194ffe0a30", "comment": "Malware payload (RedLineStealer)", "value": "2c36df4413e6f78ccf9f8abbc71b906d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242657, "uuid": "3e88dd21-02e1-4e91-b78b-5778b266171e", "comment": "Malware payload (RedLineStealer)", "value": "fe99dd41b1ac9303a784c2da504597c456da6523d17ecc5079d8cf152cf42737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242657, "uuid": "14fd5c8b-239b-4f26-82c6-023aeb6f1286", "comment": "Malware payload (RedLineStealer)", "value": "aa9f8bb6c2354511ec38e3a0f592ab4f6a85b17f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695242657, "uuid": "e60519d5-39c6-4004-933d-b7b25d8976ee", "comment": "Malware payload (RedLineStealer)", "value": "9b482d4f906baa6b1ca1035e0faec7b374bed99cc13d4dc73ea295b756fdef6f808d1276c2c6e8551e6dc6ac7bfa7e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242657, "uuid": "8d1462cf-709c-41fb-9bbc-03708e26f72b", "value": "T162552343F3D986B0DD6A1FB119F003831A3A7CA258ACA23B7741E85E5C726D9743176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242657, "uuid": "8f5f4546-e08d-43fa-9045-c46c6f11ed5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242657, "uuid": "ef2be67f-7fa6-4806-8115-b9cf5acc034f", "value": "24576:6yGDx7qrNNuIDohlpQTx66Uj8WxP/OIsdTvNaxjGPqdqBUnsXQGM4Y7OFHL:BGDx7QNreQTx66i8Wx+IsUGi0VAGKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695242657, "uuid": "1993bbab-f1dd-491e-b508-89e57d406c9b", "value": 1395712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695242657, "uuid": "d2e15a9a-d1b7-40e9-a76f-020193f78981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695242657, "uuid": "a3b34f1b-e6a4-4faf-8141-c4e6c5415d90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ffc690-57bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695217178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217178, "uuid": "463864c9-4406-4799-bf7c-f01ff9d03ec0", "comment": "Malware payload (RedLineStealer)", "value": "d41125ea605d856bf69e0b04d3daf261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217178, "uuid": "fcf094f4-8fea-4b82-a228-23e4d92e80e0", "comment": "Malware payload (RedLineStealer)", "value": "ff092fdbd0b67e1ce6f2a6d83855157b4719839236161baa166750624e2801ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217178, "uuid": "07d98dbd-d59f-4849-928a-76437e7cc554", "comment": "Malware payload (RedLineStealer)", "value": "76d9987b66e0687cbebe5f260596da20357d0538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695217178, "uuid": "bbc5dd34-e023-4236-9702-334b808ccd06", "comment": "Malware payload (RedLineStealer)", "value": "93dd2b0d4c9e45d52b6019d151cefe92d72b3b4e79bcb5dc04051259696b38ad6a4a362a87a421d8da32a29bb025a4bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217178, "uuid": "8b473d1d-b329-435d-91f9-680ef4ceb62f", "value": "T145652313BBD58067D9FA2B3168F602431D76FCA26D78D70B3AE468888D72381597137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217178, "uuid": "d4047608-1a8c-4d9d-ae97-20dd5e39e5e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217178, "uuid": "7b4489ba-e96c-4c14-906f-a4a0f59ff4e2", "value": "24576:QyrEMD3Hd9MY9ftmt/BkRTNts3M+KZneIWbKH49ZHcltf9:X1TjdfiGRxts3MXZnkbA49Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695217178, "uuid": "2ff12457-2e59-4204-95a0-7a599575cc84", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695217178, "uuid": "7046d24c-fe49-4673-8ecd-1649a32e4636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695217178, "uuid": "7b24f04a-578c-4d36-8599-998b0e2fd9f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58062fbb-57a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695209103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209103, "uuid": "a6853693-965f-4d0d-a3a6-e9f09b6e2e6c", "comment": "Malware payload (AgentTesla)", "value": "d8d15e4db0df148a65585f4c3a1c51c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209103, "uuid": "6f331716-d4fb-4fa1-9d3e-771e3026dca7", "comment": "Malware payload (AgentTesla)", "value": "ff241eca2063eb38b03d6dbe8d1af4e36536c10399ddcf9fcf1528f343f97f4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209103, "uuid": "44fa3139-4cc3-4a00-a9cf-13623a490fc6", "comment": "Malware payload (AgentTesla)", "value": "9985cbedc75b7e977fbefc65aa088a9e13d8821c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695209103, "uuid": "33cf3a7b-e338-49b5-ad11-e3dae97a2b59", "comment": "Malware payload (AgentTesla)", "value": "2b9c28198fcfe880f7f61ebeae18ae0c20dde071212f59389a555f6783316d5532c98ba223d557e4f4d74447ba0089f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209103, "uuid": "be74a556-4ab4-42da-a534-f335687d6d84", "value": "T1C9F4F1203AAC9FE3D33A63F54699954513F5652F903EE3450DC378CB6A61F908B21BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209103, "uuid": "436353d4-242b-4397-90c5-9c2980b9bd39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209103, "uuid": "6ca5b72d-bd3e-47f6-ac0d-2459dd2e03e2", "value": "12288:VdRU72iNtz0535WZb3Uf3t1pydPR3gACUC/iT5+L7Mdqie:9U71f0GxkQpwACUC6T5+vMI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695209103, "uuid": "3f3005e1-1e11-485d-9dd5-7b21818e09c6", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695209103, "uuid": "49aeef53-0b6e-407b-97ca-cb46b7949b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695209103, "uuid": "6eb7660e-8137-44c1-8928-9549dd966d03", "value": "qRHLrBumsHRQyA7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd151cb-574d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695170106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170106, "uuid": "34bc96b1-f0d8-467c-88a0-631596c18e08", "comment": "Malware payload (Smoke Loader)", "value": "be527f26f13962e89509dd096166f55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170106, "uuid": "3e7c34cb-80fe-43fd-8d04-f86df6a2e45a", "comment": "Malware payload (Smoke Loader)", "value": "ff5794af33667de77d1b287bb096b8153b1c7d096ec1d940de3bb9692c95251c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170106, "uuid": "347aaf22-21c6-4724-a5f4-d73086f7384a", "comment": "Malware payload (Smoke Loader)", "value": "fc229d2242785afe7b5493dd13a86ea1ada1d7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695170106, "uuid": "9cd07aca-845c-4313-a6dd-b96c4cd476e1", "comment": "Malware payload (Smoke Loader)", "value": "af225a3e33d4d78dba12c1eab178acb3cbbccd1de875beda6bb18247018aadc1a5f34a82da1e551afd7990697618cf56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170106, "uuid": "97039223-a112-4767-bf8f-826ebffcab55", "value": "T18E44CF22B3D2D833E0A356345570C7A56E7B7C326634C5DB33A02B3E5EB42D1AAB5352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170106, "uuid": "720e4ea5-4364-4dcd-9382-cc4af0cc78a9", "value": "6dd157837222da716ff127b0dad19e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170106, "uuid": "5d80dd0d-2478-4327-92b3-d5a674b558d4", "value": "3072:rBXiXrLPgrVGtJtNHj9/c4i8oCMhvKkuFyWvnbKn:xAr0rEtJ3DU8oBqyWvnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695170106, "uuid": "ef339199-4920-4c18-919d-c3eac1b3b7a0", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695170106, "uuid": "a0d36ffb-140f-4b8b-b05c-3b146fcd72fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695170106, "uuid": "17ae882e-e20c-4b66-a777-c8a19af44b12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad74d910-578b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695196791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196791, "uuid": "0a02b802-7eb8-4077-8d67-eeae2d5d505f", "comment": "Malware payload (AgentTesla)", "value": "ea34725ee786ccd8e29b1fbe19ef2662", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196791, "uuid": "603fa9ca-1c38-4bb9-ab40-551048f6818c", "comment": "Malware payload (AgentTesla)", "value": "ffc7f44e4dd3a2456d2a2a25ab2dcd4ef93d584ffed994025f03ef3dd34d4c6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196791, "uuid": "7d77c6be-3f42-47e1-a0c6-a33017065240", "comment": "Malware payload (AgentTesla)", "value": "833dfd997d59373993ff8c23c1aae61976334c23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695196791, "uuid": "92877012-ca27-401e-85df-291dec5ae6b6", "comment": "Malware payload (AgentTesla)", "value": "036e690c6d5681875b61d2facb11f6c75fe79988dcae6e37430bba7ddbaae6632f717eee40c86f418a9fda2dc351fe72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196791, "uuid": "e7ac6732-b960-4293-bad6-cfc6c268e8b6", "value": "T178D412583A68CE52D19F17B40430104277B1B967BC26E7E49DCEB0DE8A96B74C7072AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196791, "uuid": "81fae4a9-d1ff-461f-b7be-e7d87389b2a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196791, "uuid": "c0a505f9-008b-4b03-87bf-43770196fdfe", "value": "12288:mbQ6zxyE+m+I6I9dPI1LNQ/Z1XUh5LGPgFGH4W+CycQKeHkAR:m/zxbd+4iQh1XUhZY4W+IcHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695196791, "uuid": "041c3072-c2c9-4b30-a6f2-6f760439438b", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695196791, "uuid": "42f2af03-aae7-480e-a663-f18492fa4484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695196791, "uuid": "4c906a10-9c78-4d04-86fe-389f9904d162", "value": "Halkbank_Ekstre_20230920_080757_783952.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }