{ "Event": { "published": true, "date": "2021-10-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-26", "timestamp": 1635292981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4bfc91e1-539b-469c-810d-46eedf3c55b1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d114781-3628-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635230752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230752, "uuid": "7251d612-5ff9-4e58-9497-6d8de9c5b274", "comment": "Malware payload (AgentTesla)", "value": "6087be7f37cba2960a9777150c6e9d15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230752, "uuid": "aae7376f-0d4d-4899-9019-59386196ba58", "comment": "Malware payload (AgentTesla)", "value": "000fe45623053414c6c7ef7d53693f485d4e3e27e2e0fe4e003d118e7016501f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230752, "uuid": "7d0f591b-5591-4843-aa47-50019789ec9f", "comment": "Malware payload (AgentTesla)", "value": "b06f121f5133b6713a2c69793e4c94e1d2ff4dda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230752, "uuid": "f24ce3e3-65ee-4cd6-85e8-3563f5793636", "comment": "Malware payload (AgentTesla)", "value": "36b58cf568bab26a5481304b53b3ec992ada3cbdcd49fb08f7da146fd6eab3afd24a74adf737d826a015b4d77c5e4649", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230752, "uuid": "48174924-be30-43d5-b857-4bcdfa02c21c", "value": "T1881523BC1DEB292510004DD135B7FC51D6ADCEA62FCA05E6F5C784D8F131A9FAA2D802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230752, "uuid": "af13851b-e56b-4885-a8dc-669b7c4426d0", "value": "24576:8M3pOtXzJho5EqPaYU6jZ3lm7L2XZR7gCj7:JIzoKMaDQFiCXv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230752, "uuid": "cdab2574-ebe2-48d9-87cc-d9646a678550", "value": 911571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230752, "uuid": "140f7ba0-eee5-4077-9d1e-82ee02e4348d", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230752, "uuid": "3d792555-8bdc-493a-93e6-7c7bd225e033", "value": "invoice.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bf4649-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635257099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257099, "uuid": "a3172691-b3b2-4acb-9cbf-f75800842b0f", "comment": "Malware payload (TrickBot)", "value": "e2097b2a9b64b724ec10f9ef75ba3500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257099, "uuid": "f1e3fa58-99d4-49e0-bffe-c91292a10f67", "comment": "Malware payload (TrickBot)", "value": "0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257099, "uuid": "daf5824d-4154-4de4-8b05-98502590c67e", "comment": "Malware payload (TrickBot)", "value": "afe5333961958dbfa7fb2472f1c4e4aad965cf83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257099, "uuid": "0eb07fe9-f991-42c7-8d10-5373473062b8", "comment": "Malware payload (TrickBot)", "value": "0cd3092a9f6a5537e22aee95e9281f5b588fb1b8a2087ce7769ad239e61ec81432cfbc5e3e45eb05fa45b8c5d2bb0dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257099, "uuid": "e2c0577e-190a-4282-b7f9-a237cf3b098f", "value": "T1FBE4CF26B79490FAD5F116360FEB673BB2F6EF60493683471792BB1D0C30A114B26B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257099, "uuid": "ebe27091-c9fb-4f60-9a57-e6cba7f54f5a", "value": "542db7e97024de0354d3af3fe3180ab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257099, "uuid": "8dbbba9f-cf6e-45d8-bb09-a4e3c0a87590", "value": "12288:E3OvNPnZ2TGqZbv0r+EFmd5/gCoXcoHQBQVxvzA/Zb:PvN/0T75r1d5YCoXcoH5ryb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257099, "uuid": "4309ea1d-5c82-4b73-b330-feaea8948c5b", "value": 675883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257099, "uuid": "50950333-a1f5-4b47-9e99-83f8652d3ee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257099, "uuid": "5379d721-70c0-4a4c-aba9-cd07e811c7b6", "value": "e2097b2a9b64b724ec10f9ef75ba3500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d64b798-3688-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635271931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635271931, "uuid": "e9c77c4f-fcdf-4bcd-8b53-e4209a63f07c", "comment": "Malware payload", "value": "f6c9217ff5befdf1dbec39a08877c6be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635271931, "uuid": "73fadf42-a283-40ec-bcc0-36c736dbd057", "comment": "Malware payload", "value": "0017e2bb45469ea5f02edab017f77b7242c9a3330478c748e7e8380149ded601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635271931, "uuid": "701e3e96-8770-4e6d-84ae-9a2452d626a3", "comment": "Malware payload", "value": "2cfd106a4b16d9800679c14959b5c6bff26840bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635271931, "uuid": "8d4738c7-89c0-4381-ba8a-137e6ebfc515", "comment": "Malware payload", "value": "19a12dbaacc9cc6998bf477a7b2d3325ab1e6e9c7e427764d96284c62f6d3ddd4935370a371f66355ae9a574f590be70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635271931, "uuid": "4882dae1-62a5-4087-9ece-d2ec5526e407", "value": "T126C4AE17E6428076E4632430269D9F6259BD76300A26557BF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635271931, "uuid": "ec766008-635a-420d-8a2a-8095d2e7849e", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635271931, "uuid": "975f9c27-5f46-4ecf-b77f-a9abec3264bd", "value": "12288:aWWzIRlRn2/rw7INjVGCXZq0iiIxTD5TQdIJWjI0g0A8Svqr4d:aWUWrnIrw7I1VGCXZbiiGQdAWngR8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635271931, "uuid": "9b91f6b4-a98e-43aa-ae88-befdc4219911", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635271931, "uuid": "c2ad197d-1563-4b8c-9420-acf4fee9dc9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635271931, "uuid": "b2042306-164a-484e-8836-387b85c51197", "value": "Fortnite Cheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef030ef-36a1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635282966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635282966, "uuid": "34c31212-56fb-4bff-bd3c-6171a722c904", "comment": "Malware payload (RedLineStealer)", "value": "4722177da1ba43063aa5fd54ad499cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635282966, "uuid": "ffb40e19-be84-46d7-82b5-6db7c9041a2c", "comment": "Malware payload (RedLineStealer)", "value": "0081ce7f8c3a50f714bcdf68069b66827e59bd089b2e1d9adabdaa58fdb51464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635282966, "uuid": "3302f186-b444-4c96-ad21-c5b7e05883e9", "comment": "Malware payload (RedLineStealer)", "value": "89f61381c1761e7f2a8b015115f4e52a143d3344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635282966, "uuid": "51701807-ba48-4f85-9715-be8191a78591", "comment": "Malware payload (RedLineStealer)", "value": "9204b33cc6e9218a30545f3736b36de256a244d0e5442cf14b69ca1c106a72ca11fafc06f48df388f9e50757f4457875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635282966, "uuid": "c0b03157-98b6-40d2-96c6-e4acf26e839a", "value": "T1EE948D00FA91C039F9F322F449B99368A52E7EE15B2460CB63D55AEE47356E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635282966, "uuid": "b2eb12af-93ca-4b35-9a9c-cf20becba776", "value": "cc12fa1c06b94f51dc8ec5d000654e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635282966, "uuid": "2ea6edef-ccec-43dc-b6bd-f558afac66b5", "value": "6144:KG9x0887NUkHsVbvohFTg2HUCrSM/xuQqRFCaAAUxCdThNbRgT8t3ewQ:KG7DcsVbwTxHFr1dMEMUxCdThNGotu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635282966, "uuid": "8890f4d3-a552-4261-b761-662e2decfae7", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635282966, "uuid": "d30888b5-386b-4e6d-a8bc-15095e891f45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635282966, "uuid": "a17edc8e-31dc-4f8e-90cc-0ba6918bba70", "value": "4722177da1ba43063aa5fd54ad499cd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa27f6e-35f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635208826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208826, "uuid": "b78fcaef-f547-423e-83c2-752da8767288", "comment": "Malware payload (Quakbot)", "value": "793dc2e39241367057cd879ff29817d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208826, "uuid": "a47b1f69-0000-4e40-971d-bce8150635c2", "comment": "Malware payload (Quakbot)", "value": "00eeb0fa83ffd92aaee10d2cf851597f429062ea044863e425be8801a41ef379", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208826, "uuid": "fb12d93b-6cdf-4cac-bd27-279c806ed73b", "comment": "Malware payload (Quakbot)", "value": "1ee27633af3d4cc0083518e7599793429c5508b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208826, "uuid": "2ffc0cde-bd28-454d-abc4-3c0501824c2e", "comment": "Malware payload (Quakbot)", "value": "a18d7b4d754d158b38f5fbfb7fcfab3d47c63bd9ef35d18219b78a13d0c2b55196cf2a47cfed349812da4b6e6da34f4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208826, "uuid": "171c824c-34fd-4da7-a3b7-7b170b0e7d02", "value": "T164E49D1077A1C436E137123898F6D4E55A7C75211BB4ECDF32843B6F0AAA7C2A62476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208826, "uuid": "c9c7cf2d-d310-496a-859f-26598ced7841", "value": "c4e357325f11def5241aa909361c0d82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208826, "uuid": "3d24697a-30df-4fc9-8b2a-0118ce6f56e5", "value": "12288:0QCpB8yTuPnS6hPpaxV8ES+S51fxoGzSgnPeRkWZWZhus0E4vy65Uhh0US+7n:0QCpB8twT804SGzWZw4vP23lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635208826, "uuid": "cfd575fa-cc01-4c0b-b10c-6b8c76958f44", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635208826, "uuid": "a26effa0-eafb-4122-bd57-b9c67ab8fcdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208826, "uuid": "5a9ffdb8-4e0f-4e40-b678-25e0c7bc4ff3", "value": "793dc2e39241367057cd879ff29817d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a876f18-36a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635285375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285375, "uuid": "7c0e67f9-aaa3-4b93-b31b-752861c1f148", "comment": "Malware payload (RedLineStealer)", "value": "530766137f52580fec66e494e69addbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285375, "uuid": "156348b2-40ec-42dc-8019-cfb83bcc07f2", "comment": "Malware payload (RedLineStealer)", "value": "00fb6f91b51ac26bee53b42937074c9a0f662e9e2b0b9a70a7caba2547c68c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285375, "uuid": "5f7e1907-d8ae-49b1-a9ec-f3edf5ef808c", "comment": "Malware payload (RedLineStealer)", "value": "5d31d97469e84eea34e0753d05fffb6c26463053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285375, "uuid": "d6001ca6-76e9-442c-be91-c702e765eb62", "comment": "Malware payload (RedLineStealer)", "value": "38678051a7d94e07d9b100325f2ca895dafcd8de3b5bd9dc3507c2ef902bb6a58488f45587fa00c099c0fa01822e0f4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285375, "uuid": "444252cd-f8ef-43b9-b652-41c20bbcc1a2", "value": "T13C949D00AAA0C039F5F322F449B99368A53E7EE15B2460CF52D56AEE47356E1FC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285375, "uuid": "e58d0fe6-d1a4-49c9-be48-42078b7243b0", "value": "cc12fa1c06b94f51dc8ec5d000654e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285375, "uuid": "64f9f374-6dc0-48ae-a8b3-da24f516a99f", "value": "12288:K6w2tWx2QcB8xz/AVaUsMH4iVSIWJVHjbZiUeCd8gLlxvN:ZqwB8xzIMkVSI4kUKgLr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635285375, "uuid": "0dee37fa-2ffb-40cf-a8df-94d13908b4e7", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635285375, "uuid": "882e8048-ebf3-4574-b995-5793cdce86be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285375, "uuid": "01e69709-666d-4827-8d76-38318f844603", "value": "530766137f52580fec66e494e69addbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c5519c-3650-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635247888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247888, "uuid": "83f881ea-6f52-4c38-beb4-0fdb5c57544f", "comment": "Malware payload", "value": "dc52d0e598a785c328edb0b0b0c22a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247888, "uuid": "0b0ab505-e6cb-44a2-8362-dc407093d11e", "comment": "Malware payload", "value": "0164868f248a68b0f335a2a8acd9f916ead987070865ebd2c05a5e96b70c015a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247888, "uuid": "e036940b-8083-4562-bc97-2e36fd131f90", "comment": "Malware payload", "value": "b36d308912624aec207dac684741d0dfc0d990e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247888, "uuid": "cce7ed21-1910-4d09-987b-f4da4a4c8cfa", "comment": "Malware payload", "value": "e3c4452cc4837b03e6d0fc8c0af0b39d231fdacaf25885436480d220d5f63a9cfeddd32c6110dc05ad6fb761cb545723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247888, "uuid": "0a57e411-a49f-4c84-a0ec-dcb0d319d788", "value": "T1A09533BC0EFE4650DBFAB477CFCFD4670DAC882662B34F2B2664C5D1886E50811D4A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247888, "uuid": "0028cb95-17c6-420d-9cad-303d97d83255", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247888, "uuid": "fcb16d64-e1bc-41ce-8c57-7954af178144", "value": "49152:ZsjwUMFyyna+7EQu/MAU7Tv7iapMbA8N+tojwA:ZsqFdafQDAUPvmam+bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635247888, "uuid": "87dcdcf1-e5a1-4d9e-926b-2d6993c03164", "value": 2043392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635247888, "uuid": "b3679430-f363-4a01-ad82-a8a9ca0e36b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247888, "uuid": "c15b8e46-ab01-448c-a949-3740c2011a89", "value": "dc52d0e598a785c328edb0b0b0c22a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c43753-3674-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263276, "uuid": "b5248b2a-8675-498f-be5c-defbd433e2b8", "comment": "Malware payload", "value": "eb68e65f78dfb15f14ebfb2d13aeb793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263276, "uuid": "09e8d35d-5d54-4b53-9f95-674cf3ba4bc4", "comment": "Malware payload", "value": "0175c23a9b3054dbf07dd7faee1f722ce2fb668ea7c8b0d58238db4a0a7cd61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263276, "uuid": "c551cc6e-8b10-46e6-802e-10915109c6c9", "comment": "Malware payload", "value": "03a30221c2ef6e64cbcda0483bad9cca447eebc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263276, "uuid": "20107941-617f-43a2-b130-e0a9d0eeb684", "comment": "Malware payload", "value": "839a1c4a8ed1516e919e5b080f6bbb943c284d42ad7ada67ad0fbba67ff3f7171276386ac3fde59fa64d15917251834b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263276, "uuid": "9de02d22-083e-49b0-914e-ff99ba9a42de", "value": "T1C5248F0436B95B12E5BA67F01632580493BB7DAE243DE64D1EDE74CA0F77F404A61B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263276, "uuid": "7768b085-eb61-4dc1-87e0-7976ca26281b", "value": "3072:VGxwcL07QUovXGZIfG0hYbPD1NvXS2TUcooKtnUp+b:VGxhLKPIuVvL78nUp+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263276, "uuid": "fdb318ce-48e6-4456-bdae-ae327b83aa19", "value": 225558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263276, "uuid": "f92a0e40-4aec-4924-8f82-db6edebddfab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263276, "uuid": "db187ac8-9028-4ecd-8d3b-2d91616b93d3", "value": "eb68e65f78dfb15f14ebfb2d13aeb793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5164cc-3673-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263175, "uuid": "87f0b9a3-1926-492e-b927-6d51d871dc08", "comment": "Malware payload", "value": "38149f0cdfbb6e142e40fea1560a3684", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263175, "uuid": "3983c8cb-07ac-46b2-a778-5663131afa49", "comment": "Malware payload", "value": "01916caa4c3e7631485f2e8104bc2f94cc3a0dd26d66a50ebfb58651fb38121e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263175, "uuid": "8351b788-640a-4b0c-90ee-6d035f28f037", "comment": "Malware payload", "value": "153d046f2c54ed4f8ba0f155ce07f5dfc2ff542d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263175, "uuid": "ba28277d-c5e1-49a3-bdba-34863380ef9e", "comment": "Malware payload", "value": "78d23be601ee07de5dec4620e8eaeea09cac2755ea30f17f3458307455f0df5098d21b749c7a4afd0ff57cba548e4b33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263175, "uuid": "4bd1a90d-973e-49f6-bb46-1ea110cec10d", "value": "T1FAB26C8C6E25F58AC660A264A9BE6ED45FF8620BD44113DD3D2D73408FB1244D7AEF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263175, "uuid": "aa402e1f-388b-45bd-814d-be166b16b739", "value": "384:tm3uw375WCw0XoObWJUmt0O9QAzN01wjBqFot3diIp8H2tsUaePL5vZh7QxERdfl:olLwCw04EKUmtfPWmNjddi9H2VZP7Qx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263175, "uuid": "f3cfb2f5-e31a-4204-9212-5f504228c51d", "value": 23932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263175, "uuid": "fbe3572e-adb1-4b02-bba4-de326a12a6e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263175, "uuid": "56ccd459-6666-4ba2-8637-35472a6dc137", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ef891d-3671-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635262121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262121, "uuid": "da7867fa-2b52-4f26-bbe9-9cc069b50692", "comment": "Malware payload (Loki)", "value": "58afb8f1530d54a182313ea2c2663fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262121, "uuid": "f836b75c-89e7-49ee-a017-532ef3962dfb", "comment": "Malware payload (Loki)", "value": "025bb9440b5682c4bdadb33b85029857b643238f24a0f553ff275853dec522ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262121, "uuid": "30881740-01e3-4303-9ffe-3a53b55cd5b8", "comment": "Malware payload (Loki)", "value": "3b2e6040e7614e8f96d7a3064564de1bace3009d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262121, "uuid": "12ee9d68-e5ee-4efd-876b-96d147ee5a29", "comment": "Malware payload (Loki)", "value": "40904f0ee1592f5bbd6b67146a691755998877511f8bb82f3f29200835c6ad3b5433a399d24892cd1e3e63e1c1f7b192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262121, "uuid": "5e63be30-e41a-4020-ab16-ba39d84a9882", "value": "T14E44122073D0E8F7C54909329A765B2EC67EE5482250929FF7A86FF21E323C2965C1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262121, "uuid": "31d5fc39-8bb5-47ec-b4d6-df96e8eb2597", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262121, "uuid": "4667677c-3609-4543-9cf3-38ee93726deb", "value": "6144:wBlL/cqdZdQtZZy/zCkpu1ukyk/ag/QCl/SprUygNu:CeqtbOmPswwSxUygNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262121, "uuid": "d4f08178-54c6-4a7f-9248-0fa65dca58ba", "value": 256975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262121, "uuid": "28516a1b-bc68-42b4-ae18-fa570288e7e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262121, "uuid": "e8edd24d-78b0-4a99-ba5e-0b72203f07bc", "value": "58afb8f1530d54a182313ea2c2663fa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e25a8b-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635233210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233210, "uuid": "e15734e2-589c-44ef-9664-2ddfedfb5319", "comment": "Malware payload (AgentTesla)", "value": "eda9597e4908dbdc5a2c7a4ca4cb3925", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233210, "uuid": "354149fd-f4ac-4c9b-a0dd-87623a6bd373", "comment": "Malware payload (AgentTesla)", "value": "026a4841afc0a27a36f74e4de837e02e64853be2a67f70506ad9933116a9f669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233210, "uuid": "473d9cfb-1976-4ca7-830f-abd72c001465", "comment": "Malware payload (AgentTesla)", "value": "8c04047c23253865936c285d5e9c0a5a5f470523", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233210, "uuid": "a9279e36-d9ac-44df-9f02-724a9ade38de", "comment": "Malware payload (AgentTesla)", "value": "46de6660ab4afebb1ae984fd2cc619e550dbcfe3720501822774266df29d4b8663bcbe45a34a615989f320e9ae542325", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233210, "uuid": "0bfd794a-f842-47ce-afe6-0c1af55a1f30", "value": "T12A74236CED9258259FA0115904D86DEA710E9FF2A05F81B03F6DE9721F2DF62907A3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233210, "uuid": "01a29fd8-923e-44ac-9651-c15290c5fb82", "value": "6144:z1ecd5E9hdewTvdmcogvVYejYVG2v0oVza9jw/6bolD8njHtGBkh0upbV6:z8b8wTvhvi4doVzat0g7tqo00bV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233210, "uuid": "523f0ebd-4cdd-4be4-a94e-96ae554c04c9", "value": 367139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233210, "uuid": "9d65a5a9-3f7d-4309-b383-90a440809988", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233210, "uuid": "4d75a1d7-5c96-4f0f-841f-1fe148a66ced", "value": "New_Order_PO#960780_MT_Quote.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1069f6-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635250835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250835, "uuid": "78a03aaf-0c01-4ea2-b934-658895219b6c", "comment": "Malware payload (TrickBot)", "value": "645a229bfa994e79286537ea8f0c9381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250835, "uuid": "ef73cd46-48c4-4326-a803-b316ecf62944", "comment": "Malware payload (TrickBot)", "value": "027755b2d3c269bd4f4c7617acd42cd9bd0511ac010717743de242569ca7b2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250835, "uuid": "91e9f21e-eb43-4fa6-b5a1-6e2629b238b2", "comment": "Malware payload (TrickBot)", "value": "0fbdededade42af9d85d69519cb57f727ede1b1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250835, "uuid": "3e148d1c-8400-4362-929c-310e2736a242", "comment": "Malware payload (TrickBot)", "value": "0e0e9611660bd87e258883051ea2448ae3cdb818e526f0acaf14c17e5656327770a76ff6789a22f6715ec13a4d3aefe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250835, "uuid": "5e67aaaf-cae6-4cc2-9f11-bbfae50f2210", "value": "T1C1A4A6C67F7F61A9D6E4B43CA2922E649FBD928203E006CDB4164B91BC7DC605F33586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250835, "uuid": "d878b6b1-1a06-42b3-a92a-84a143ddde71", "value": "138a0f3d3d8c3b24b1a0016b0affcc04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250835, "uuid": "c777a88f-9192-407d-bb10-68c7ce704f8b", "value": "6144:lbtGo7DYYBilGHh6YgwA7QDjI6KA5jT3Zqk4EjU01a/7RsZ231XBNjw:lbh7DnojTcYQ709pVRRrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250835, "uuid": "b155279b-8cc3-4e30-b8d2-66a46e751766", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250835, "uuid": "ee12d084-10a1-4c12-aef0-485462dba1de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250835, "uuid": "627f2e08-879a-4b19-8f68-6d157e297bc5", "value": "645a229bfa994e79286537ea8f0c9381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979b17ba-3692-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276377, "uuid": "7af9fdf6-54a2-42b8-8dad-fd03d57cec29", "comment": "Malware payload", "value": "46cffaa06a52f2551d0d617a13325077", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276377, "uuid": "18ffeed1-ba24-4b4b-b0c6-eb00ea00b948", "comment": "Malware payload", "value": "0359a99ebebef2e0a87de9047435fb003c030f741e491ee11d2af01d9680c4d7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276377, "uuid": "e8b0ffa7-cc29-4d88-bb5a-e8cfda785d62", "comment": "Malware payload", "value": "e3d45b208373b6525de6546945091d4f7a2f90a2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276377, "uuid": "2f3ae55d-bee1-4c66-bffe-00898f083302", "comment": "Malware payload", "value": "8fb37438511fab0fb1879418d7cd9c230d26cd740e3765449a1046b7a2a995d3640686ca1ffeede6cce6b20b49245197", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276377, "uuid": "a3108933-c463-4650-bf5d-5950351a6724", "value": "T19B92C0A4C7EA731BC4F09231AC12D9BDA8B1AD37DB6646734CD0F48334668E5C264E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276377, "uuid": "cc55ca69-2da3-4158-b04e-96cbc115d23c", "value": "384:2D1yJCKVnP5WOzVTPz/wVNhGQX8jkFBiJkgk971mb1kL8nLcMiFqcJow:TCG9xr/YSQNfCM97Qb1WKL1sGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276377, "uuid": "244301ea-c3be-461b-a451-8e50a1ef20d8", "value": 20492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276377, "uuid": "1ec183e8-0885-4b8e-b1aa-f4e350c8a3c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276377, "uuid": "6fb3928a-5a4a-4771-922b-61563ff285e1", "value": "46cffaa06a52f2551d0d617a13325077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918f3430-362f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635233847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233847, "uuid": "df4c12f5-9dfa-4acf-b129-e995e00bc675", "comment": "Malware payload (AgentTesla)", "value": "81ca41509d5260d4b1669c214211a5a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233847, "uuid": "4a4d1b37-d606-4a79-b764-236c0764d7e9", "comment": "Malware payload (AgentTesla)", "value": "055c02887ad04ea59b7f51d1efcdc306adf2a37f6dc66816a4ab151ff093443f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233847, "uuid": "25cdec1f-846d-495f-b7ab-9a4d135d862d", "comment": "Malware payload (AgentTesla)", "value": "9dab3a2836e6aeb3eac7f9e68a447c045c3607e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233847, "uuid": "f9f9ef66-d4ad-48bc-abac-f7186f276d9b", "comment": "Malware payload (AgentTesla)", "value": "4b0b2abd858c431343902851d4995d7ad870203fc5aa9223211eb722d04a422449cd3ff666d526f651770744f7e4526c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233847, "uuid": "6caaa038-c673-4b83-8b67-725eef664e41", "value": "T16F84130C5A78D373E6BA237955A2444483B464142323FBBC7E01E3FA7E6B3254297F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233847, "uuid": "d1ad626f-58ae-4253-b48c-31b4e7452b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233847, "uuid": "ec711ec2-91a2-43ab-a11a-8067d814e68a", "value": "6144:z2mKRcrl/zfTMHArVi5zmujElTwxfdGQ2aLqBpA/Aig/3J9hP+niDGwHL7:CW/DBkxfAXaeBux23/4iCwHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233847, "uuid": "b85d7d82-b603-4bf0-b7a3-b71dfa292699", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233847, "uuid": "4a8882df-3e0e-4809-ad34-4cc8f923790a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233847, "uuid": "c079f1bf-0568-49c8-9ce4-21d004974ab1", "value": "AWB D2101002050-292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef0508d-3631-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635234809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234809, "uuid": "89e44294-a9d7-4df8-8425-351cf64d6074", "comment": "Malware payload (Formbook)", "value": "ddf91c2660ea4372ed90f89b4149c1d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234809, "uuid": "e42758b7-ab59-4783-be36-431cc590128f", "comment": "Malware payload (Formbook)", "value": "05f27c9b3277dab3d05c70390b221c0a8769e0665a32e534b558f6cd3656a230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234809, "uuid": "b7936493-d428-4e4c-ba71-ea68bff83faf", "comment": "Malware payload (Formbook)", "value": "6e75c43da5c1b9d0920094bad35802d0300d77ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234809, "uuid": "1912432e-00e7-4b9e-8344-efdbc77ef66d", "comment": "Malware payload (Formbook)", "value": "3a403da68ab36da2e0381166cb1ab01f1468f92143de4d4fa1394708f3987c41bb55b51d64db6f7a2a353caaf4ffe359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234809, "uuid": "7fd8aa3e-f69f-45cd-875b-8c998d686c9f", "value": "T1ECA4AEB0B7626046D77BD6B98906AFB200275FB4B560D1076EF4BCDA37B2A435C32847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234809, "uuid": "42afd951-fb03-47e1-a942-2a36588b5f55", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234809, "uuid": "9e4ef98a-f798-458a-8f43-661a8a7efc18", "value": "12288:8vzZClqkYCQoXSsNpzjQM6Eert3ItMR9Tr:SzZCssMM6TrT9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635234809, "uuid": "06ae7d2f-5891-4c90-9494-b8e07e05066c", "value": 454175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635234809, "uuid": "00141acb-5676-4e74-9d2a-8d916f9088c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234809, "uuid": "29f160f3-f4aa-4420-8e26-743b7545f4ff", "value": "Doc.dhl#20087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5f7aa3-3698-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635279095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635279095, "uuid": "8eda8be5-f46c-421d-9e59-c6b4972163cc", "comment": "Malware payload", "value": "dcf289d0f7a31fc3e6913d6713e2adc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635279095, "uuid": "709bbd3e-2567-4921-863d-15a5bdbf86fe", "comment": "Malware payload", "value": "06edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635279095, "uuid": "0ff207c4-4a43-459c-8357-2d9ac323094a", "comment": "Malware payload", "value": "44be915c2c70a387453224af85f20b1e129ed0f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635279095, "uuid": "d9f81eb0-e2a4-4339-8f90-9f5f93e451b9", "comment": "Malware payload", "value": "886ad55237fc51391729e1c6a68cd24a19dc98cb157a9de59fa2448596987d5fdddfb5b901ee1704f6bc4d6ce1519599", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635279095, "uuid": "1ff516b3-2c3e-4e65-8d84-ccc25914f450", "value": "T13674CF00B790C035F2B657F84AB6D3ADA92E7EE16B2894CF52C516EA53746E1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635279095, "uuid": "07dce9ba-59b6-4b24-b838-de60c2fe9a05", "value": "8db81cce9914747c7ca79cf056ce5ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635279095, "uuid": "0538963b-6b17-4a51-baf9-dc96ab06ffea", "value": "6144:FFTcfqsL9FV/NzaTCoJZrrWkPsMAtexET4ftYDIy8+Dxxs:bcfq6B5oBrfPsMAtexhfteIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635279095, "uuid": "77eebcb5-cdaa-48ad-a552-c6ab2d88651e", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635279095, "uuid": "33cd6258-a1b6-469a-8740-9a2931d62321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635279095, "uuid": "a4e0ba0d-6a7f-4f94-b6bb-db8d2dee8f79", "value": "dcf289d0f7a31fc3e6913d6713e2adc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c98fcc-3672-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635262528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262528, "uuid": "aee57957-4b91-483b-a0e0-9b35bc1f3145", "comment": "Malware payload", "value": "75dc0b7ee8ecf84a04ae6dd0ace2f54d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262528, "uuid": "bdcc3640-4bf7-41f0-a169-84cd254bfbe0", "comment": "Malware payload", "value": "06f18fc3c26ff3b6b028d3745e020bc973b3892c0a77096b5d1371dc82989298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262528, "uuid": "7761c0f5-ac2b-4671-96ff-93f02bca0f35", "comment": "Malware payload", "value": "4185141db5402579321714059282892a932661cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262528, "uuid": "49c7b558-8bcc-4310-bd16-bda5417483ff", "comment": "Malware payload", "value": "aa676c8e48fdb860fd44bb20276958dcb48ea1b0f9e216537debead90916572dd442615a4cdc7cccd753940954053cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262528, "uuid": "c7a2ca16-d5de-4bee-8757-b95cda6422e7", "value": "T1B3342A161BD89B29F57F47358178020063F4F612A723E7AEADD160FE1D62B828B1771B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262528, "uuid": "61e10b8b-d7ba-485b-8280-5c7854b662c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262528, "uuid": "bf6c4ec8-8f0f-420b-a55c-d4af36befcb0", "value": "3072:dYMM1I+KA805Y+V/yW5/GMiP9L/GdXFldIOSSM9XTeOPNyoHSIoxdQk:s1I+KUhyDMQad9hSDN7Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262528, "uuid": "6fac7203-5d9a-41a4-8f41-3a03487a57c0", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262528, "uuid": "e4adebc2-892a-4d3f-9e8c-59405ba75242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262528, "uuid": "679c95f0-37b3-4bc8-ae99-de7086bd6463", "value": "open this if the doesn't work.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787b9a25-3625-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635229510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229510, "uuid": "34fdca03-7938-4e9e-a3e9-0aa4cff26c05", "comment": "Malware payload (AgentTesla)", "value": "746730b158d37bfc83138fc21746d71b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229510, "uuid": "34e52d36-d4fc-4cdc-a94a-ca5dfc2e6d3e", "comment": "Malware payload (AgentTesla)", "value": "0728b056b8d85d4962e672c30f845e77aff6e2b40c524434376be7589eab3a81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229510, "uuid": "c366fae3-fa90-4ff7-8102-aa120bc81da0", "comment": "Malware payload (AgentTesla)", "value": "6bf45c1ed7e0a8dbdbd976cdec1a973214ed3f47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229510, "uuid": "14141b3b-921c-4c17-95f6-439f9e597dca", "comment": "Malware payload (AgentTesla)", "value": "f92d349b4ccbbe0114a502f983db9aee4697b7fb52ef9d8483047bba6c02d802a6954ea6722a36fcd253f0ab22912d19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229510, "uuid": "f01bb392-35ec-4e07-9d34-5dbb482de676", "value": "T12E84126C5AF9E32DDEBE177C8095146843B842C86912F7EE0EC1A1CD3E7B7025E4216E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229510, "uuid": "54b01b7a-8d8a-4ce0-a2fb-e553a9162fb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229510, "uuid": "b559d58d-00df-49cd-8683-42a6f713c45a", "value": "6144:Vxb5bQJX2fWEG+OPQQ/GbA0O8mILM2zXUs+zb/0K4URE/Y9+m9:VNO1oZ/AQQB0O8m21XFqvE/Pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229510, "uuid": "c77e17eb-96bf-4cbd-b89f-84e383670e00", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229510, "uuid": "692f1254-4159-4cdb-b7a2-8415fb77c2d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229510, "uuid": "4e1b1c2b-de1e-47e7-8691-17e44b8866a3", "value": "hGcq4H7BvYXsjbs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d1f088-3644-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635242689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242689, "uuid": "354cbc87-c45e-411c-afda-5134486f446b", "comment": "Malware payload (NanoCore)", "value": "06e79cb697e436c1e66c49d3c39dbd82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242689, "uuid": "f9f9e50f-c5e8-4734-9ba2-fdc0b4485dc5", "comment": "Malware payload (NanoCore)", "value": "07749072a852c769fad91c350e6921b811fb04de3448516e2ccf5b81d07e22e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242689, "uuid": "218ad8aa-5d52-4db2-818c-9dfb73e0024e", "comment": "Malware payload (NanoCore)", "value": "025758750ef682cead7c98f6cf4156c7bb33a3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242689, "uuid": "e53bfb37-7c83-4198-8370-1514dd6edfd5", "comment": "Malware payload (NanoCore)", "value": "f20ec5af5ee7beb31ff0de54acff26c31f0b3f495f5d4899de34ee55be4337f91bca178e884c4c256804287035e5711e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242689, "uuid": "47546456-0f26-4a6c-bf7d-d690258abc62", "value": "T141A4BF98F3749CA5F41781BD5877E8312133AE6A6823890E365E722D5D7338350A7F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242689, "uuid": "3e991873-8ce4-401c-9f90-8bf01342e13e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242689, "uuid": "a98c5540-67b3-4f6d-befe-d69f13704bc5", "value": "6144:75UiswNkTzNaIaX++UCEbOUPhM2yXJogC6HVcUGDneVy2vakl3V:FkyX+7OUPh3y5D1cVDneVyYagV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242689, "uuid": "4abd234a-031e-47cc-a6cc-ec0961a7544a", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242689, "uuid": "fb664496-caa4-49b9-ad23-1931a54ee6e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242689, "uuid": "03107a23-b2b3-408d-bb98-7c03d6515b1b", "value": "Payment Notification.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844a8ff4-3670-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635261742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261742, "uuid": "0238605d-6c96-4e1d-963c-45d5788ed7f0", "comment": "Malware payload (RaccoonStealer)", "value": "fce7e8f5fd983481a7683a721ea95d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261742, "uuid": "f57a28d6-c197-43f2-86b3-22e7fc4af8c6", "comment": "Malware payload (RaccoonStealer)", "value": "0abca757a21c853f04a42d9198e1d165cba434e5602609a0783e3e04131bd29e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261742, "uuid": "acd92498-a2d3-4909-9782-229fba571a7a", "comment": "Malware payload (RaccoonStealer)", "value": "1eb83bf1984a99681b66dccedb743079607eb952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261742, "uuid": "a926ea7f-8bac-4731-8076-582b77495868", "comment": "Malware payload (RaccoonStealer)", "value": "1ee820f844bd436d6bf5ad78e1fcfff5b2f05a76552baa89ff4fdde3d1e647df501486ad050705e7ddf1bda7cc521f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261742, "uuid": "7d27265a-0c33-46fc-85f9-01c649f7f075", "value": "T149A4012276C0C439D9B796318C52CAE2467BFCE2D83C547B37CB792F2E712819A16356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261742, "uuid": "ca0c53f5-5d54-4a80-9769-78d096160504", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261742, "uuid": "4a5b98fb-1e7f-4134-8bb5-a7f01b04bd16", "value": "6144:fjIfNdyE0CczpZ2hXHLgIEdF7bGdsE/NtAAhFCp76WKAHGhzoMNu5RqzSHtv4aVj:g/yEBVr3mFvGd/fJFuKAkiqzSH1DFyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635261742, "uuid": "69b72e9e-91e7-426c-8bbc-ba0f9a266e0c", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635261742, "uuid": "98620de5-f0db-4dc0-824a-8853cda4bbd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261742, "uuid": "c991cda5-a3d1-4a31-ba64-27ddb1474f37", "value": "fce7e8f5fd983481a7683a721ea95d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27cea48-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635263189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263189, "uuid": "035a26c1-fca3-48d5-ac6b-7b33d0b7aa59", "comment": "Malware payload (Vjw0rm)", "value": "b52fe288ee67ceccaeee80dc4749c358", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263189, "uuid": "a88d7054-67f9-4ddd-a1d9-d42b69f6d517", "comment": "Malware payload (Vjw0rm)", "value": "0aeb9b8280cf3a77ec5e44ff5b3866aa17f011a1e0b47dd7b70133d8fd607b56", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263189, "uuid": "21ede36f-26b5-4f1c-b49e-0031c154d094", "comment": "Malware payload (Vjw0rm)", "value": "38c1641f3aa617170306572bfd41e8a30b42d693", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263189, "uuid": "d65f4b1a-bed5-4bb9-bfc2-3c91ffb78baf", "comment": "Malware payload (Vjw0rm)", "value": "ca039c87433a0f3d735672a329d6846e7650aba066fe18c7afbcbb92b31cf3ecef8b619010d506ae0bf1c73008b7548c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263189, "uuid": "35e8da19-4e9e-4912-a09a-e7777bd8adf2", "value": "T1C2838E459E413C46B5B4F692109F0024CE16E6F4CF2AA45BE08939CD0EEF2576B9FF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263189, "uuid": "877a5e64-9342-44ab-800f-989eb65de645", "value": "384:0jfHP4VQ4jLhQpJWfDQubKIsnfAf2fGfgffqf9X5fgCaWqwUQn:v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263189, "uuid": "dc34cf3c-0cde-4b48-935f-77038da7ca67", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263189, "uuid": "c47f7ef9-a093-4bea-a6e5-4d91094d5fd3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263189, "uuid": "bbc3fed7-000e-4483-93ff-e8ddc1c59c34", "value": "n2m18_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89249e3d-365b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635252731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252731, "uuid": "b7dd6d9d-ce04-40e0-b88b-f4ba2a636fd0", "comment": "Malware payload", "value": "6abf697a343d8fd73a7f512e08fb9c91", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252731, "uuid": "181992b3-b0d8-4f54-a3c0-83fbd334d030", "comment": "Malware payload", "value": "0ba71f9d719ec035f7c15474a97d2410534fd93651e25552a620bc9fddd9e253", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252731, "uuid": "45324bdf-0248-49da-a6d2-3e9c63c335a0", "comment": "Malware payload", "value": "88749bace21d1a0cc7b3efc35e8576f7be536973", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252731, "uuid": "227a8dd0-ec7e-4e63-bcf5-7c59c25cf3ef", "comment": "Malware payload", "value": "42815f5f8aacb60751ec1a97b4e8e2b43b87eb7054d6ce348b0b3b06c7c838f6821847015da677dde9bb29d3fa9414f8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252731, "uuid": "5812c089-9a66-46df-bdd2-a67a02070408", "value": "T15654F1782BA4697EC9E90A7DC586812486F0EED17982F34C7E5E793D9933BCC08143D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252731, "uuid": "0135769b-7bdf-4673-ac77-f4083fba91a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252731, "uuid": "c74d95b1-dcc0-4abf-8bfd-ff27cd0e7d77", "value": "6144:EySIP972zJ4cEanWDjGpjGxvJ60EgZDspZhx/DJwMRO4:Eytt2zFWf3vo0EgdKZhFDJwmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252731, "uuid": "2d36c7b8-4def-45d6-9b96-14854f5de089", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252731, "uuid": "306e4665-e8cf-4c6b-be39-09e288609af7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252731, "uuid": "cbf1ca30-4ae2-46df-828b-1c2b12e015fa", "value": "Dhl_FX9087H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42deadc0-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635262921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262921, "uuid": "9a5d1d01-2c47-4e46-a702-98fee1c4a3bb", "comment": "Malware payload (SnakeKeylogger)", "value": "75092844a3c2f6726cbbc6abc08ecabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262921, "uuid": "02ea128a-8024-4cc5-b0fe-9601918eae3c", "comment": "Malware payload (SnakeKeylogger)", "value": "0bed29205093ddf132859e47613c614a2908bb32f124caac4d85f06b676d672d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262921, "uuid": "3a1849bc-9ab6-4b7e-8b69-25717cebd579", "comment": "Malware payload (SnakeKeylogger)", "value": "0746152e28c33a4fd26d43e0e3de20485b988381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262921, "uuid": "1f9c040c-2d9d-47df-ac6b-36be65bd0b8d", "comment": "Malware payload (SnakeKeylogger)", "value": "fee8e614e63eb220533cece6b44de26b1efda60f28a161dce4712401705955d302eef56d0d96b8e36f98ca2002c0da01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262921, "uuid": "49af9ed1-2c8e-4647-af7a-5c4c76083d77", "value": "T1C8053FC2F5C3EA1FC5D825B09681CE1074646FD8412FB995FA6A7E9EE33F690A90C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262921, "uuid": "55c6d4ed-43da-45c4-8c38-964180207b1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262921, "uuid": "b9150352-d331-43f7-8ab4-faf0c9eb090c", "value": "6144:JbkozvHu2loqZtLufLpFvrgH0iakx+tPk8tj6Bp57WBeVbN5CtphhptttcZ/wXyx:eoLxf5yBq5gl6iEC/MHmg789IW1dXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262921, "uuid": "0315d94a-b502-453f-873f-3578f31d6f18", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262921, "uuid": "4abcf351-6ac3-478f-98a3-33b97853a0d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262921, "uuid": "f2068d89-d2d5-4cac-90a5-de3ecd6be3a0", "value": "6R7Arc4PyuCMzJHYxYZy6Apdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3db5e21-366e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635260936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260936, "uuid": "2e414e7f-0a78-4cb2-8142-0db6994ad0f8", "comment": "Malware payload (Smoke Loader)", "value": "f50e748b30a91dd671d0c6fc2f8e8681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260936, "uuid": "4136685d-2753-4e19-8686-c68601e3a727", "comment": "Malware payload (Smoke Loader)", "value": "0c234eb09ebee0e484dca3d0f6bf3072843b89527ecd6cfa4680eb27f0b8f032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260936, "uuid": "2caea941-f6f7-49db-b212-c6399561dc15", "comment": "Malware payload (Smoke Loader)", "value": "67cee6fffd5e2ab09ed92f490b2f991902ce3c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260936, "uuid": "366ccfd5-065b-4b84-8792-8e47991db215", "comment": "Malware payload (Smoke Loader)", "value": "f6a1147874dc903fafc1154e5bbbd50fc2802ab19f32fd7e03130789fd5b4ce0eafb06c4cef45e9ec3fc5dd3b51557ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260936, "uuid": "019bfc38-8ced-483e-8ca0-53acb4661bd2", "value": "T16924BF103392C47DC5B652704C61EBE15A3ABDE3D92E854B6BDB3A2F2E703805A36357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260936, "uuid": "d19739dd-2bcf-467c-a3c1-22fe75f9d03d", "value": "a756627435b382dc3646987f64d479a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260936, "uuid": "50510e62-bf97-478d-9dd0-2227f291b8a3", "value": "3072:rClvFJSsjoIMXno1JGJkr+AJkBNtcj1Bl5hDdXsU4FuVMO6P2+BwvHJ3/R9:2FFNjoR3oDGJkr+AO03l5hDdX/oynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260936, "uuid": "101a1c57-7bfa-4953-b98c-b973c91e48ca", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260936, "uuid": "9decedc5-aeb0-4240-aab1-3d8cba73a664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260936, "uuid": "8812b85d-830f-4fb8-b885-7cc4efca01ba", "value": "f50e748b30a91dd671d0c6fc2f8e8681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc74868-3674-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635263285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263285, "uuid": "525b2b87-6a04-4173-8794-61a34caa44f6", "comment": "Malware payload (Formbook)", "value": "85ec8033b08a339d131abcf8746db957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263285, "uuid": "98c2e8cd-6806-4370-aec1-1a5edb9abc07", "comment": "Malware payload (Formbook)", "value": "0c36467c738ac49e2b04f05ebcdc3d9144727758b2e844bd91be84bff3f94956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263285, "uuid": "14042d27-9ab5-4e56-a13a-9606da0d0500", "comment": "Malware payload (Formbook)", "value": "d6364dccd2fff8640cb092bae5af2f41de0fad8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263285, "uuid": "de65aacd-48a2-44d3-b936-16a0960ecf68", "comment": "Malware payload (Formbook)", "value": "902062ed1121dd3e930103844dc6a6ed71df79823df5f4f2153b2a6077b0e2de0518778c55ea554a107c1d51ad5d71ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263285, "uuid": "4036928d-48bf-46fd-b87c-bc2d4fe6acc8", "value": "T1A34412A377E505AFD79693B00BFEEFDAEA7B9E044520869F07012EAF25346C04E05785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263285, "uuid": "f29ea387-8d92-433c-a79d-2bdc5d08b998", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263285, "uuid": "8f3f98fa-77db-4817-85ba-c2ceb9c41652", "value": "6144:wBlL/c3sIhLFTqneAMsQA/HAQMVWkO2yok9uKnQmK0:CecIhLlqasQmHARVWRVokg0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263285, "uuid": "a8c645da-5cbc-4b00-892a-81399d9de2b9", "value": 257807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263285, "uuid": "0f6be05e-6857-4dc6-9626-675621952539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263285, "uuid": "31412a4e-b7a7-40ff-ba04-9f7cc072dad7", "value": "RT3051026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5807c7e-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251597, "uuid": "f5699513-e1f8-4201-800d-9dc776c94fcd", "comment": "Malware payload", "value": "ac1f5dfae069ed96ea7111677177c425", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251597, "uuid": "78e5cd09-bf28-4be3-a0ff-a43ad818c999", "comment": "Malware payload", "value": "0cb8ab85dd8fa7b41ed6face6bcbc676a75652be3af464bfc7f25acec0e8e630", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251597, "uuid": "1d45ca1b-363f-4d5d-84d8-4fcae9858be6", "comment": "Malware payload", "value": "14539e4e875c4ef25c350f8eb2135c94f25a9e11", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251597, "uuid": "1ff9edbb-542b-4856-8c1f-958b395e8870", "comment": "Malware payload", "value": "bb1023b3105b4c1dea06df58d020ec304ee4542368c2e6b930ebfbe5bf9e6d4ac84c4614a04153537fa7c614419eecae", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251597, "uuid": "6933d6c9-2b62-4129-bdc3-f425c4c6545a", "value": "T155A4E162B9650F7BCDD135BC8063CBBB8A4E5C36CB408AE77904F1645A3499CF27864E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251597, "uuid": "25eff01b-9e95-4425-889b-7bfefa0cef11", "value": "12288:ARU4u8GBo4jDP3qsuwpSBV3ebooocQrGR32CW:ARU4vGBo4jzqr3eco6gZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251597, "uuid": "003f8ad7-4027-4b07-bdef-b696e3e70049", "value": 451320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251597, "uuid": "e91c661b-a71c-4d64-9a29-11ef723d0533", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251597, "uuid": "9a466f2e-b891-4179-90b2-9de3f19005bf", "value": "Requested Items.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98460c71-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635252756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252756, "uuid": "2efa9242-7fb8-4f68-bf9d-349dad00ba45", "comment": "Malware payload (RemcosRAT)", "value": "7bf9e7df3851b225fb932416d792bfe7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252756, "uuid": "3cf58336-d1aa-4554-a8ef-f06a2f2a695d", "comment": "Malware payload (RemcosRAT)", "value": "0ede7febc557ad60a79097e1f1edf2356d2697aaca2142cc64d70240323acd21", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252756, "uuid": "9635cdfd-847e-4884-aa07-86d8d990a08e", "comment": "Malware payload (RemcosRAT)", "value": "e89b23df236aeccd6975bc95d1d734df61874b3e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252756, "uuid": "242fa899-61d4-4224-af20-15ef7cf4810f", "comment": "Malware payload (RemcosRAT)", "value": "a871b5118296b8a2c2a319aadfc9171ad7490d30a07f70135dd0ce00ca845583de5020592c9a54a63066df0d8d5fc353", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252756, "uuid": "b783f2de-c18d-4049-9196-3ef69ff71d9f", "value": "T102257EA2A0C144B3D5733E75BDEFA7B9DA283F602FA8D84107E5B8191B35241793D06B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252756, "uuid": "10cbc4a1-da65-410e-a8a8-a45bb47d67d0", "value": "c408e5d23334aeef4d12e2007ba01029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252756, "uuid": "b0049381-a565-4fc7-823f-d82dc19955c6", "value": "24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCcoK:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2AD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252756, "uuid": "3aa8a060-f9e4-4394-8a59-5bbfe33fb40e", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252756, "uuid": "13b87f76-01b9-4e13-b492-05b98abd9e75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252756, "uuid": "6835c0e5-3104-4c7b-b424-a3825af7b6c8", "value": "DHL_102521 Receipt Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995a309a-3652-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635248892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248892, "uuid": "3bfeb48d-d609-4d0e-9db3-e68446540a9b", "comment": "Malware payload (AgentTesla)", "value": "b653ae5bab899f2542604e2b01793bd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248892, "uuid": "71c85d1f-ddfc-4a98-baee-0d90d514cfd5", "comment": "Malware payload (AgentTesla)", "value": "1029f8ac2b3c5c0aa0bc054a34592db9a2ba835ccf64106b4db7ef5efa6d7e7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248892, "uuid": "d41c6926-fd2b-40ec-a36e-e0f1b1ad8214", "comment": "Malware payload (AgentTesla)", "value": "e3601173e68fe72ce0e38e57b9393fcbdc30bed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248892, "uuid": "a5da109b-49f2-4e03-b131-8fdcfff2669f", "comment": "Malware payload (AgentTesla)", "value": "9f32b6059240b3873c14d358af046597dcb6e61794300f282418a0fa08ad1e2d207b14b432f390b26ec5235f6266ec2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248892, "uuid": "f8550f8a-3f52-4772-a4cd-f42af69edcdf", "value": "T1E784224E2BEAFA30D5FF13FA9498511482B0C1563926F7ED4EA5E4A83FB37051052A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248892, "uuid": "c4da9352-8ab0-4a54-80e7-82180b869b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248892, "uuid": "ab40e535-46c0-43c8-935e-199f26781923", "value": "6144:svXWXwnBE9uFujgYy42ztn8UcDsmoI4uYWcYA8DdpjOhquLdIfSUu:/XN9mPn8UdmJCWcYAeUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635248892, "uuid": "03116c73-bf2a-44cb-9979-f8d2bd3eca5e", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635248892, "uuid": "063f396a-25e9-4e20-a615-795d19745cb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248892, "uuid": "2146b676-0eb8-40ce-86c5-7fffd6e4cd14", "value": "P. Order & Contract (A-4553).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9decb4-366b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635259766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259766, "uuid": "cc854374-ae5f-4e08-9c6e-af85a3386c56", "comment": "Malware payload", "value": "ad638220399f5523afa8ab321fefb504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259766, "uuid": "f0c9d548-b80e-46dc-95ba-fc3c2b812ed7", "comment": "Malware payload", "value": "107f887e88ede803b418e9f330817fb1e45d4ba4538f0e000f9510edd784c8de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259766, "uuid": "9a5636b0-db59-4c73-960f-0aeb4d129fa3", "comment": "Malware payload", "value": "b46b87a0a51f82ac9924887b898eac497b01b9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259766, "uuid": "6bc859e7-6e32-42b3-9d35-1ae667fc3fb0", "comment": "Malware payload", "value": "064d17ead1127a83c54c41c78c51a8208ede5622176c094258b5aa1a3cbc2c82f241f32587d606aed092209d33d3467f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259766, "uuid": "aa0c0c86-c1e1-4f00-8687-a0c3bac7566f", "value": "T14CA35910B3F81464F3BBAF70AD7249851E36BEE2BEB1D60D4518018E0936EA9DD39753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259766, "uuid": "74e17f9b-8404-4c34-92e2-2f949caf9d50", "value": "3072:M9ww7tP+d0yCy9DC6V/dQILI1bStP9aGspgM3NOu3y7:CG1OIs1brXp39Ouo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259766, "uuid": "1a824d15-ac60-4913-8194-070b21f03f98", "value": 100999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259766, "uuid": "7274c8e6-35f1-448b-86cd-884cd9b75cec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259766, "uuid": "0ff53ba9-7f17-427d-a185-2f9843ae5fec", "value": "ad638220399f5523afa8ab321fefb504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9492fc6-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635258851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258851, "uuid": "13e8ac67-0937-4add-b31c-01b9f87352a3", "comment": "Malware payload (DanaBot)", "value": "dfb70f4e40f91f1928068bad6e00f657", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258851, "uuid": "7dcc132a-bd18-4a34-8ccf-c3cf6d292d83", "comment": "Malware payload (DanaBot)", "value": "11da67d2ec898827753f51e2bd4fc8329a5b29f33bcd1494f996c311bac93e7c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258851, "uuid": "5aa33a5b-792f-499d-acfd-dec75084c818", "comment": "Malware payload (DanaBot)", "value": "0fddb2128fad566f9d098ff190542e8dcf242f89", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258851, "uuid": "1d1dc55a-7d3c-498e-b4a7-93a34582f438", "comment": "Malware payload (DanaBot)", "value": "77ce9af45b9fdf16a9fed5c87d645bf6a1e4d814ceee325fa9036908107a0d20c1abd44e1a02683ebde6f48d3e03cf55", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258851, "uuid": "aa00c874-56a4-4908-a85b-4b1f3faa4778", "value": "T113352355B681C025E4A686304B42D6A2232FACE7DD7D8AB5378F3B5D2F7038079B5372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258851, "uuid": "c51eb0e5-ec34-4f3b-8bd6-a823045642d2", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258851, "uuid": "a844a2de-d99a-4b28-81c6-94d09738b1f7", "value": "24576:hTH9Pby5Mc+/N/C6bx9qJvhCr9kflhhJ+fhff9Z7BJZS+29nN:hTdPbdxC6bxIJvhCpkwB9Z1Jg9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258851, "uuid": "39e3cb21-627d-4be8-91eb-452b31ace456", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258851, "uuid": "d731aa06-9573-4e15-afb5-1e9704639a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258851, "uuid": "8fcc4e8e-0358-4569-8e8a-0f1ec1f8ec95", "value": "dfb70f4e40f91f1928068bad6e00f657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed69ed96-35f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1635207372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207372, "uuid": "ec9bb3d1-f272-42e5-9ee9-029a20da4f56", "comment": "Malware payload (AZORult)", "value": "97142312c6860e8e5d6452c0397b3ee7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207372, "uuid": "8863bde9-b3ee-4a88-a468-1c035811f2ee", "comment": "Malware payload (AZORult)", "value": "12753e984aa4edc41ac1d88b8d945f38b0f6cf423228a6bae4d458ca026d9f38", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207372, "uuid": "231c039c-c337-41e4-8e0f-618eaf08dc64", "comment": "Malware payload (AZORult)", "value": "0778dbf9ab607aecbce688d1c3128d3a73b931d3", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207372, "uuid": "fe3d13f6-44ca-4dc7-808d-0e64e69ce746", "comment": "Malware payload (AZORult)", "value": "1ca74aeaa9283ab77c92eb02476f8fe2368fa93106aa5c4c0f121ef3d0b7cf9093e06c26652ae0fc51699028f8010f7a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207372, "uuid": "fd21ff2f-360c-449f-8d3c-aff8f05ad9be", "value": "T13E534B507B888931DAAE373B82D7144163F6A2971272D31E6FCD92FD68422D34E067DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207372, "uuid": "cf4ed2fb-bcf9-498c-a7bf-20f3851df0f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207372, "uuid": "548fa04f-9fb8-4eb2-988b-adbe34da5495", "value": "1536:K23gstngJt8ex76i2ZHTSCymSq5yuwdXH8X:K23gstgJt8exIuXmH5NwdXHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635207372, "uuid": "3f7db9a3-83fa-4ed7-a0e3-6cd3e1ce6d8e", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635207372, "uuid": "dc635c02-d6d4-431e-92bf-4739a9fbce46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207372, "uuid": "bb25caf9-10c5-4840-bf09-a66ca20a2fce", "value": "0778dbf9ab607aecbce688d1c3128d3a73b931d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ab12cc-365e-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1635253906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253906, "uuid": "17724c2e-7fdd-46e7-8623-9176af79e039", "comment": "Malware payload (OskiStealer)", "value": "810a82f75517c167b50617cd983ba22a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253906, "uuid": "db6487b4-6f74-4e09-9936-873d3f7b9cfd", "comment": "Malware payload (OskiStealer)", "value": "12ca573395abe2197dd8e264d780b988830337b1ba66723c2ced6a0ce51993ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253906, "uuid": "6170dca8-e25c-4589-8c06-460cbb8ab353", "comment": "Malware payload (OskiStealer)", "value": "a3c591f17077af53b6cc7ea0e935354ec7acd2b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253906, "uuid": "907e8c27-dc7c-4551-b36a-feef511a6c51", "comment": "Malware payload (OskiStealer)", "value": "9b1e942cce1cca5796f66d7bd8490cab6d72ff5f04056bd548798baa9c1c3fa75341b23974cadce701d53a646eca3e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253906, "uuid": "36f6d123-ccd3-46ba-b155-0aab2d07ddc5", "value": "T1A284129447FD5630DAF90BBEB098A8496ABA51A82901FB2D0E00F1B97D37743C147B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253906, "uuid": "93942c07-4420-4f58-9df7-c48180d0b929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253906, "uuid": "f48993c8-b2a6-4b6b-9640-544eb2782763", "value": "6144:zsXZI3stD/X5mA0Eh4URliiBbLI220HwwUL1sfMwmCQeP2gf0cd9bl97o3Y3DpM3:A6s9oehEybLIiw1hsUEhugRnD3DpM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253906, "uuid": "6ad63a26-00c2-4227-8675-ddf9f22d4a4c", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253906, "uuid": "d7ac15cd-68db-4ea0-9c7d-796092456839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253906, "uuid": "20ccc824-e8ef-446e-9eb5-607e696919f4", "value": "810a82f75517c167b50617cd983ba22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3b5d46-363b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635238804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238804, "uuid": "4b269631-6b94-4894-bd0f-b1f9b1603f5b", "comment": "Malware payload (Formbook)", "value": "02efd596d71089ed8db9062b5adb762f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238804, "uuid": "467471c6-4df9-4674-b298-248309e9880b", "comment": "Malware payload (Formbook)", "value": "13063a496da7e490f35ebb4f24a138db4551d48a1d82c0c876906a03b8e83e05", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238804, "uuid": "7cf3c3cb-823f-439f-8d15-aa7fd658947b", "comment": "Malware payload (Formbook)", "value": "52d13613796b8df4c94012872085f37f744e1fcf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238804, "uuid": "f0cb0c1c-90f7-4985-8554-fbd50aaf040d", "comment": "Malware payload (Formbook)", "value": "2ee41a69610876f8e154840bacaaef86e13e2a7caaa82bda0ccfcebc67865edf81eb05bb09497d32aa423ccfc7125332", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238804, "uuid": "2bb48758-21cb-4b12-90d4-2464193f8b57", "value": "T12F44BF3181196326F096B5BEA798BC680BD9CCBD6CC961FC1F05B607C4B61398CF29E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238804, "uuid": "1ff5c6a2-684b-4c28-8fc0-a4c3c81361a5", "value": "6144:ohwYZg5IjsEb3tYhmxEYE9x5faGaGN2Ko836hl3oPAdZbcT:owYy5IwqymxK9xhaGaG4x836HogZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238804, "uuid": "992ca279-76d2-4519-89ce-fb904c814f10", "value": 271432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238804, "uuid": "bfa19970-7370-43a0-add6-d2eca062197f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238804, "uuid": "154ec6d9-987a-4183-a1a7-948a43224cb3", "value": "Remittance_Advice_USD35,949.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68f1080-365d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635253720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253720, "uuid": "07fef59a-70e6-4f2f-a19c-875a30a5a79b", "comment": "Malware payload", "value": "9629f328fcaef5a5129088c653a90981", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253720, "uuid": "85c732c5-d62e-49fd-b098-66b190655f59", "comment": "Malware payload", "value": "13d1bb365917dc7b8e8903fa499262112dee1622072103581e53af7270c753cb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253720, "uuid": "369ea315-7211-4235-aa5c-99ab319b92a0", "comment": "Malware payload", "value": "ee5e1ef9cf429d361464fdd40229126874659d69", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253720, "uuid": "d4ca3288-3f5c-4677-b949-bb1169c73843", "comment": "Malware payload", "value": "7f162a2e129eddfcd2616033110d27c70ef96bb9f413600d7212bec585380349777c9c36f9c797e9c07aadd257e87c6d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253720, "uuid": "969bb074-5a50-4a79-aa3f-b65f56872884", "value": "T11E5423CCDD25C902E64AA873FA80B5C3756075A520EDBE27B2D6B132DD3388D4319DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253720, "uuid": "de838f00-96a4-4fde-ac10-ff65c14f7f01", "value": "6144:zGnBfAvWIHvgz10P46i16EfMR+AvpHLpiMBVIgRYG40bnEEcAcpLjWhsAdZHJs:zGnpAvWsv4A46i16Ef1AhHLgyVkwLc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253720, "uuid": "49736896-6b56-4ea3-ad0d-52329fe21f5b", "value": 287195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253720, "uuid": "873e0152-b10a-424f-8698-6a771882f218", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253720, "uuid": "ec3f0a9e-dc91-4d67-9179-19709fe878bf", "value": "yEQ77qa8Wm4h3lqL85wIFg7ZgcptBbcn1tSl8VslZ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efb4ceb-3650-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635247882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247882, "uuid": "13640da4-0a6f-4415-acda-4420885c2bb4", "comment": "Malware payload (DanaBot)", "value": "da31da82503730a670af571c2cc3439d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247882, "uuid": "8fa10726-d25c-420e-bd4b-52167fe7bf50", "comment": "Malware payload (DanaBot)", "value": "15691c73aab5780751badca9956f6a30a7f4e4a36bd246db8cc15e6a3e72c7ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247882, "uuid": "282c6af6-90d4-42fb-8371-36fdf85334c3", "comment": "Malware payload (DanaBot)", "value": "75b648a13fb935a1fe10fed9191f645b018b0729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247882, "uuid": "315d7837-019f-4860-aa15-279023e2896c", "comment": "Malware payload (DanaBot)", "value": "d4ce8d281b7d846aefbee97feb05a3e9da435171ada6aa1db57723abfd74554b71019058dbb8eff1d2c9e256b8e6810c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247882, "uuid": "f7132dda-1965-467a-abb1-9fda93ce6ae5", "value": "T1F16633B7FE608A28EC1C45701529B8AC6971FE1A59835D0A1254BF2E7B2BD630D11FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247882, "uuid": "56841c80-3493-49f5-a634-702dc6ba68ad", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247882, "uuid": "28387fe7-c6ef-4831-b40e-be4c96ddb9ae", "value": "196608:Re/X6CsJ46bxuEeZB2E4mBbD70lm2JgF888Ig7FJjJZA3f6H:R+T6YF2E4mB70P2W8ngJJjlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635247882, "uuid": "ad23e128-9738-42a3-99c8-81b62c3b7b70", "value": 6485055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635247882, "uuid": "bdab6d93-efca-4a7b-98bd-3ab3400c4ecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247882, "uuid": "609831ba-c32d-4291-a951-621743124f69", "value": "da31da82503730a670af571c2cc3439d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd78e5a9-3665-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635257114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257114, "uuid": "66a09042-f92e-43b5-a49d-9683e8319eb2", "comment": "Malware payload", "value": "13b44880fdf6e313f3a624665a45d2d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257114, "uuid": "709b60bf-f3b7-49e1-a19b-d293bc78aa67", "comment": "Malware payload", "value": "16a244c1397a3bbc4053e021f52c7e6fb013a1ba336814d2fff42d375d713bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257114, "uuid": "b5f04379-be4a-480f-9443-c2c6191c445f", "comment": "Malware payload", "value": "a543c1b2d4a5f7332c38c02f74270d23500787c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257114, "uuid": "422234d5-cf43-4519-97a3-dfefe811bcc4", "comment": "Malware payload", "value": "ce237eddcd688d26bec1429f4b60a3638e01684aff48b9df9ac11c6b1fba4c1a14b96f34e9598c56fff39054924780d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257114, "uuid": "376a0121-f2f7-4cd9-a819-262255aa3052", "value": "T116E412117292CD75D1B792318963CAB60A6B7CF3DC3C96473B87372D2E71241AB62326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257114, "uuid": "6c74a082-91c8-4368-8b26-7d921e0a59a4", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257114, "uuid": "f9232e5c-570e-4ebf-93db-92d809c47b46", "value": "12288:vYq/4o3gY2Brd1kqTDh8ryAt3X58STcuCmVKFX4n/OcIw3tlS:vvDwY2BZ1RTuryAt51CmV+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257114, "uuid": "bc29257b-52ed-4c7e-aca3-9c01e4036588", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257114, "uuid": "71e403e8-dfe9-448b-a528-c2e08275e485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257114, "uuid": "de64f178-f3cf-4dcb-b68d-f9348759fdcc", "value": "13b44880fdf6e313f3a624665a45d2d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fe6bc9-3637-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1635237153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237153, "uuid": "58c548e8-9c12-4927-86b7-c39b21f4782f", "comment": "Malware payload (Stop)", "value": "c659988758cbc8c589b8d68072bbb58f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237153, "uuid": "2ae1d564-3e76-44a4-9ea5-045be4be2273", "comment": "Malware payload (Stop)", "value": "16c3f8999141beee55afdb49670b9e44b4916816faeb643639a7ace81c13806a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237153, "uuid": "b2b25552-003b-419a-9095-4ed13c267262", "comment": "Malware payload (Stop)", "value": "1b783397c6d92e787cf1723dc8bbfca9fe46a437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237153, "uuid": "a882ecc9-9a7f-412f-9c12-1c8697795d0c", "comment": "Malware payload (Stop)", "value": "edb15cede88392381e3b19a70d9c92bacb3e3ac4eadab5c299d8e7fa3567bd372a4448a69c2f37e94debf1ac536d237e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237153, "uuid": "cc4cce6c-0584-46b6-9168-2eb87fae53ec", "value": "T146F40210ABE0C035F6B652F8597AD369B93E3DE1672498CF62C116EE5635AE4EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237153, "uuid": "2315c7b3-1b4d-4907-91d2-9caba00a95c5", "value": "c1a5bb3afb402531c716c0271d97c097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237153, "uuid": "558f2e91-d2dd-4a60-b4d4-98de939df2cc", "value": "12288:MQhmZgez5fwFx+lxlA3YDs4LDFQmitQbJhjvFMk0HqF9YqrE2xNAZx1YTqp:MQhDE123Yo4HGmbR0HqjXrE2xqZA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237153, "uuid": "87cfd50c-a695-4ec6-b75c-d3d5f7dc524a", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237153, "uuid": "f2bd7d91-e44b-4ba1-bdcd-d95872a2a094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237153, "uuid": "69af063b-820e-44b8-bed1-61fc2b841c54", "value": "c659988758cbc8c589b8d68072bbb58f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda8aca8-3639-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635238323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238323, "uuid": "fc6aab5b-3721-4676-8167-bf2ffd51d0da", "comment": "Malware payload (SnakeKeylogger)", "value": "67ba40dc8ad74a411541e4fe6438a8a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238323, "uuid": "4443d46e-b5ee-4320-bca9-4c4531f744b6", "comment": "Malware payload (SnakeKeylogger)", "value": "17d4ec72b74bbba2187d5e7d12f47928bbf5c62e3d90d21b305ebde857fb9da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238323, "uuid": "52b23ffb-b555-4d92-96ca-d8a5eb578a44", "comment": "Malware payload (SnakeKeylogger)", "value": "f828fcab08e3afe85872b323aff46d890d9ef24a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238323, "uuid": "8e1caa8a-7d44-448b-acb6-ddd30c85c979", "comment": "Malware payload (SnakeKeylogger)", "value": "854f6d01d315f7a820000410ab772de235f7f46d39b2062d38eb053b572763e3408d78a7f1e4032e2b8c0e17ce0b38fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238323, "uuid": "5f4c7cc0-e9df-4024-91e6-d00055de2106", "value": "T10954122224C4C8B3E4534E729BAF5741D9A7CB245F10B41713919FBE3D2E68BAE095E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238323, "uuid": "6fbe1ca9-f1a6-4048-8a14-7a3326a2b79a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238323, "uuid": "c7f27a72-d9df-418b-acfa-bbd87a463e69", "value": "6144:wBlL/cmXlTsfp4TD0qJAclsA1JzT5HqIqxfQmlI12O4NmobGJa4W:CemXl0p4X0OflsE5mdQD12Ohvab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238323, "uuid": "a2e8700e-a288-4f74-a411-eab2d299dc99", "value": 305636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238323, "uuid": "fc179e60-3d5b-4e71-95ea-0c20c5ed1e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238323, "uuid": "2795af72-34f5-4d89-be5e-d9f914394e5c", "value": "1.1 INSTRUCTIONS TO TENDERERS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fa95d6-3644-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635242731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242731, "uuid": "57147541-fe5e-4fa2-b22d-0edfdd70be47", "comment": "Malware payload (Formbook)", "value": "e54e7ec5aa72f4d5bb128553728fb209", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242731, "uuid": "abfac900-8fb6-4052-ad4a-e03bbf905b77", "comment": "Malware payload (Formbook)", "value": "17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242731, "uuid": "af2d6b87-bebd-4164-911f-8bb98c97dff3", "comment": "Malware payload (Formbook)", "value": "75def864c40663258f582b8dd8cbad3905f74c56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242731, "uuid": "cadcbf27-bf4f-4b2a-8aec-b8d88e49db33", "comment": "Malware payload (Formbook)", "value": "7ca0eb3a93cece56581c74d04c1ceb653342e55e85338c3dba082536cc79c65e1090d7e4122b12ce9b616b6c615744aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242731, "uuid": "4c06a9b2-678f-4e9b-970c-167a8ec0566a", "value": "T1306412085ABD6266FDB68FFC0086440A97B9582C3213FF2E2CA475E57F77F068445B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242731, "uuid": "7315719e-28c5-45e8-b124-8d81a742ca4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242731, "uuid": "c66b71c5-07bd-4651-8e48-ced1abc6902e", "value": "6144:VUOmwX3A1yQocv/4vl1/tYIx1CdQUrnspbQ10DDs4jW2ncti8yQc9z9K:BQSuIx1CiUzX0PWLtVyHJ9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242731, "uuid": "48969602-bfee-4a28-9632-be5755af7528", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242731, "uuid": "d43f430f-096e-4a65-96e2-007221f19ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242731, "uuid": "a994d216-fc40-45dd-9890-4db65edba6e6", "value": "e54e7ec5aa72f4d5bb128553728fb209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fbc3ca-3652-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635248867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248867, "uuid": "7c099b34-4bd3-46ea-9fc2-ae4cc25fe406", "comment": "Malware payload (Formbook)", "value": "6abafa56150932f18e6d0033fb6cbd9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248867, "uuid": "bc77f583-831f-49c2-887e-101fb9f6fe0f", "comment": "Malware payload (Formbook)", "value": "19f21f6cf4e87d810898c7057147bf0e4c2505eca2109bd99983da377d2a9925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248867, "uuid": "302e77bd-232c-427d-af94-afa58725752f", "comment": "Malware payload (Formbook)", "value": "9a3f19ab57a1e377e842b40258fdf8afd4de35be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248867, "uuid": "39769fac-ec85-4727-b962-8b8e8ac3b633", "comment": "Malware payload (Formbook)", "value": "f1d3a68cd8a3b6f50c4804e1b5f54dedda06ada22e24c604924deeada4dbc90aec30fbcacbcf0f98ef8e1fabea1408e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248867, "uuid": "d4995206-8a8a-4ab7-875f-bb8ba73059f4", "value": "T18944123753C19077F2A35773186567A5C1EA820402AAD18B13D8EFBE8F65BC7B0269D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248867, "uuid": "ffa4ae52-fedd-417c-a9df-a392c669323e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248867, "uuid": "f42f547f-3d2a-4a03-bc28-24d8be6d137b", "value": "6144:wBlL/cvc+vynYfpVwWWEUpIf+4sGZ5d+HF9apzWMBw:CevfynYfe/pIsGrAFpMBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635248867, "uuid": "d5e82422-94ab-491e-a02c-39055f3746bf", "value": 258077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635248867, "uuid": "c703b349-1209-42d3-9fc8-1399cdfd5257", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248867, "uuid": "58ae3faf-626b-4627-8a94-1f504fe20e76", "value": "PO-Soru\u015fturma -Sipari\u015fi-RFQ-26-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34f4230-3639-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635238252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238252, "uuid": "a214953d-8f6b-435b-98c7-9a3df090cf7d", "comment": "Malware payload", "value": "5cf1f752711153e10c98282709acfd12", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238252, "uuid": "e86997bc-baaf-4f70-a080-cca6383b9ed2", "comment": "Malware payload", "value": "1aa8d22e5751869d856ba6fab36f95bc697e0c6c13b90bad050998143ccee5a1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238252, "uuid": "e7054c81-648e-4104-9cee-76d5b9dc89a6", "comment": "Malware payload", "value": "652792dff9908e5ec651f3ec0674541836e314ac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238252, "uuid": "0a25cce3-5980-405a-85d4-aaf2fc46e524", "comment": "Malware payload", "value": "a37dbdb463e2d21cf6634ce6bcc16d52f5e5b0b30413b37527f975732116d757bb60afe83fe7b4dc533c7b4f50ff1f4c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238252, "uuid": "58b8c936-9cc6-4688-8dcb-1a2c882a9cc9", "value": "T1B3B5A931A5357A87C26A0070166FBF1A431C7D87B3DA1F58454ECBF82CEA8F59309E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238252, "uuid": "1166e358-f745-47f8-92fc-55f5b5a0c4fc", "value": "1536:KxxxxavIR/f34HkYmJVJdJ2JOJEJPJdJmJEJGJyJCJEJWJeJlJ7JoJJJmJEJGJyb:KxxxKxxxzdRp/VfAii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238252, "uuid": "6c82272e-c4df-4993-b0cf-53ec6909a9bf", "value": 2345106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238252, "uuid": "cc76ce46-8188-4f26-b39a-f19cc8de04e2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238252, "uuid": "65ba51df-b298-42b3-90db-df33f0ebe248", "value": "E-Invoice_PVFOWE_20181006_5B905D576.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f75c24-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635250853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250853, "uuid": "4167179a-355e-4337-8d72-821f1daa5e3a", "comment": "Malware payload (RaccoonStealer)", "value": "0ccca865e4d4098983d224eb8cdecee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250853, "uuid": "5bebd40f-1560-4513-8b1a-2128ef2e5cb1", "comment": "Malware payload (RaccoonStealer)", "value": "1aec6cc141b967ad7e484585cc9f14807fdea191960515a13e638d26ae1cbcee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250853, "uuid": "e21700f0-bbf7-48e6-8632-bad316cda234", "comment": "Malware payload (RaccoonStealer)", "value": "8a2c6b3c842b11f2d90d98f1f2cc16e61ac5dd2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250853, "uuid": "68409b16-2e65-41f1-9fa3-75c09c1b1b8b", "comment": "Malware payload (RaccoonStealer)", "value": "dc52d9534eba298d36bd4f2984283546e742ebaf8fd35f5fa02b72175ebfe79c821e71f7efbb242f0e82738524b45bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250853, "uuid": "7f9f63bb-695c-4ef6-8c2e-1f9ac22375f9", "value": "T101B4021136A1D476D1B305718875C7A01A7E7DD3DAED888733EB3A6E3E703907A26386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250853, "uuid": "1c84bb51-d78b-44b4-8a7a-6e932329fc1b", "value": "a756627435b382dc3646987f64d479a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250853, "uuid": "e3153d4a-5725-4671-82b8-a4b9971c0c2d", "value": "6144:4c9hAQ3XMUKlVUufRFAU2vb7+CcuFWSWv+tkkmzYgS3xdRRUedilZzwqIyri/UiS:9JnMvnQv/fWSW2WsFPndExwqhbiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250853, "uuid": "15119226-5b91-4502-aa4a-bd51e2cbe0c3", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250853, "uuid": "4124b30d-315b-495c-9271-044a2ca70d66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250853, "uuid": "94c27df7-2c89-4576-90fd-0012a56c37d6", "value": "0ccca865e4d4098983d224eb8cdecee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e28f95e-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635260443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260443, "uuid": "e9f24321-6069-4554-899d-3a4a1b76de8f", "comment": "Malware payload (RaccoonStealer)", "value": "de144902cfb8d1862aa25550a75a41bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260443, "uuid": "be0007b4-9f8e-4865-afb0-bfe3af79c544", "comment": "Malware payload (RaccoonStealer)", "value": "1b32252ad8a9cfc4888eac00a38959ef06db5a91e2b8bd11e6c43cd1dbec215a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260443, "uuid": "8470f110-0d4c-4499-ac9f-34588069839b", "comment": "Malware payload (RaccoonStealer)", "value": "28f4a203a54aa0fcdec2ee91056da15d10dc108e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260443, "uuid": "aadc1992-a656-4786-9c06-1d8b46254ea9", "comment": "Malware payload (RaccoonStealer)", "value": "63ab99bea82f6bca76bddca88d920816c8621ebc52841e91074691282710686778273da2418ca52b5007355526b03783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260443, "uuid": "0183df6d-7229-4375-ab34-192727b43573", "value": "T15CB4F1017693C872F5B682318D61C6FA563AB9D2F52D4587F7DB3F2E3E202808B25355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260443, "uuid": "0ff94a8f-b7a0-4eef-846e-fa54cd5f11e3", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260443, "uuid": "d21650c2-834a-4c96-bafd-5f00b902c3a8", "value": "6144:9W3yXLGbduSb+9SLRCefyUklRSClf8NvRtU4ZLUxJRB6VHR2689ynVP:IlbduSUSLRC6rOSClkNjU4ZIAH89S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260443, "uuid": "b7da0ad3-d79b-4e26-94d7-d6eaa29de7a9", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260443, "uuid": "554ea0b9-ea51-495f-ad7c-c77213630525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260443, "uuid": "ad4b9344-996d-41c4-a02b-168e26ad585e", "value": "de144902cfb8d1862aa25550a75a41bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd7c29e-362d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635232980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232980, "uuid": "409f6c8c-f76d-4051-abc7-aeae78d864f6", "comment": "Malware payload (RedLineStealer)", "value": "1e711688ec1c8d281ed6055bec888e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232980, "uuid": "62c3e718-52ff-49bf-be13-b0721b0f1f74", "comment": "Malware payload (RedLineStealer)", "value": "1bf71e6b6357654b5c48fc36edfe96ea9439f5101fb5038a6c3dd1fd4bea38b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232980, "uuid": "5fee463e-eb6a-4de8-b6aa-4fb3603a5ea2", "comment": "Malware payload (RedLineStealer)", "value": "3fb6edd21a1489535c7c9ab56311a435fc6216f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232980, "uuid": "80275841-3256-4465-9337-a1bbc135a724", "comment": "Malware payload (RedLineStealer)", "value": "914b0f1810dca8256733cba65e7cc51f2a92dc817c5122f4a0ac457f9b9b32494a87828915dc1be1753248a950d7a408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232980, "uuid": "36c6e56e-a96f-4c3d-835d-e42717732c02", "value": "T19826222323B24157E0E18D358937FEF531BA1B277B42A8BF5ADD5DC61A311E0E222953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232980, "uuid": "53861e1d-7481-40ae-b25f-d66f7f49894e", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232980, "uuid": "cedd884e-8092-49d1-bf0f-fb435c42c3eb", "value": "98304:/LfxSIwA7ST/AAvUBEpxalYePNkQI1RzgM88lbYH1fC/in:TLmT/AArHalzPNK1GM885Yg/in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232980, "uuid": "a14e539f-7aa9-4fd4-8686-af63e7671d81", "value": 4481024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232980, "uuid": "aa5bbae2-e618-4f42-bac9-48fe9269792c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232980, "uuid": "18bec766-9007-4564-8a82-f50ef9ed142a", "value": "Fortnite Hack Mod v1.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de251df7-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635263181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263181, "uuid": "8781f685-2546-483d-8963-f0e5491aae7f", "comment": "Malware payload (Vjw0rm)", "value": "983be3951a672b11ebdfd6d7d1233299", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263181, "uuid": "344d0412-0ab9-4838-bd89-cf4634d8bd10", "comment": "Malware payload (Vjw0rm)", "value": "1d31f4d9800687307188f1527d2c512249b972426e8ed4be143467ff2d9183f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263181, "uuid": "7bbbf716-ecc2-462f-a5cb-86f2356b3f8e", "comment": "Malware payload (Vjw0rm)", "value": "bb0e6da5abae02fcbefa6f1a619c6f3b1a3bf5a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263181, "uuid": "233d9869-2b07-4c9b-a5a0-10818a580e0b", "comment": "Malware payload (Vjw0rm)", "value": "7eb6b800c6b351ecd2adf5c59c77ce7f8c0ac55d3a065a552bf71e6899ffb655ebd55e593a1fe0469c7cdc136db9c943", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263181, "uuid": "689b90a3-63ec-41df-83b7-fa1219ba67b8", "value": "T147838F12BE501C56B5B4CA9210580424DE17A2F4CFFAA45AD44D09CC0FEA27F6B9FEED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263181, "uuid": "0b4a828a-dca6-4c82-9d4c-8ed287b69895", "value": "384:gvnvI1AYT7hA55m/TAOrabX/g/W/W/w//a/N3p/wSqmaw0AP:vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263181, "uuid": "cb59f1a5-94f5-4e31-b2eb-0c1003487d58", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263181, "uuid": "462dc90f-2a28-48d7-a3e0-5bb71fc5aba9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263181, "uuid": "6d5a9247-2803-4084-ad5e-7af806a60dfd", "value": "b2m1_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce02ff3-366b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635259689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259689, "uuid": "52d8d34e-41b4-4c5f-9d91-bc029925323c", "comment": "Malware payload (ArkeiStealer)", "value": "89bee605f4b726bb0fccb378c22d02cd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259689, "uuid": "5752dc1c-c9d2-4721-8d38-b94a590ddaa8", "comment": "Malware payload (ArkeiStealer)", "value": "1d4ecd52ab85b7f5229f00ee10d438286e361d4c304000abca8b3dcbe1d7c720", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259689, "uuid": "55528bec-ff72-4679-b9f2-fd80fe27f9af", "comment": "Malware payload (ArkeiStealer)", "value": "de676173aa2a7b9de8a4631f70b4ded25f2b41ae", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259689, "uuid": "6d73aa60-08b4-423d-9dc1-e4bfac3ff66f", "comment": "Malware payload (ArkeiStealer)", "value": "1ad2629f0a13798a3210bef3bbe13770f9c5b0d20398a30ab8ef0bfc062788e49e0a539cd3760a94377a965de1b6024c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259689, "uuid": "f54fe308-84a5-4a1a-8d4e-58656c4ea4b2", "value": "T161448D00A7A0C435F0B617FC99BA936CF92E7EA16B2490CF53D51AE99674AD1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259689, "uuid": "d1b6e950-639b-4115-a683-335960317690", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259689, "uuid": "3167b663-8bea-4b9a-a988-10a1e4fcd350", "value": "6144:uTcT0asMxs6M0LU97WssYkHkX5WfCjncknJmOi:OiTxs6MLxLsYkHkX59jn7J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259689, "uuid": "c15f7fe7-96bb-496d-8757-c38c69a82801", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259689, "uuid": "6721ee6b-4212-4f1c-8c21-f41a4f7f8d03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259689, "uuid": "705394a5-a91d-4d2e-9a29-fcd5b0e509d1", "value": "89bee605f4b726bb0fccb378c22d02cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244c9364-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635250844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250844, "uuid": "83f15b43-f2d9-4d99-b907-28b5fee70c66", "comment": "Malware payload (RedLineStealer)", "value": "2f550b5949e072cfdebb0ec52f745570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250844, "uuid": "a346b49c-4ef6-44d7-8582-8dd33feb8419", "comment": "Malware payload (RedLineStealer)", "value": "1db83d40d6e592912d7a1e2aeb822f636e5c1403b3dadbc15c814d5a3ae0ba1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250844, "uuid": "13b4d788-2239-44b5-83d5-1a2c4c7753f6", "comment": "Malware payload (RedLineStealer)", "value": "f375dd384aa601521e811369e361d970da4f5d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250844, "uuid": "a9e14bc1-2d5f-447d-948f-fddfb7a91705", "comment": "Malware payload (RedLineStealer)", "value": "96f4a26c2022e904166e6f865cfaca86e63937f40b1611b6b45534399453fc8f546c71164bdb2a33bd9ad82164847298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250844, "uuid": "6646a0bc-482c-4835-ad53-4e5108d6775f", "value": "T11954BF10B7A0C034F4B763F84A7593B8B93EB9A26B3494CB52D616E957746E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250844, "uuid": "2fb41948-2ab2-42f6-93c3-6a382c06eb30", "value": "b4ee3ea4b41d42005fc87ce221afb6b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250844, "uuid": "77bae815-51dd-4d44-a1bf-64c8738286fc", "value": "6144:DGL+xUXLCuKpRNHLs2dTV2mqWpWlRvWwAwehkKC3jhb7aqLrm9YExxFU:yLPLCFPpbMmqWWrvNAwehkLdbbLr4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250844, "uuid": "3897bff9-2326-4ebf-a8f3-0a038bfb509f", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250844, "uuid": "1d33b2ff-601f-44e5-ae0a-0024b7b5a2b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250844, "uuid": "2fc8c270-c77f-4509-b0ae-0c3e292ed1b1", "value": "2f550b5949e072cfdebb0ec52f745570.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a478e624-363f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635240751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240751, "uuid": "427e3718-c331-48bb-b8fb-153b29d0f507", "comment": "Malware payload", "value": "5f33b0b0b180c86492a2178099419de0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240751, "uuid": "5d150ce2-2f5c-4e1c-8af6-f6b539c067b8", "comment": "Malware payload", "value": "1f9ceb3ecfbf7b4bc5ed82661c04d7e9248c467c7c351965c12e4ccd44f53579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240751, "uuid": "ce9eab91-4951-452c-a100-c66173ca9d18", "comment": "Malware payload", "value": "ff7eb538b9426ba37798533874799c40d2eefa8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240751, "uuid": "c3e92182-e6fe-428b-a893-7356b5938504", "comment": "Malware payload", "value": "9e3a3579af1b27e650c6c4e953eb8d14e471db183b74f4aec7324949e216aab67adc9c0628373c23ab57b69188f0ed21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240751, "uuid": "2dbf7d80-b9be-4898-b457-4dae2875b4d2", "value": "T1B37413BF1BFF5E5FC4842EF8A883005491F8D0AA6896F3664D61BCA1466F3E45501EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240751, "uuid": "45d385a1-035f-4c17-a61d-47d5f1f85d27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240751, "uuid": "6c481f74-a535-4401-bb90-b2e34c7e9964", "value": "6144:+sLUazr6r1lV/LEsb2hY4GjiGMtqlWTUZ6HplVV2yfHpw:RUirMLEsb2hb5q4pR/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635240751, "uuid": "b531b8a1-f9bd-48b9-82a8-cf6cea7b4222", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635240751, "uuid": "0b8c736e-282b-47f8-b422-942ae65f68ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240751, "uuid": "8be8f363-ef89-4826-b179-b561015b168c", "value": "Inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a03778-366a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635259186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259186, "uuid": "f65af72b-2a24-4ac9-bb01-da1657eae0e0", "comment": "Malware payload (Formbook)", "value": "7e6941867ebd9aeb6ca816a7fd3fc190", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259186, "uuid": "c1046fcd-624c-4ab1-8ab6-314d8165d7dc", "comment": "Malware payload (Formbook)", "value": "21aa20c4adfe3bea202c5e1d3915072546ee0b927060e02e8c57ffc54caef90a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259186, "uuid": "c6015932-385e-4c10-8b0e-7f9941cf2b3f", "comment": "Malware payload (Formbook)", "value": "d800272e4e9dd8eb2545378c375bf7b287c61675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259186, "uuid": "9f769cae-4da0-42f7-9a59-daa3ea144e6a", "comment": "Malware payload (Formbook)", "value": "934ec2b5ef95bfadc69d3cf811341a3220debae5db9d42a2693cfb66a969b403fbff392ff3f3360a2dcc98f091c3debb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259186, "uuid": "7d8c9883-08be-4a0f-8bfe-d4b08760891c", "value": "T1AB74224846DDF339CEBA0BFA2061821457B460543E27D72F2F4475F55E7BF096A20A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259186, "uuid": "f913f4d9-9cc8-4f89-ab61-0a52884733ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259186, "uuid": "5fd9c373-8b5e-42cc-b66a-76eab37973a7", "value": "6144:FDWM7pZGKLCdzvHzcxLWyEwNyfDV7EWc101lMH9E13yA7TWLz+o9WZg9uqL:VlCxCLWNnD+51Uls9E1yAzoMG5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259186, "uuid": "c444f1fe-d59c-455e-87e4-4e912c0ad8c7", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259186, "uuid": "55d001e4-03eb-4fee-89ac-ca3872dbbc80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259186, "uuid": "79f7c6b1-4d4e-4f00-98d2-4b591afc7c14", "value": "7e6941867ebd9aeb6ca816a7fd3fc190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40800f4e-365d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635253468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253468, "uuid": "ac162d7e-3ff9-4a32-830b-6f44a26f11df", "comment": "Malware payload", "value": "2ceb032d598fcdbeebc48de8fb1c21cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253468, "uuid": "99fcbe8f-80f5-4a52-9660-8a129db2396b", "comment": "Malware payload", "value": "22ccc8cbedb5b7f7b548575b96a70cbfa8841c03f3240e67670280a03a1097d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253468, "uuid": "270fef14-1bd2-454e-bd20-78982a3ab9e8", "comment": "Malware payload", "value": "1583af1d5c881a26b5d752a91494a6d5db954219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253468, "uuid": "5723478d-273d-4aec-93ff-bb323e7d90fe", "comment": "Malware payload", "value": "f764ef32c56e1e4967d3ced2a154d35d07836768592f1d6d10cbcb1c725cafac53365d512f0d8862d5a583d0c6398ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253468, "uuid": "671ee935-64f1-4b6e-b82e-c1fa8021b2d9", "value": "T1DE54F12932E0CA35D679013BDCDE815003BDFAA275A2DF3EBA4E725885533D10909ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253468, "uuid": "dd74328b-de28-4615-bf7d-e2d3c699427a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253468, "uuid": "1e7426c4-c7b1-4b6a-ae86-e91595701680", "value": "6144:+otWmqdMwTlTQclN6xgc5AXov9NDvLFgdZzQSQ:+o7qqwTlkxgOAXYPFgdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253468, "uuid": "83334858-7b0d-4ec5-96f3-3f269f16bc6e", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253468, "uuid": "a3fd7912-ce4c-4fd9-9eb7-317e3389640a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253468, "uuid": "3186d48f-897a-4758-8c73-e090ca21fe67", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23049326-361b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635225072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225072, "uuid": "a5b45190-9c58-4203-947b-e3e863f9d4c2", "comment": "Malware payload (ArkeiStealer)", "value": "41ed34b70460e1eb3b561fbc89b65052", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225072, "uuid": "12db1edb-2749-4a0b-9a6e-30082d319a73", "comment": "Malware payload (ArkeiStealer)", "value": "22d5d59d54369797b47fb086e329d72d65f98bd679977370ddb24118815f311b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225072, "uuid": "6d86dd5e-3b66-4378-8475-ddd80e4f6cb1", "comment": "Malware payload (ArkeiStealer)", "value": "a5def1d5bf16265f8a828dd4b1e9c2deede4e3c1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225072, "uuid": "a3f524e9-2e60-4913-b3c6-93a4cb954b64", "comment": "Malware payload (ArkeiStealer)", "value": "066c6e8cd4ee9d63e66a30860aee3786d75058869641d9d1be3ff12b26efac624db52fb903152e65e425a0164932dc0e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225072, "uuid": "40897386-63dd-4772-bc8f-c97a0bcae262", "value": "T18BC42323C58CD251C2A446FDB2EC75AD4AE55791ABB19ECB2D9CC893468AB5303073CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225072, "uuid": "82fcc73f-3df1-41f5-ac20-b96d1ae23129", "value": "12288:2gKu9ispye/dTsVTelgzZS3npuSJ7SC9McXFL90PwJ:2V2Y1eKksK7Ac1LGPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635225072, "uuid": "0681aaf6-4531-4d20-9034-446403494a43", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635225072, "uuid": "319ace80-b9ca-489b-87f7-bc333b614ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225072, "uuid": "685aa885-6d55-4b4b-8e14-c2755beb49d0", "value": "41ed34b70460e1eb3b561fbc89b65052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a9c86e-366d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635260424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260424, "uuid": "8ea540a1-334b-43f0-84ad-10d0b5370c4e", "comment": "Malware payload", "value": "d6b3278ea67cd6b78735d244d1ff2c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260424, "uuid": "1fafec53-6bd2-4b77-96a3-b73321568ba7", "comment": "Malware payload", "value": "24e82dbb33057c2b62ea809e5cd162c6440071da8c498feba79b7db0e3bf0d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260424, "uuid": "08620c6e-5bd9-4a44-ab86-e40312448547", "comment": "Malware payload", "value": "0628f84a9ff1b70d0ee93693e509da3cf7cd92f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260424, "uuid": "adfcea7d-ecc7-4f23-9878-c5f6ca131da8", "comment": "Malware payload", "value": "cdd04e2639eef59e83f56fc400cea45b3dae64a2b3172821d64aad0862d92295b793a5c2f05c86457094256785838806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260424, "uuid": "94993a6e-25a2-439a-a207-869e38e9e535", "value": "T1D4249D1172C0D871D6BE45308864C6E6567AFCE3DD2E898B37FF3B2E6E712805A22355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260424, "uuid": "5856d7ba-65f7-476f-8409-b7f12e2a06a2", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260424, "uuid": "af71f7d3-421f-423f-b87f-d43a70200798", "value": "3072:L4hDm6a/6BO0fFRFvZPDhMJT7cDgmsCJVYYuVMO6P2+BwvHJ3/RA:+Ds/6BOSFR7PWJIgmBV9ynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260424, "uuid": "05cd1136-a9f8-4cac-9879-31891307d313", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260424, "uuid": "032ce677-f1fb-4738-a783-a23c43c169e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260424, "uuid": "3771b69e-5b28-490c-b270-dc6825cc7a60", "value": "d6b3278ea67cd6b78735d244d1ff2c96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8486bbee-3625-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635229530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229530, "uuid": "d147d787-3013-43a2-8300-cc6711de78ad", "comment": "Malware payload (AgentTesla)", "value": "5f7a67046a405aabbbc254aaf318ce2d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229530, "uuid": "c7cfcf77-a442-4781-9a1c-f220aa8cf107", "comment": "Malware payload (AgentTesla)", "value": "2565bed371d87f2d364e0888b32bb78ff2adcff374354c0984f5ad03e909af30", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229530, "uuid": "383d103b-cb77-4891-8fad-91ae9cd15e57", "comment": "Malware payload (AgentTesla)", "value": "589576b1e587d3b179ef7803f17a71aede36c0cc", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229530, "uuid": "6193288c-12fb-4602-b583-0e09650164ed", "comment": "Malware payload (AgentTesla)", "value": "bb9ebca6c0244b01c09e745ee25eb5d4b669b8afcc028bd01c21af55468d71989b1132203c3c5cf65f2ed06378cbd86f", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229530, "uuid": "a81bbe84-6933-4832-83d2-f566bee68d71", "value": "T1397423327316171C16E1E4D3C2D20DA0808B9EE1CC7F93532D4906BD4A5BE9D7DEB696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229530, "uuid": "2be9f7cf-2ca0-43c4-9323-c1c4e92ca9fd", "value": "6144:DhbHpq8BrXBlCSUFBdwxW0TZuo3keYxkO2gbZirfJpUzg2yBzF1Sc+PQ4oTCv7x4:DhbZBrXBlCj4WiZFkBqWZirfCgdxF1Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229530, "uuid": "5749d8e6-b70e-456b-b0ee-ba1377bffa33", "value": 365511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229530, "uuid": "2b665fd0-9135-4434-94ac-0d0e75f79640", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229530, "uuid": "49039546-169e-42d3-8037-a483a863b358", "value": "DHL Receipt#AWB811470484778.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba9353f-3693-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276626, "uuid": "b0d2f202-9015-4af4-8079-1c80d7aa3232", "comment": "Malware payload", "value": "03137e005bdf813088f651d5b2b53e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276626, "uuid": "0f47ebf8-8dba-41e6-84bd-15496d9d3da7", "comment": "Malware payload", "value": "258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276626, "uuid": "22c1b3fe-e75d-48b8-b0f2-f905c3837169", "comment": "Malware payload", "value": "0aa1fb7e5fc80bed261c805e15ee4e3709564258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276626, "uuid": "3918dd07-7433-4e4d-8dc6-2fd52100e547", "comment": "Malware payload", "value": "fac1b940cc1dd33655f6b71c8b6cf685c14a731ff058dfd3325210bbf159d93c894eb19bb307b61cfe4b002673539729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276626, "uuid": "1d636f99-950a-4ec2-8c0e-56154ab28318", "value": "T164936B10B5E1C471E57319356835DAE19A2EF9204F299EEB3398136E0F341D0AA35EFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276626, "uuid": "cb7c5a31-fdf0-4fc0-ae6e-597607dd11e7", "value": "81d7345751d04409b2dd22cc99377edb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276626, "uuid": "96c03343-c768-4cc8-b83d-ed4597374fd9", "value": "1536:4ZxrW2eq7mQeNzn26jO0+7I+LeScuT1Gd5anG7IW1V7hYxamr+s8jcdMTWsM/D:4bEZQC26S0+7NeSrTcTanGEWLh477MTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276626, "uuid": "782a1995-9d5b-4095-b543-2dc991e81ec9", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276626, "uuid": "fd352224-2c56-4848-acb1-f1e5ce8a85e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276626, "uuid": "223491d3-f420-47ab-9065-5c0b9efd18d8", "value": "agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d9a4fc-3627-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635230390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230390, "uuid": "46da1a63-44a0-4b83-88ec-791caaeb6409", "comment": "Malware payload (NanoCore)", "value": "69d14fb14deeb4bc08a3c47840d1f6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230390, "uuid": "b4585fd7-0dab-4e28-a204-a001c3fda4e8", "comment": "Malware payload (NanoCore)", "value": "2719fac0d4d5ff10221753f561d70346516d6226a3868c40a9d4c9282f370aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230390, "uuid": "32351a11-80de-435a-91bc-b9885160cdad", "comment": "Malware payload (NanoCore)", "value": "2830362d97678edaa8dc6f28a8c555f690101bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230390, "uuid": "dbdc0fe1-e033-41c6-90e9-d532bfcbfb8e", "comment": "Malware payload (NanoCore)", "value": "d422ae6f9bd5ee5b0129107a5481b9da2ea40945f5446f2325c498460e71fa84ae22e45cd46557e93e434508d96ff179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230390, "uuid": "31692d7b-cb73-44e5-b110-2d13c84c9a5d", "value": "T161F5232563996B08E17E5BB5D034444867F9BD46A733D72DBEE001FD1D23A82CA2BB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230390, "uuid": "11351724-5edd-4f08-b4aa-09c6e1d1b85a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230390, "uuid": "cd697a4f-a110-4c98-a1d5-1d957a2b344e", "value": "49152:ZpnkYqNy6CVbAEVaLTS0BPMm5UYQQngkM/yA3flKxrdaAkjuQ9BYbDBTTMCbM:Zpnhq86CpApEmmGgtn9KxhIwbhMCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230390, "uuid": "0c9366d6-9852-4d77-854f-4e9b16fa3a48", "value": 3559936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230390, "uuid": "4c4798b5-3400-4def-b227-7da3fb1ca7b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230390, "uuid": "665ff238-db12-439a-b9bb-7fd1f89905a5", "value": "credit notification pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334ffa4a-362a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635231541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231541, "uuid": "896133e8-b900-44cc-9e51-8c1c001398a8", "comment": "Malware payload", "value": "31137492984d8a333b4e352cf7341f72", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231541, "uuid": "343842a3-62d7-4920-8fb1-ecb5fedade15", "comment": "Malware payload", "value": "27cd79c2714c5db3d8b7c9ff6761c63f1a4c5a7d84f04aebe1cf5b830384efe7", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231541, "uuid": "33017a82-5819-47aa-92ad-1b80b2a2db3e", "comment": "Malware payload", "value": "79c4e01425461d6f2e50e2c3a1333b28ad58ab0f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231541, "uuid": "b1b32ffe-b15e-4f9c-896d-c0a337282eba", "comment": "Malware payload", "value": "39a31f5798303e00b9f4aeb4e3d03f4f1c747cbf4eed8f3538eb1bfce39cd571f5d95de6303faf6fb773bfef22722a0d", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231541, "uuid": "973fbe46-4dd0-4b90-894d-24c686e9a344", "value": "T18F451226369DD931C13A123A8C8E022103FDFB567692DB7F3DAD222997533E649191CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231541, "uuid": "923e3918-d18b-4974-8626-d3ce008b5068", "value": "6144:wpyQ4rXWsEbAq2OluO93wfQkqO20xzpgjCbEeF9naRqDloCWlbTPPDF4k:woQYWskAHO4OZwYkzpCeDnaRqeCoXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635231541, "uuid": "40ac3056-416e-497e-b811-c2fb0935af2a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635231541, "uuid": "e637a2db-0a0c-4f21-b594-eef98e783635", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231541, "uuid": "4f9184a9-5308-44e9-8df9-aa2dadb160c6", "value": "P0 11234532.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc53ba7a-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635253783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253783, "uuid": "cc2fef09-4a17-4265-8bdb-9d0372cd5d4d", "comment": "Malware payload (Formbook)", "value": "5cde7ccc7c5ba480965e4c4e62b2dd03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253783, "uuid": "5de43c18-fbc1-4293-bd23-d530d8a40e46", "comment": "Malware payload (Formbook)", "value": "281631390e6c35c336bb442e93398d1ceb07a6fd4c2a9075b802355126412ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253783, "uuid": "179a5699-3a4c-4783-bc2a-c6b71a343935", "comment": "Malware payload (Formbook)", "value": "a4cdacaea4454a79810b24dc97dcbd8ad6c5d0b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253783, "uuid": "f7ec27c5-5d3d-44e3-9bde-4bd6d9625b1c", "comment": "Malware payload (Formbook)", "value": "d6c267e0b3e07dbc08fb6c2d20d1db80a8d4becc85510a3b707b7dd8184b0adf9bd0e2e34deaacd4693f7f414336e05e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253783, "uuid": "c48a81a0-ffec-4527-bff2-266216873049", "value": "T14884DF8C3650B1DFC857CE7ACA942C64EA60B8B7530BE307744352AD9A4EA97CF055F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253783, "uuid": "ad811f48-cab3-4621-a2cf-e37c47a8f3e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253783, "uuid": "1c1c54b7-b4e8-49f7-b568-36349129ee52", "value": "12288:MX7q3+Af/6y7s5Nv7CCbnla4SzZulgBra:Wq+Af/6qorl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253783, "uuid": "3ff2de2e-aac6-489b-b04b-e389be83cfe2", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253783, "uuid": "192e258f-e0ea-442f-a07f-3810e41582e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253783, "uuid": "4b89e901-df20-43d8-8778-0efa8590a1df", "value": "MT103 Ref Swift_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f4de81-3697-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635278332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635278332, "uuid": "9c3b429a-e8ba-4d48-96c4-d0f24afe8181", "comment": "Malware payload", "value": "9e37ecd7b3a3cc19e3fb569a8f79f2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635278332, "uuid": "5b16e888-4f13-4812-a238-d77b735e937a", "comment": "Malware payload", "value": "290cb899ef25b56068497a4af04f625cc1e38f5a3b53ba335af3670f6bcad377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635278332, "uuid": "a2d7f275-cec3-41e9-9b3d-f49bf3b4b771", "comment": "Malware payload", "value": "44f6277cd30051e80d5aa4ecc5f73387bbdf5fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635278332, "uuid": "82f7a843-3dfe-4c30-ba59-4eed58f0d71e", "comment": "Malware payload", "value": "0f2b30b04d538870f80eaf54807f7e2765505c334c7b51f30294b2184c9b6e6efaefdaa690c194d16ae1ead90a010832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635278332, "uuid": "ae69db82-8108-4e45-a085-2a0bdf71ba1a", "value": "T176A40201B2A3C175C6BA55308C21DB91463ABDD3D97F954B3B9B3A2F2E712C0CE26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635278332, "uuid": "70f33251-520c-4446-b959-97d11323fb7e", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635278332, "uuid": "03f8a0eb-3a07-4c60-abe5-526844831e05", "value": "6144:fTWvGdEw/Jj9ZSBdhIxDMFmSRlBHrTvDU6Wdmv5ZfPb8HP8dOtHAaJ9OE5ynVP:uUEQ5OKxQFmSZLiwv5ZfPykAxh9R5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635278332, "uuid": "1afda23c-77e6-4e0f-990f-24773c30b07f", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635278332, "uuid": "6ba04ab0-2d31-4515-933b-e3e663ae3c8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635278332, "uuid": "1ed3872a-6821-4ec4-a081-81559e36f6dd", "value": "http___backupsoldyn.duckdns.org_11d_solex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6dcad6-3639-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635238325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238325, "uuid": "3474caa6-43b5-475b-97c8-4690191ead9f", "comment": "Malware payload (AgentTesla)", "value": "5987cafa67769b2a0b701b4d180210a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238325, "uuid": "79af1714-c8fa-4f3a-8104-7c558763bdb5", "comment": "Malware payload (AgentTesla)", "value": "29a0bd2dc254d43be7423cc9f3e080f073a828b406df9345b2878f9ed3408b97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238325, "uuid": "2ca9b405-869c-4c2e-8847-f570da907531", "comment": "Malware payload (AgentTesla)", "value": "a9cde3b200caa0f04669009e6fc8cc2378fbfa2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238325, "uuid": "37e60ecc-8f20-4fd2-8eb2-adacd1364308", "comment": "Malware payload (AgentTesla)", "value": "a02c3e700245782ef0d90c1029b33c95cd93460019f60aaaf70267d5fba0a5fa4a6fbaa2dd901fdce660b4d2e1f36788", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238325, "uuid": "d4fd56b8-a027-4db4-9c6b-a3226e3472ed", "value": "T12054124D1AB8C335FC7D5FB888914809537898553522FFFE5F41A0E92F2BB13C6826A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238325, "uuid": "4c8cb657-bf29-4695-8878-098312497b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238325, "uuid": "0838f540-d8d4-430c-84af-37a79a2fe260", "value": "6144:VOoYsG+uBKziLEyDq7QqpOcDaKcdQEWavQ7gEAr:ysaKzZ0Q/cdHWavQkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238325, "uuid": "b771fa6b-8649-4636-bcef-66924213e860", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238325, "uuid": "360a6d71-3f84-4dde-97cb-fa548fdee75a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238325, "uuid": "c06819c2-d48e-4970-91ec-19d726f7a497", "value": "02-VOLUME 2 (PROJECT SPECIFICATIONS) & BOQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6009f590-364c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635246219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246219, "uuid": "29052061-4d6a-4621-9739-ffc95ccd444b", "comment": "Malware payload (AgentTesla)", "value": "c8e1f5d76a8f5131e5347c76e9ec2bdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246219, "uuid": "8cccfed2-7c2a-4a2c-91b3-c750512c27e9", "comment": "Malware payload (AgentTesla)", "value": "29b1033a886b90d092ec14041729bca1d00a4da73457ad62bebd03251343fefb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246219, "uuid": "e962ba74-50b7-4473-bab9-7a0de47190eb", "comment": "Malware payload (AgentTesla)", "value": "fcd565e0c15debaba5186e2832beff76b83b6301", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246219, "uuid": "69312873-8884-4c93-aad5-89cee57aca9d", "comment": "Malware payload (AgentTesla)", "value": "ade132587a8970a1e4d63c6724f9266f611160c774118e82dc501e82622aa1ea9c8430df77645c17e0fbcf17cf308717", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246219, "uuid": "d9c36527-c413-4138-a2b7-7603470f31c1", "value": "T1D1A4014272C0D27BD7926C729C97D5DCC2F2BD20EF056A1B76D0BF2F46365E256A0288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246219, "uuid": "9d165906-e3a6-44da-a6c0-1ea6867e542e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246219, "uuid": "f2ce4988-7d91-4d89-9b18-2b7e7587e3d9", "value": "6144:JBlL/f4GY+TVFbPIFEP5zF+bKkCRXmIzJvmODaoaOQ45AzoC7L/Y0:v8+BFrIUFkCcIN+ODaoaOQ4YTk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635246219, "uuid": "ac0f48c5-ef37-43e1-b7a5-b4e4384af6b9", "value": 472972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635246219, "uuid": "c80bb12a-32dc-41c2-ae2f-a658fdf86558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246219, "uuid": "de519b40-dbe2-42f8-be91-88418b26d0d1", "value": "Ref. # IRQ-21-007783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510c5216-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635258650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258650, "uuid": "7b8559e3-7824-4b67-8fc6-b0f1086082f6", "comment": "Malware payload (Smoke Loader)", "value": "e08efe5c2ab13b61afeb5b6a31d59ea9", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258650, "uuid": "3cd8c833-6f4d-4bc0-8167-f7f3d30d0e61", "comment": "Malware payload (Smoke Loader)", "value": "29cc5c140effd19120124fa46d42b27c474af45b8e31ee2de85ca9d18eed097a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258650, "uuid": "619a20c9-95af-48f5-8ff9-0eeacdb69d27", "comment": "Malware payload (Smoke Loader)", "value": "6d0a32c4a07d843cbece3a0ea1632ae586476be7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258650, "uuid": "51c8deb0-a46a-49f0-afae-71338eeaa571", "comment": "Malware payload (Smoke Loader)", "value": "917d9427249f10690214b95d050d545ecdd84283e7ed79bc6cd827196535e5ed98568bc8d84285d602a8c0a94aab00e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258650, "uuid": "f57c8492-f09e-4cd5-8021-b7368272faa0", "value": "T1BF049E10F2D0C47DD67649314866CBF156AAFCF3DE3D894B278B366E1EB12809A23356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258650, "uuid": "a544c1fd-ab6c-4340-a05f-0bf4b66bb8a6", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258650, "uuid": "932d5922-3b6f-4cb0-811e-4259920b3eca", "value": "3072:MXvIIY+VmuIikA+F1pJ7OaGGY50fj2aPXuVMO6P2+BwvHJ3/R9:MvIUVmuTkBJPqa/ynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258650, "uuid": "e585a2da-8a89-4781-933e-46e9b2cd3b38", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258650, "uuid": "5b6e3ac8-9b97-4970-904a-a626fa93c840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258650, "uuid": "d95ec18e-de26-48eb-b78c-e41fcb7aa858", "value": "e08efe5c2ab13b61afeb5b6a31d59ea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4132903-363d-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635239918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239918, "uuid": "8352712f-d93a-485c-9148-9fd2619c79a1", "comment": "Malware payload (Quakbot)", "value": "cfb3ffc1eb6eda1b3ea27e52daaeb8b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239918, "uuid": "044f59b0-8e79-43a6-86fa-3562dc3c26bd", "comment": "Malware payload (Quakbot)", "value": "29ee4b979a09ad89da43a027d894a6d5a59924700a176c15f963535697d68d47", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239918, "uuid": "552be291-5323-4c41-b45a-0365896e663e", "comment": "Malware payload (Quakbot)", "value": "60bdd3fb1d317e2f8bc372abe260fd7d5dbce9d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239918, "uuid": "f7e5757f-184f-4531-84a1-854d36916cda", "comment": "Malware payload (Quakbot)", "value": "85cb873a321218fa75568e85d8d46de8081cc09beb95c926b4d2aed858db5fe795cf7863a62da3f5b101de08fd087252", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239918, "uuid": "c26ed1f2-df96-48d9-95fb-3cb25498c7d8", "value": "T1B9D4015672D8CBABE58617349DD5CACA7722FC209F6B8603304A731E5D3ABA09D03716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239918, "uuid": "e55fd0a0-c4d8-4f42-ba29-53ba00fc85bc", "value": "12288:x6JnQ8i0b3LonM0RrKo8EmXp1bVAMbOxKlZwQiFxSxoUhJFw:MJgwbMKEmTbfbOyJiFxNUhJFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635239918, "uuid": "000ed677-2b7d-4f35-b6df-c7eb993598ec", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635239918, "uuid": "8ea73ca3-0e63-4dbb-8ebf-5d9ff46964d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239918, "uuid": "2568a0bd-fabe-4ab6-9158-547d9a93ef44", "value": "REF-9601675-Oct-25.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d558e24-366b-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635259449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259449, "uuid": "61c2e551-f1c1-4cbc-a4c5-e4aedffd1805", "comment": "Malware payload (AveMariaRAT)", "value": "ec9fb1c161dfcfd1aaec47260aa825ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259449, "uuid": "828f11cc-dabe-4d73-8dac-8eb1ea1b5e75", "comment": "Malware payload (AveMariaRAT)", "value": "2adae2e808882ccca7219d2230f756dad064a7f6fa139395a0166f0232e2578d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259449, "uuid": "97ca4470-a329-465a-91dd-ad37063446a4", "comment": "Malware payload (AveMariaRAT)", "value": "69aa21f9f9dd122b64518a37c6d49a8b9f8645d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259449, "uuid": "2236790e-2ad2-47f3-9d28-3ffccb5b403e", "comment": "Malware payload (AveMariaRAT)", "value": "560f8b6bc9a28063b2109798e2b381741f24521fd54cb6019c248b478e293ca21500c6515e8af128c2c0a7e6628c6476", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259449, "uuid": "21ade89b-3550-46db-a080-e14de70bd9d7", "value": "T153138C5033988632CAAF177EA0F18140537483D6A627EB1EDECD92ED58573434F277AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259449, "uuid": "1057a4cf-534b-4699-a75f-d0c3537d6684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259449, "uuid": "ef2f7f21-53aa-42df-86cd-83f5323fd30e", "value": "768:vUvQULR16i3rWFyXdo5Ms7NPtXWTF9KQ168Wv4eYJwE4nzev:MvQer6ibcMsBPITr1tWgfJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259449, "uuid": "13483bf8-59c2-4789-bbb0-ab871c12fd92", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259449, "uuid": "1f9259f6-c0e1-424f-97fd-a9ef96b2d3dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259449, "uuid": "1c6169a1-dd47-4855-85a6-07fcf5811b9b", "value": "ec9fb1c161dfcfd1aaec47260aa825ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c72353-365e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635253960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253960, "uuid": "596cc21e-8e81-4431-8bb2-c0b753e7d8d7", "comment": "Malware payload", "value": "9788886bbcfff1864a7e8b21c31eb533", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253960, "uuid": "d34dd006-9699-432d-ab53-f15c2b1eac62", "comment": "Malware payload", "value": "2b54106bd3d298e3400ae5da1e909902479ef07adb977d8d0244d44411834606", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253960, "uuid": "37dd47e0-a1a7-4c5c-956e-aa55e0b13ac3", "comment": "Malware payload", "value": "b5a9a1549ec9aa88ba8e6282867c9367505141e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253960, "uuid": "8de0b727-ffb6-40c2-b4fc-38b33dd1f375", "comment": "Malware payload", "value": "b961a1ab1a8ed5694141cd3c5bb9d1f58060b607bce5f7a8ba0de532327e5385a9cde1594d8a46da73f027711acae504", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253960, "uuid": "14b77ac7-8708-4c7f-a329-62046a95d0d9", "value": "T11BB25DCC6D24F98AD624B264A5BE6E885FB8620BD80053DD3D2D77408F74244D69EF2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253960, "uuid": "896fe154-9418-4f66-a90e-2185b707067f", "value": "384:tm3uw375WCw0XOS4I5KZ8x9mHWII0T1BqQ/D30iYpuH2tsUae6aVBAvADN37Esdt:olLwCw0+eEZgAJrpz0i7H2z3VYADN37Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253960, "uuid": "de2aab2a-2786-4cfe-b576-b7b56155578d", "value": 23932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253960, "uuid": "c5e323f2-27f9-40de-a299-114fc9a51b64", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253960, "uuid": "b9421127-3cd7-42c7-b746-c88ef5717310", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620263ff-3671-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635262114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262114, "uuid": "9edaf38d-f12c-4a48-9d60-4586ecbe5902", "comment": "Malware payload", "value": "d5c9505584cafafc8d7b4340ef2bcf6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262114, "uuid": "24a62388-d1fe-4895-ae40-71c78e629836", "comment": "Malware payload", "value": "2bcd72c508e3a9b3837a8268c045d89774d49729bc1218fb744100560b14755d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262114, "uuid": "3948266e-3454-4430-959a-78e681063646", "comment": "Malware payload", "value": "bd307d445ff1648cc6f9a8eb4a511e6dde457446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262114, "uuid": "5330edca-4845-443d-9260-e6b5e121d13d", "comment": "Malware payload", "value": "681991a97a03447efa296cae30b50b6cd7f12d819917fc01e4bac5c758099bd14ef4d2998a9f6958e885f6d379dd406c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262114, "uuid": "dce1ca68-c461-401f-b052-4ebf01145741", "value": "T16D81E12CB6ECDF21D13DCAB547D75C242777241BA281EA090C8B65E327363A547D1E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262114, "uuid": "e3404a07-7cb6-4dac-9b21-01e0f5d7cb31", "value": "96:AOlNx2z0ZlNx2z0U9Mr23EMxIOPVfsddQM1NOjeqtlRl92cvKPQu6EqV9Y:ASRUx/0jQH6qtlR5SPQGqVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262114, "uuid": "a3c9cdc3-0257-4d15-9b6c-f91c98a82f6f", "value": 4014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262114, "uuid": "eaa0ad68-4b5b-484c-a11d-3bc68e6cc120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262114, "uuid": "11fe0412-8c5a-4ff0-8f6c-d9a298ed50fb", "value": "d5c9505584cafafc8d7b4340ef2bcf6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4080fde-3640-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635241233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241233, "uuid": "99c5420c-24e1-41d4-88cd-2343b523eb71", "comment": "Malware payload (AveMariaRAT)", "value": "592cbf02a35ee0358194b33c483be874", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241233, "uuid": "66072336-d982-40de-8467-da5c31111fa8", "comment": "Malware payload (AveMariaRAT)", "value": "2c12f9be67bf31375db1b0578920fa37b415ec1a2df56cc1f3dacd9985f60100", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241233, "uuid": "cf91f08e-cb5d-40c0-86ec-76100c37a09f", "comment": "Malware payload (AveMariaRAT)", "value": "ae04e74a104cd6d2d00331111f0f2596c86eeb2e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241233, "uuid": "37dbd508-5b2d-4834-be35-1f86c7f91c72", "comment": "Malware payload (AveMariaRAT)", "value": "b4683c815f2369ed185afe4109ae5a1ad944eb3c78488a1a7c163b4f5a33a4549548f739d6594faeaac3d5eb09390f06", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241233, "uuid": "13a24d1e-8285-4d77-81aa-7595b6847ae6", "value": "T11574122277954BC9EED986316CD33EA00CF1B552A905E7BE23C06A5D0E73941E213F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241233, "uuid": "9a4ce0cb-17dc-45ce-ba3b-c368c0865578", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241233, "uuid": "1e52521a-a620-4a93-ad57-a718b68324a4", "value": "6144:BQIxNYrJYEfv9Ykr7DVLq1YV+8TzAB/KOnTSE0K8LvfDEQXWUtin2H+:yrZfeec1Yf/AwOn3094Kb3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635241233, "uuid": "83b65d6a-da9e-4db4-b6ca-a9d9ec5cec39", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635241233, "uuid": "7daa809f-5eea-448c-bb66-64a2f50a5941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241233, "uuid": "ce86a48a-6c87-4fb7-9183-d21eb887d62f", "value": "0d2805a84af62c765ac706960cd2a4a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bf4929-363a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635238632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238632, "uuid": "58fcf0b4-07bd-434a-935c-87eb8785044e", "comment": "Malware payload (Loki)", "value": "64d7fb3ae1043e7e3901c6deb6093a8c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238632, "uuid": "4e77ad8a-a6ca-473f-a026-f1a8cd0e713c", "comment": "Malware payload (Loki)", "value": "2cd684988c8f45511d2d84210c3d3607a8bc0685f686cfd7ae6fb6b9c1de1a59", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238632, "uuid": "66c5cf36-a075-4cc0-999b-ae1fb3fbf17a", "comment": "Malware payload (Loki)", "value": "8fac15d2ad2240e17d6bb775a7cfe84648c216be", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238632, "uuid": "9300c888-1751-4b01-8c91-8486a3889cf2", "comment": "Malware payload (Loki)", "value": "fc8cfa719e652cc2e50eea94ee5ac305a7f8c6415cac96bba9e59603d5086d95cb3cfff71e68cb7e760cda2aeb59b267", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238632, "uuid": "9a83c6c7-347d-4d90-bdcd-7928144686f8", "value": "T163A4D0506F4DE1CBD81A3A3CB60D374D94617C391A98674DBC73F53A39BC898E2AE160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238632, "uuid": "2bbab75b-398f-4727-a4ba-3556be45f235", "value": "12288:l7ZrN2BP9iKQKQv6TJmgSZiCcsIZjLCOGw+:nsQKQD6ANzcBZapw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238632, "uuid": "e384af67-10a3-4dc8-be42-2e07aed3bf62", "value": 461192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238632, "uuid": "ea47de0b-9b7c-48d8-b86f-971f26363175", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238632, "uuid": "d918d7cf-c539-4a30-bf2f-32746e92d7db", "value": "PO-2110009 SO-120063.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b1cb30-3666-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635257478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257478, "uuid": "d06d75ea-94c7-4633-b21a-ca074728ced2", "comment": "Malware payload (RaccoonStealer)", "value": "d3ce6a2e5bc3c50f1e43a337b75380c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257478, "uuid": "8d4ed24e-c3cb-4e09-ac41-aa8f8f6c7d9c", "comment": "Malware payload (RaccoonStealer)", "value": "2dbc67415f119b345460488b72fdbe1c7ec9811c45f4c0bcd4b58691255f6337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257478, "uuid": "753562c2-dd8c-476d-ac9a-700bcf0252f4", "comment": "Malware payload (RaccoonStealer)", "value": "a28aa5e798b63fe3ab37e125100e1ffc19151560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257478, "uuid": "6592d3e1-f62d-4c8b-8b14-ab1f9b67f9ba", "comment": "Malware payload (RaccoonStealer)", "value": "c0ea721cdfe0c7b9d82ceefff1722210bd9248276e6a7066832918c3ededadf1e4af111de4f181a3664dc991d17fa1a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257478, "uuid": "b1f1b36f-0630-4a8d-91d8-f6818e48b7fc", "value": "T10F04AD2032D3C471D0B6D6314865CAB1563ABCE3DA3C894B3797375E1E7128B9BA235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257478, "uuid": "48eeaea2-915f-4163-890d-1b6f8072dd02", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257478, "uuid": "733e5c95-e669-44bd-87f8-12aee249bf41", "value": "3072:tHvyIY+VmuI636z+i0VGMlS3U1tx0ffqHibqBuVMO6P2+BwvHJ3/R9:xvyUVmuD3cNlXqHwqBynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257478, "uuid": "030bbb26-70bb-48af-994d-bfbc7ee25854", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257478, "uuid": "954b2d03-4244-4ff3-866b-e0c7eb638c18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257478, "uuid": "c9bbc3b6-cf34-4a22-9cdb-aaa441a2950e", "value": "d3ce6a2e5bc3c50f1e43a337b75380c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115bef1a-3653-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635249094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635249094, "uuid": "eefd27f8-587c-4213-b9d6-58a8321a7a70", "comment": "Malware payload (SnakeKeylogger)", "value": "6318403488d61f1b6827886675f4180f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635249094, "uuid": "1a90f355-e2a5-4435-ab57-08f2a051f283", "comment": "Malware payload (SnakeKeylogger)", "value": "2df9afd127774f73f6163002fb778de08846983e3c2fb33d0edc900d290a1ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635249094, "uuid": "03235946-1b1e-4851-9cca-1593427bd180", "comment": "Malware payload (SnakeKeylogger)", "value": "8a94dc140346053904c7168e213931d57f4ecbb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635249094, "uuid": "52504b86-874c-4600-8713-fd14aaf1eca3", "comment": "Malware payload (SnakeKeylogger)", "value": "2601fa54ec4851a63d7630033106a3bbf07cc6a87d0ff18399f4149d9af619bc81f9cd84094532073e3293c66a282731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635249094, "uuid": "cdbd6c4d-cd52-4e94-bbb6-ca1fdc667ac8", "value": "T1C674F102E2678804CACCB9706F29F5322772EE446531CB6607D6AF9B3BDEA4325153F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635249094, "uuid": "ef7388f4-9231-42f0-a4c7-d76c10d96055", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635249094, "uuid": "1c7a8f8f-df48-4a10-9de6-34bd65ea82d4", "value": "6144:A5YRk/2Z07rfBj4z44/byDrDBGeZTe+FRcDDaxcaLPFKvYknix3il+d:vkE4rfBjw44TyDvdZTv79XLtKvYknvAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635249094, "uuid": "c5ba1481-5868-4c5e-87cb-a9b6f76f3b06", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635249094, "uuid": "566335fe-506e-494a-bb93-8a7049e77765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635249094, "uuid": "4a440db9-4e11-4b78-9383-aa025b3abdaf", "value": "A67gmDqdYqpHVq5d122pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2843d9ee-366a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635259011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259011, "uuid": "55c75c1a-acef-4d64-a877-9c65c7be86d0", "comment": "Malware payload", "value": "08f6da19b67e14e225421141cab0c5e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259011, "uuid": "47f109e3-1d46-4413-bea8-5f02425c98d0", "comment": "Malware payload", "value": "2eb68a6872268ddf621da62312adee7c9099abc6fdf96c1da39cc12454360d9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259011, "uuid": "51ff370f-dda6-4cec-ad10-72ea0355d3c1", "comment": "Malware payload", "value": "8c26a10a4e4d39cf02edbc50aeb581a304fa2e4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259011, "uuid": "fc71e530-6dcc-43e7-8adb-abed07108cf0", "comment": "Malware payload", "value": "c3d56c33811652b8a9fa2385f7a2c77a2c9f81de3cc2c1f74c2939bfce3347fb927697de156f1e0ed5bdad3b875cd2b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259011, "uuid": "57487872-f382-4b8a-948a-a5a0135e53f0", "value": "T113131804EA50D5BFEAD202FDD7B60A7C6DB88B10131A12C393F6B97BAF858C67531506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259011, "uuid": "022bc2c9-ea89-4422-9863-64fbf0be53fa", "value": "b48e9dea7d116d458066f979e6408c63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259011, "uuid": "1c7439b8-d90c-4d2e-859e-ee35e9867d61", "value": "768:4siFcSIe5eIXZg7qFzvrDPva7iS9PBPSBcmVtXIsLxZvqht8dMR:4sWcSD7a7OvD/S9PBPocmVXLxZvqhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259011, "uuid": "4c8ea33c-b445-4699-919a-a2bba024fed5", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259011, "uuid": "0ae89009-8999-4ee6-b69b-4aa4ff857e06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259011, "uuid": "5246976e-076e-45e6-890d-6148b2595cdb", "value": "SecuriteInfo.com.Trojan.Win32.Lokibot.SISNMTB.24690.31546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9617f0b-365d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635253698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253698, "uuid": "6971fd7a-d905-4d0b-9624-987378b1cea4", "comment": "Malware payload", "value": "5512f94ae3c28d4039e3a49df66096e4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253698, "uuid": "76266bea-9f50-4135-bc50-86fa420cf734", "comment": "Malware payload", "value": "2ed6f29a5273f58c3361f785478296ea4129ec4554f4aa9e13cbe55a729a2487", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253698, "uuid": "24e41791-e464-4457-8fb1-e1f3f4a010a9", "comment": "Malware payload", "value": "6fa0ee91866f8abb614b46fbace04c1dd3d8ea68", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253698, "uuid": "79271223-badf-48cc-b297-bcf48555c3c0", "comment": "Malware payload", "value": "65eafa53e68f00877d4ec5ad7ed215026946ff47c4136569ec54a3bf5f6472dce5966a2f8047acd64ee41fecc3dcdf3d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253698, "uuid": "8a8ccd6e-e2bb-4a2e-a4fb-82779c4227c6", "value": "T16CF0AB0FF41BE7D70A213503F0E6A03C513480C20B90CA7D412A438C4B204753E2007A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253698, "uuid": "c47f199e-c34b-41d6-8bc7-7ff9f9c34105", "value": "12:TaVLMUVb9wCJhIgmVeljehfMWUBAzdqsH3qs6LCXg0TC:mV4UvXrp+fMWPnqsxQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253698, "uuid": "d1084115-fa97-4877-b290-10608a0ecbbe", "value": 516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253698, "uuid": "e7381b62-b221-428b-b8da-9b4b47053b1c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253698, "uuid": "7540a662-f362-46cf-b983-d4e6fb0d14ee", "value": "JDLA241DJW5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c17b2d-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635258582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258582, "uuid": "83058e17-4420-4f16-831a-b2645568144c", "comment": "Malware payload (Formbook)", "value": "b2e4154b740fab6d388dce97e6f3f3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258582, "uuid": "da09218f-d0c9-4a41-a07e-b892e6430c57", "comment": "Malware payload (Formbook)", "value": "2eec14d00309c58144cc8234ebc9c5c4c9d81a3511f45830e50a3929fe2b158a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258582, "uuid": "1a50ef83-3c9f-4cb7-accf-b1972cb1c2e2", "comment": "Malware payload (Formbook)", "value": "e4c69d00644e265cc1911bb1390b9abf963b2764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258582, "uuid": "253a459f-a12f-4545-b833-7ce9f05ed95a", "comment": "Malware payload (Formbook)", "value": "6babed786f5610fd1eb059c6e394762046fb58aa5602789af545a0c46a4cfabf2ffe8ec17fd094bd5432cef7f68c439b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258582, "uuid": "468d79fb-5d4b-4315-9901-6f100d1e9469", "value": "T1E374122C9FE4A330FD7E037D96F4150821FAD6883452F39E1FA6A49A29577048257F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258582, "uuid": "1a16072c-a88c-497a-ad50-491f33e3e70a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258582, "uuid": "5605bdf1-6ae3-4eb2-a39a-ab269dcc5db5", "value": "6144:BI1gESiWKX/RK+wNf9O9lHvhkAj5WxpCQJzLOrKqvjOj8fhP58Ka/Qc:XESilRx+kPhkAI+izirKGs8px8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258582, "uuid": "e649143a-9d6a-4dc3-9b4f-6072fe500246", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258582, "uuid": "38dc6731-946e-4aef-8680-8cfaaea00da7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258582, "uuid": "23f773a8-3d10-4c10-9df4-28d046a83b4f", "value": "b2e4154b740fab6d388dce97e6f3f3b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2744ffd7-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635233239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233239, "uuid": "b8fcfd16-2baa-4b48-b018-7d4716cab281", "comment": "Malware payload (AgentTesla)", "value": "9f57c3ad7d81f07720ca6fa4405ae4a0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233239, "uuid": "79f9741c-69d9-4fa9-95be-9ba241c087b9", "comment": "Malware payload (AgentTesla)", "value": "3020625bf9647d6eae6fbdc414eb60bf710750a4184deaa03daba17565eccbd8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233239, "uuid": "955a4eb6-f670-4ab9-b7c3-458981675489", "comment": "Malware payload (AgentTesla)", "value": "323a8b80402dc0ae392efd91d1c1bb37d105c9a9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233239, "uuid": "8e663f12-a268-425f-a336-53ef1d7eafff", "comment": "Malware payload (AgentTesla)", "value": "09f9692090d60cda4575382bbedb97fa35474f0365f79539b866c2828e8640724c79dfe7028213d64fd56bf1ae699e6f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233239, "uuid": "4b6e90ef-5296-4484-9832-8b00fa8c1982", "value": "T1FAC42337C0E0431FA763827235A98D5B67703622FBDEA821B744E41E460CEB5DB64ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233239, "uuid": "dd7da6b6-76dc-45f0-b5fd-80112043c94e", "value": "12288:eN+cuzc3T4TPvADNhhSKO1G6hsnMrPcjoklb+zMKaHiQBdFtOOX:TtUNbfGsMrHklCaHlDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233239, "uuid": "2d2066bc-b07a-474f-954b-d516c48e3b57", "value": 553803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233239, "uuid": "65433f92-22d8-4368-9b37-950c77105351", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233239, "uuid": "ddf710e5-baf3-4528-820f-8ddbbd324f6b", "value": "purchase order 2900517+2906627 pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0e0360-3642-11ec-843c-42010a9c0014", "comment": "Malware payload (FormBook)", "timestamp": 1635241946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241946, "uuid": "66f62903-4950-4e3f-9584-5f16d45263a2", "comment": "Malware payload (FormBook)", "value": "2bd0212a01ee6f425e6eb61ae258def9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241946, "uuid": "b103334c-b2a1-4534-b3e3-a9dd54e10c0c", "comment": "Malware payload (FormBook)", "value": "3045902d7104e67ca88ca54360d9ef5bfe5bec8b575580bc28205ca67eeba96d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241946, "uuid": "b872cf09-2cff-4304-961e-f6e21f8572e2", "comment": "Malware payload (FormBook)", "value": "358dfa7f2bcdd56a342179937a6dd11d94318227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241946, "uuid": "ae15f7a7-29c5-4b57-a872-036935070446", "comment": "Malware payload (FormBook)", "value": "ae36bd794b2a4e1483d9f81406af14157ad9c92c3178437f8a1f707a611b27d76cd8e6f06a188b8d2df81f93263d1fb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241946, "uuid": "d37a10b8-fcbb-47f6-aebf-2cef3a48f1c8", "value": "T193157C22F567193BD2961939C463A772A8F5B7E0273711967FCC3B45CC262807E35E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241946, "uuid": "0f3d6cea-6e24-4b31-9a76-2ccabc4124f1", "value": "cd903ee6199fd8a23728e08912cd0b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241946, "uuid": "c6344d0b-dec2-4bb4-9fec-fb7600688342", "value": "12288:4XP/GqooPN90ke+TV6nRsT3qoHsXmlN3TQQKKyB4pV:4nNNaL+Td6WCgEQsB4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635241946, "uuid": "9f152f4c-32ad-4cee-8fc1-cc80c99a053c", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635241946, "uuid": "380da0e6-aeb2-42db-9183-2944a608cb1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241946, "uuid": "e4d5c6b6-d695-42a7-a0db-80cdc5d229dd", "value": "2bd0212a01ee6f425e6eb61ae258def9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1787e99d-3645-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635243091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243091, "uuid": "df8e48c4-3108-4922-96c3-e3a737db3e46", "comment": "Malware payload", "value": "922451995226138f5924a830e58dcf84", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243091, "uuid": "6fab2260-7ced-4490-828f-1041481c07a6", "comment": "Malware payload", "value": "320296ea54f7e957f4fc8d78ec0c1658d1c04a22110f9ddffa6e5cb633a1679c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243091, "uuid": "a1d5ac7b-687a-49f9-a16a-8b3ec1ae2fc1", "comment": "Malware payload", "value": "05036842cc0faf1fe3c539e984af4ca96fb4478b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243091, "uuid": "2f664938-5033-4173-9b84-f727389dd364", "comment": "Malware payload", "value": "8dca3135ab01efec37bacdaf9e9961d14f74fc9a74854281abb9d57f5f66c940c81c39585c40a55f3e2ee8ea1a2981f8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243091, "uuid": "e2aa9231-40d2-4138-a5d7-584850936af2", "value": "T19F6439367A95C0B5D1DD89F0692CAA55842C6A3D13B08CDBE7C06D2E6DF70C05BA1F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243091, "uuid": "e28f5b5f-6699-4e41-baaa-9afe747a85b4", "value": "404e60e1ae3fa5a8516183e3655abd0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243091, "uuid": "c9d2da7c-8e2d-4862-ad22-cdf6b09264b2", "value": "6144:poopl2EeNVPzsVtfEQXC21T12Tk03AgMTXyETmK8FkpWqclG21Llw:pbdikTXyEDVpLNelw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635243091, "uuid": "693046d1-55a8-42b6-8459-ff978bd4c3a7", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635243091, "uuid": "0820a754-4d5d-47b9-a476-f3da80b88410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243091, "uuid": "e4e0ced6-cf85-4a4a-9995-d3f6ee4db154", "value": "cob.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18451bc1-36a2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635283036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283036, "uuid": "f4f81e83-9c35-4a94-8833-c43c85769097", "comment": "Malware payload", "value": "2626a621fab10eec02e1c3dc2ab29361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283036, "uuid": "b4be9485-3675-4a8c-81ac-804f7e7e10b8", "comment": "Malware payload", "value": "33c72f7177a297ca3c396a50c7ad4bb85d20693d8cdc2fbc26b979d1cf0bddd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283036, "uuid": "24c6e54f-66b3-4aa8-8aad-8ab273cbaff1", "comment": "Malware payload", "value": "420b54d3d6cfc013c9a55dc6c1ee7148459776f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283036, "uuid": "60669ffb-b774-4c13-9046-d5cfd2616fe7", "comment": "Malware payload", "value": "9ae03ec512a432ccacfebeb72c27546e72b004fbf8f060dab454f752b41bccbad3f325d21e30744731ce4bc5ed57743a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283036, "uuid": "6879538b-97e6-46d8-a711-c499978f65a3", "value": "T15BC4AE52BE4290B6E2E221BC56BA97325D3DA93407115AC7D3C44E798D301D0BF3A7BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283036, "uuid": "123268c2-dc54-4771-b6f0-fd7f230b2be4", "value": "7276786446dd386310f1928814c93495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283036, "uuid": "e12798ed-69b9-4519-bfa9-ddcd9685cdc3", "value": "12288:GY7Lwe5zzrtK6HOWUGmuulkI7o8XEqxcAMR3D0oil4bUEpRzW3rd6b1PXpfQE8r1:G0Lwu3InErq3+P5IEj4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635283036, "uuid": "4484108f-b637-4d5c-9b47-2ed9cd6f10e5", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635283036, "uuid": "b319cc96-07d4-4c86-b06f-5f86731889a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283036, "uuid": "eecd3c42-c09a-4fdf-9376-9317c53e5966", "value": "2626a621fab10eec02e1c3dc2ab29361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca85256-3643-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635242482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242482, "uuid": "782a123a-9bd2-4ccb-9586-bc0c339fb3f4", "comment": "Malware payload (RedLineStealer)", "value": "0211971320aa3e95c0a3cbe2b8b78bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242482, "uuid": "69897105-cc4e-42ef-931c-1e73149d4562", "comment": "Malware payload (RedLineStealer)", "value": "3405731ce8212b634f19c22bccba238c2f8bdaedc518ee43acc8257bf184397d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242482, "uuid": "7b264c2e-2fb7-4a63-81c8-3e8d1d22876e", "comment": "Malware payload (RedLineStealer)", "value": "b1ca5061433b411e46bb765473a10b49e180504a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242482, "uuid": "8ec14f48-a023-462b-80a7-5a94f07d6575", "comment": "Malware payload (RedLineStealer)", "value": "953169cf56c7507b63cc3d82fbc781328a93c20565402c6fe716a253612ff5c06e3124e33575761ac83040145015bfee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242482, "uuid": "6d96dde9-9425-4688-9bac-cf95e74cb22b", "value": "T15C249C11BEC0C471D4BA1530CC6586E11B7AFCE2D97C598B33DBFA2E6E712805A26366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242482, "uuid": "0eb40320-4605-4fa3-8cf2-590254cc7b55", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242482, "uuid": "325f15b9-892e-49c5-b483-a7ccd2560da2", "value": "3072:CCpDl6a/6BO0fFd+4lxVMObcD325o32VknSn6uVMO6P2+BwvHJ3/R1:XDV/6BOSFdFQ3T322nS6ynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242482, "uuid": "35fb074d-d865-40b5-88fa-27686ff52e6d", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242482, "uuid": "722c0a9d-8348-46a7-92d0-998757a25a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242482, "uuid": "6ca15daf-dc0a-4e69-b99d-2d9718dc3cfb", "value": "0211971320aa3e95c0a3cbe2b8b78bd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4ada34-3691-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276118, "uuid": "67e81a31-0d9b-4f40-ae5e-fbba2c37a9aa", "comment": "Malware payload", "value": "7b5584dc10f6b205326d406869e25bc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276118, "uuid": "3b07b755-5c8c-4854-b052-71c1df2d7306", "comment": "Malware payload", "value": "340bfdc4c8685a15afd0fde875efb6abc20ffae0f9313b33d4f94129c3915dd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276118, "uuid": "1b4c1590-a034-4d85-a7f1-23ddba8bd906", "comment": "Malware payload", "value": "bb0027f853a6493483a935830742c31a087d67d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276118, "uuid": "4b387c92-4896-43fd-863d-c8d588a2ae6b", "comment": "Malware payload", "value": "cb7725caf80506f203669c97f1c3bdd4b534a0e812cb8c3d6fd4081086748311a9c18aea6d8e838650ee895ef292126c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276118, "uuid": "e8b76aa5-5536-4c31-8cc0-40d588bc1162", "value": "T15782D0E5516D9401DF0A003EE35F0D96BC906E615EFA8B4A390EDBC3DCF62BC8268A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276118, "uuid": "19c4bc3e-4f43-4acf-83b2-0fd1505cb6b2", "value": "384:MCIhLg+t2Ca6vL8J27zr/ChqKXPTRa9hJWpt+UWYx2krdSbMv1RK:CLgHCa1J2XryRXPtKWIEBE+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276118, "uuid": "8dcccf3d-f650-4ad9-8482-c9d42584153e", "value": 18644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276118, "uuid": "110b7f90-b565-4a18-a0c1-e96636f6d0e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276118, "uuid": "b4ca8f02-4bae-47ec-9edf-94f643b213c8", "value": "7b5584dc10f6b205326d406869e25bc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e587c40-367e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635267772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635267772, "uuid": "caf27126-233c-4ecd-88eb-0e7571785bb2", "comment": "Malware payload (AgentTesla)", "value": "abf1c76fc8ac7ebd1781cb922561396d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635267772, "uuid": "f1e6d877-e99f-4e52-b77c-b1a74ab57ef6", "comment": "Malware payload (AgentTesla)", "value": "39ba1810eed52ad0090b4205a453a85ca159f8b5357cd3d94759c58ad022808b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635267772, "uuid": "ab40b010-6a6f-49b9-abfd-f1499d2fba7f", "comment": "Malware payload (AgentTesla)", "value": "ecda39088e95dd0cd746dd6547a0d599109bf38c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635267772, "uuid": "755d2fa3-a1ca-457d-a80d-1eaa50bcaf4c", "comment": "Malware payload (AgentTesla)", "value": "4feb62a812d955f4f91d49e049707b9c477b038878c617e3505cc29d8ba29abcb6b99ea97c5cbb744e48e6cab5a7002e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635267772, "uuid": "8e9251a7-6e25-4c85-925e-c7f9870ec2ea", "value": "T1957412492BACD321EABC57BD21D918064779A2D63372E3BF1E4561DB1C2B30392562F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635267772, "uuid": "ff1ff4b1-2bdf-4756-b61b-7b9ccf029ca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635267772, "uuid": "a2115f7d-9946-4fd0-b72c-bc10ba98c6b9", "value": "6144:oxK2QMp4pcQjDRXeyoTUBZSWDGXnBxstEEoa9awOYWqbAHUu+J/IBUVeb3OZiMi:oHp431ZoTUjSWDGXnHstEE19pfAHU/JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635267772, "uuid": "a555b98d-2b8a-40df-b10e-1f2862deb1cf", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635267772, "uuid": "7531cd66-9989-4a3b-93a8-0ec2d713696d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635267772, "uuid": "af4f1386-6c57-4398-9184-83c96aa8c2bc", "value": "New Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d102bb-366d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635260436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260436, "uuid": "fc31272e-69b8-4951-9296-5c97515720ee", "comment": "Malware payload", "value": "c3b9b246d9de62ce463b4266579b86d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260436, "uuid": "f581c4cf-de79-4711-97d8-a5a92efb745e", "comment": "Malware payload", "value": "3ad185d8abc9da17f8238ce04a5b259aeb77d365fadfa9d235fc05e3730d8885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260436, "uuid": "5681107e-efd6-4379-b5ae-4e873c7339ca", "comment": "Malware payload", "value": "450e483c0df833e8346ddc68aeaef152227519de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260436, "uuid": "90c3209d-e265-48b2-8941-0d75d6f17db3", "comment": "Malware payload", "value": "54b388d802c1acc5ce84caaf798018b27fba5a09aaca683bfcefc8e0e68b7930fa762e72a5eb779bc39e90d4f0132038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260436, "uuid": "2f68fcfa-b4e3-49a5-b0bf-99a5282ae521", "value": "T1CD83D03126C0D472C9A3247194A8D7F51FBC863315295ECBA7A83E351F303D19ABA79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260436, "uuid": "0b832796-b3c7-45e4-b275-cc06d746add0", "value": "1536:AelDZ5Kt86dSv/TGB5Yts/xt3EufNk5n9I3RRRRJo4LSDGXUpw9/5kwjsUlQMN9:AelDj6a/6BO0fF3RRRRzWCXU2lwU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260436, "uuid": "7eed5eee-5df9-4155-a5d7-a74002490672", "value": 86566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260436, "uuid": "39f14845-6eb4-4397-9751-13394faee3f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260436, "uuid": "8f6d75f2-8805-4467-970f-de19e481a2a7", "value": "c3b9b246d9de62ce463b4266579b86d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0296a2-36aa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635286797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635286797, "uuid": "247de6f7-3af0-4044-900a-122882c43bea", "comment": "Malware payload", "value": "0fabd5967aed8ed7807d064308f39f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635286797, "uuid": "aa78512f-1ab5-4dad-abf7-f424fa51be99", "comment": "Malware payload", "value": "3ae5f736bfce95b0611a36c8bcfa56bf0f13a00f69076bd9c70cdac71f6dda61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635286797, "uuid": "486febec-ac92-425a-a2f5-768518044712", "comment": "Malware payload", "value": "f670c06fa73f975e7112a12cd2c4d655e7c1adcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635286797, "uuid": "04cccd31-7162-487c-bef7-ae53ae995a84", "comment": "Malware payload", "value": "15b7bf0fd8b6942b50ab5f13e5c6ee471db54475600c83a11856f21b44ef075e3b5d87d691f1e1c675cf1516adb1eb23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635286797, "uuid": "0ac414ee-67be-42cb-966c-d29c16794a5a", "value": "T1B0C35AE6719097A0C7EA4BF25A614A2C4156FF319F1A05F777CB222C1B33AC643713A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635286797, "uuid": "9fc45c7c-1ed8-4aa8-9f9c-ee1641f86da8", "value": "d0eb3861cc8e9aca36aba2f73bf5b215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635286797, "uuid": "41d271ce-3ec7-42b3-aa24-5bb54a17e3f4", "value": "1536:MZchsR++RTcZXbp6M4C0bR5fKLIRr/WaG/biS6LVv2RosHw8Mf:oc0RTc0fKwr/Wl/bi/LVuR1Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635286797, "uuid": "8a6d502b-b9e8-41d5-bf47-db2bf5379200", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635286797, "uuid": "eb78b186-dc67-4c3d-96b2-a0f3db2ae429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635286797, "uuid": "d244738b-ae49-4f75-b66d-281d98124570", "value": "SecuriteInfo.com.Trojan.GenericKD.47258968.7621.3008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bc07cf-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635250955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250955, "uuid": "dc183d2a-5868-46fb-ac32-790228be7a67", "comment": "Malware payload (RaccoonStealer)", "value": "2eaf696f66b19b9329f23458c73bffb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250955, "uuid": "df8e8292-25cb-45ba-9509-a64a1ba83979", "comment": "Malware payload (RaccoonStealer)", "value": "3afa401a164d6cb1ba9ee8836c8f2af6c2bd445896bdf986a2385fa52e9e8c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250955, "uuid": "7924e961-acb6-4f87-9162-124ce0596788", "comment": "Malware payload (RaccoonStealer)", "value": "b7decb2f51e3dda393806de8be2a55545dc13135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250955, "uuid": "c757b679-19ca-4514-9db6-2dc06a593425", "comment": "Malware payload (RaccoonStealer)", "value": "26f1079d27eb6df86b9acac3b34bdc57fcccdc5bd8c8433f346e562e84dc4af979e12c99d110c8e57006ad71fb7ab823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250955, "uuid": "61e63c3f-b6f3-4856-a089-19739689d45f", "value": "T170B4F1807AA0D435C8A616318C65C7B41A3ABCC7D97C8687B3973F3E7E792804B76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250955, "uuid": "f233b9cc-c076-41ef-92f6-a2e1d2f79f7c", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250955, "uuid": "df3fba73-4f8d-4db2-8f43-6c69c46b7417", "value": "12288:QlbdFl0aMbtNsj8IyGxbRTGiwPRAf8taS:QjPNCsj0GxbRc5C8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250955, "uuid": "bd01b1cd-e23d-4a06-8600-e55547d3254a", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250955, "uuid": "54f9e316-867d-4451-8639-4c7e31961648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250955, "uuid": "59061a60-bb7b-40de-98ca-2c0a0f73f9a4", "value": "2eaf696f66b19b9329f23458c73bffb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9680b059-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635257048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257048, "uuid": "759c7625-4047-442d-9b4f-55d175fd24e0", "comment": "Malware payload (AgentTesla)", "value": "f93c48915ab6f58f9be772a2ab0d1c57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257048, "uuid": "b218690f-8c86-4f4c-b4ed-f71f010195f6", "comment": "Malware payload (AgentTesla)", "value": "3b736f48f5eea56b7174a06329912ba91060297a8eb0e26ecc17ca835bd2ef23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257048, "uuid": "2f4ea5bf-7c96-479e-900c-81dd960dc2dd", "comment": "Malware payload (AgentTesla)", "value": "78a65edb93b540a5f3840dbcf069ae94d2039c86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257048, "uuid": "2d54ec96-bef1-4edc-b9d2-3c9da74a7200", "comment": "Malware payload (AgentTesla)", "value": "e7d079709e9465e47d56d3301b8882953d2a81efe130481a5a16dbc97262eef2f056b9643ffec23e9023b6da8532567a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257048, "uuid": "991efc1d-9fdf-44e1-9cd2-56fce1590413", "value": "T13294E09C7660B1DFC967CEB2C9646C24E621B976430BE347741312ACAA0E69BCF055F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257048, "uuid": "71940c50-6160-471c-a336-ae4687b6a6b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257048, "uuid": "adc6f812-8f4a-41dc-8ac3-5a1fb7739d54", "value": "12288:SKjYPCnzTyDXs8uIw+RJOZxzNfd4AVjGIZH:LmCnaD5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257048, "uuid": "76ac0b33-8bda-4e43-9389-cb50fda01b7d", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257048, "uuid": "06f640b3-864b-4f58-89b8-dde7d64a0f1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257048, "uuid": "589d9929-164c-4c57-bbb9-3e96315d4540", "value": "cotizaci\u00f3n.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef365fb-3621-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635227857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227857, "uuid": "92bba2c9-54e9-4d0e-9eb0-d7cd29e70a15", "comment": "Malware payload (RedLineStealer)", "value": "57a386ee05488ff2f494edff96beb8e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227857, "uuid": "2614db33-bd48-47a7-9e68-4ba1278ffd93", "comment": "Malware payload (RedLineStealer)", "value": "3be5aca7c4cf45120fd31590eed1b21258422fdc5a5f7a234e268dac4c91f74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227857, "uuid": "e71f66b1-b3b7-40f1-9483-c8658fa64da7", "comment": "Malware payload (RedLineStealer)", "value": "3cd2e6ce8c51307f0e880e45896c0efd00879d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227857, "uuid": "012de3d5-216d-4edd-acfc-3ceee6a9b3b8", "comment": "Malware payload (RedLineStealer)", "value": "1b05753fcc92ae3fad8b6cf136ad60a10033010dddcc03059ba8e54510f954245952ee223462c3514443fa5e77492bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227857, "uuid": "7e610371-513b-47d1-a96c-75e3b5aa78d7", "value": "T1E856335DBDA1230EE7F7FEB36B9D896789F93E18025C30B057C43ACDC61A106B681468", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227857, "uuid": "4a39ebf7-0590-4a95-a7ed-6b4421a71a8b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227857, "uuid": "0ef2f3cd-6071-4e74-afe1-18330ac09b6a", "value": "98304:CKgGNyQIqoDZ7svVkt2F5uQRYXflms+rGZbt7XPJcJlmkLcVM7si9CIqOV5V8DvY:CKnNOZGVkYF4QWflmRy1cfmkLc64i9CO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635227857, "uuid": "00dcf25e-e534-4467-882d-c836128888ae", "value": 5904767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635227857, "uuid": "6e6a0c71-19b7-42c1-b16f-8d6f31043d52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227857, "uuid": "62d75df0-5fe2-4fb4-bbd2-ae062fb1ddf9", "value": "Start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c06272-365a-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635252314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252314, "uuid": "13aec217-e60d-499e-86f7-02fc293f7ee5", "comment": "Malware payload (Vjw0rm)", "value": "43668fd05f27d299e4ac10206dc3fe93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252314, "uuid": "281b3cc6-b766-45bc-a8db-f208e7851efb", "comment": "Malware payload (Vjw0rm)", "value": "3c54f74f6a7a7481d6f9f00763483bb046dbbec0987a8ac733a5c6a83a484dc6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252314, "uuid": "9492a484-f483-4a2b-a71d-85a58004f82a", "comment": "Malware payload (Vjw0rm)", "value": "46e60c7ae52fc0db4e5870610857ac44e37dee80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252314, "uuid": "171740e7-d505-4cc3-aded-951d13768df7", "comment": "Malware payload (Vjw0rm)", "value": "a3e26374d86c13e47d1690b5b3e9ec92d37edfa5a87a74abcb00fd943d5be2f654a7657a9d4e4f4eeaf4691c4bbe20db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252314, "uuid": "24c56c49-f3be-49f3-8f96-b826eabac765", "value": "T11A839F1192612D46B9B1DA02F71D0510DF14A6F4EF6AA0AAD143C8CD3EFF2075B9FE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252314, "uuid": "6eb1da3b-d780-4f52-9ecc-f404649705c4", "value": "192:PjTKDrSsWruBc3N19eFb1ow9yQ9y9JkLE6+61Wsz+fr+5inP7TvsC+U6OEsO+Rhh:7TvPkrvmgpR/4K/Ktr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252314, "uuid": "e5c7ec5d-6e80-4bda-84b3-91f3ea442fa6", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252314, "uuid": "239d2e78-cec8-4e78-9804-2a4b863d0e9a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252314, "uuid": "98042d8d-920c-4061-b833-ed7b0cef618a", "value": "v9ak32Paymentreceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ab0fc1-366d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635260409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260409, "uuid": "3ed79875-4a23-438f-92e6-2978209bc523", "comment": "Malware payload", "value": "9a4933342d17be884dcc76dea1846895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260409, "uuid": "2a6ff33e-fc4e-46a4-a1d4-70657d670395", "comment": "Malware payload", "value": "3c997b19d774542b8b6a21c4a747ce603df734a8334b7f7dc6f67dfb3cd0dcad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260409, "uuid": "5db2e67f-05b9-4479-b5ae-d103484051c4", "comment": "Malware payload", "value": "66b677bd50eba216c7ee092bae1c5a83913f09a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260409, "uuid": "056bc212-d1b8-4e51-8a29-c6c0d88ecd69", "comment": "Malware payload", "value": "864d383229fca90531ab9647505617ef6c57547ebab294a849ce3a3cb947ba1d4e0511694dca966f4ffb7de4207a7fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260409, "uuid": "0e6d5b48-cd0c-4b41-b556-4900657d2e6e", "value": "T187D14A7666DAC062C4F278F0E0ADAE634B6DD931153C7F6197C06C361F10AA1FC4724A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260409, "uuid": "f75fb7c4-a5cd-4a99-a8d1-70aaccb8dd28", "value": "192:ULNpc3lC7/qjdPhLlcZUB96gxuQP29CsIqv4:0OlasdPhLlcZ5Qe9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260409, "uuid": "5eb46b80-4c7a-4e09-a65c-80f0a5a296bc", "value": 6669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260409, "uuid": "ac37bb18-35bf-49e7-9c32-5120edb1b816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260409, "uuid": "739ab646-8cd8-4a25-8381-f6d90b2a44a6", "value": "9a4933342d17be884dcc76dea1846895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5ca39b-3625-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635229656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229656, "uuid": "01b603d9-1bf5-423c-b1e9-6363c94bf3fe", "comment": "Malware payload", "value": "0b6e1ad9283603e6e95cc5806ccf321f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229656, "uuid": "37652cdc-e96c-4c64-81d5-bcaf16ab4216", "comment": "Malware payload", "value": "3d156a58639e674a485df13a0d79eac3bca41a97529488431c790bb1c5fe69cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229656, "uuid": "815cfa4a-c129-4b6e-a93b-667148a6d5f9", "comment": "Malware payload", "value": "cbd5756d5a07ea1fc90499d33363a55e71402fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229656, "uuid": "e80d6404-fe2b-4432-b062-cbfed921a86f", "comment": "Malware payload", "value": "b5c04f93a86ce05aad66bf3df2d107a05cc15828d19c3ba811b235a13b5f9727c87fc92964502ac1caa247a62a8031e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229656, "uuid": "bc36a582-58f5-4b2d-8381-583eb50332fc", "value": "T1FA84121476B0DA18DAB78735DEDF820813BDF4823A52D7293A5F319C91523B20A18DDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229656, "uuid": "82a71575-3f66-4d56-9ae1-3fe21aaa8796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229656, "uuid": "87a1bcc5-cb30-4028-a00f-e2c85013f733", "value": "12288:i+2SPfNSCcEYFGY5fETriHgCVlsdlBHJ5tmYI:oWMCcE2kbCVWBp5tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229656, "uuid": "64dc286a-fec3-49ae-95a9-fb47af4ae2ba", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229656, "uuid": "c2ebf120-42f7-4528-a99e-dba5481b1b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229656, "uuid": "f1d2e959-4c95-4331-94fe-4fcbdd7580ef", "value": "07302019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffdc0d5-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635251158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251158, "uuid": "039044c7-769e-4849-b289-fc40544661a4", "comment": "Malware payload (SnakeKeylogger)", "value": "87c6fb76c2715168b36133c27517cfb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251158, "uuid": "cceb120b-ca72-43ba-ac40-2fbbbfb04c3a", "comment": "Malware payload (SnakeKeylogger)", "value": "3d19aa2680143c23ba9869e23ae6ea4a4280ed9bba1d0313ea6b0f4f0659970f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251158, "uuid": "265a5986-5e48-4fb7-af83-3dad2f9c77ce", "comment": "Malware payload (SnakeKeylogger)", "value": "be638a5d91cb2f42b0ebb9b060bdb9207464088a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251158, "uuid": "603fe33f-705a-4380-a708-83ad8814530a", "comment": "Malware payload (SnakeKeylogger)", "value": "9524fc36c297709ef251d480ea4ee160f239898e7d027d2b7177b4312442ff06fe79ad155661def045849a0b77024393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251158, "uuid": "0eb9189a-dee5-4f92-9e49-084c7919a462", "value": "T1C474CE8D7660B1EFC827CE769E941C64EA20B477530BE747641322AD9A4E69BCF050F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251158, "uuid": "62b427b4-1d30-48fb-8de5-dbe2c8139f4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251158, "uuid": "65d3a891-3ab1-44e9-afa0-f1a5cb702828", "value": "6144:RLncw9D6l61fo2O4E9tRYQz+ABDynx19UIIXbqETg4WwpML6FRa45ZR:KJqfNQtRYQz+W23oXuETg4Wwm6FRa45v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251158, "uuid": "0bce3394-b906-4c21-825e-069ff5f4c103", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251158, "uuid": "039d92d9-da71-473b-81d7-694d984278ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251158, "uuid": "645799b0-f103-4451-98c8-414b9b6a9b36", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc88647-3671-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635262245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262245, "uuid": "59718067-d7bf-4db4-a03e-bed2264a27f0", "comment": "Malware payload (Loki)", "value": "c124b0bba30210c33ab39114c51fe80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262245, "uuid": "6864b337-217e-47e3-a732-d8d07f33fe1e", "comment": "Malware payload (Loki)", "value": "3f6596e3385b59719027037a5e60937d085c8006b3033e6cea37bf5366e5590e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262245, "uuid": "34f4ce19-9144-49c6-a501-21f89c6bcd4b", "comment": "Malware payload (Loki)", "value": "96247043602bba20b4aab6bbabaa90dc9b236dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262245, "uuid": "b4df8074-6516-4d96-bffa-9d8d1a0ea356", "comment": "Malware payload (Loki)", "value": "ecf89a4423217c9df2b74e6a18c14573dcf493a38bc99efe8c77293737707e77c9bed7410fb56ff1dc5e4bf60bc323c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262245, "uuid": "587a362e-1ff1-4b21-8f59-c5db6f6f3b86", "value": "T1DF74DF13F1CD64FDE04C44795CAAF72CB6226C24085B6C5A5E86F96C077924322F7ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262245, "uuid": "1050cff2-4cc8-40ca-a001-d8e24f94f9a1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262245, "uuid": "322afc26-b653-4c2e-a743-a648ae33b192", "value": "6144:DBlL/6zQS0gTNit3Kk/dsVPiD3mPAuOmTZ0jdmCefqI44Tp:Vrgbppirg0jdmd1Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262245, "uuid": "3d5d1911-fb86-4453-8b08-d64eba6a86ef", "value": 370906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262245, "uuid": "d23a7a2e-476e-400d-befb-5d88b39ed8f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262245, "uuid": "f576cb50-c375-4f3b-a721-a35c403c3e7e", "value": "c124b0bba30210c33ab39114c51fe80b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9eb7159-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635257215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257215, "uuid": "2426eccd-b895-4248-b097-0cc830d6cd29", "comment": "Malware payload (Quakbot)", "value": "40fca5447e95386946fe6404c7976b5c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257215, "uuid": "6f2d76ad-ce70-4592-a30e-ef73b873f5e5", "comment": "Malware payload (Quakbot)", "value": "40b203a7b40ba1188d0a56a486eac6d4c289ee6ef3a32ec07c245ef44f325a95", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257215, "uuid": "b7b11e74-d313-4bf1-8e09-19b9c1e0bdb0", "comment": "Malware payload (Quakbot)", "value": "30a671ca2ff5c8c59a5801c6a84a18fdad90c1c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257215, "uuid": "a778cade-dcce-4e3a-89c7-aab4e2d0b7c3", "comment": "Malware payload (Quakbot)", "value": "ed3d1b672e44776989361f7b0533abb60cd69a108332705d5aeb688a81b690c889e12bb31fb8dd7b5eb01dab7f4f028e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257215, "uuid": "bd888167-b227-4edf-83fb-06959b5464aa", "value": "T13234D146B91CD89EF617873148C7ABAA5323DC304FCB1F876695B62C6FB8DA47903046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257215, "uuid": "4e716f5a-f3b8-46be-978e-05911a27f32a", "value": "6144:DKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOcfZw6lBVb7oWSuKMA6PujbmvV8Dzj:2ZrlBVbszXjS9t8Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257215, "uuid": "43c428ca-232a-4672-a29d-1e5d60ad29ac", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257215, "uuid": "bb05d699-c823-4f8d-9a8b-b8808c8b5a0e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257215, "uuid": "1cd9bc40-30a9-49a3-8a5c-0cc0c64f8f2a", "value": "40fca5447e95386946fe6404c7976b5c.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60364d1-3637-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635237317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237317, "uuid": "10f66d38-90ba-41ca-ad6c-44ac694444fc", "comment": "Malware payload", "value": "5923435d537c817c0e284cec78a625ca", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237317, "uuid": "acfd4a0f-4474-4ebb-aa0f-c523cda61907", "comment": "Malware payload", "value": "416b4fab85b707b12f4bce28529a496828c4f1dc5fd5e45492eba0f3d2730e90", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237317, "uuid": "fc1d4567-88a8-4cdb-ad98-fd83bf146a42", "comment": "Malware payload", "value": "e9ce979ec2bb0333fae733c476340d768c54bfa0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237317, "uuid": "e5b0128d-36a8-4c73-bdb4-5977254dc9dd", "comment": "Malware payload", "value": "71a064db6f7f3f8664e90c961ddb17bbe1af40cab67ff8ab7ef3b04dbd34ea1c06fbba9a46e904fb5b8090732e5c4716", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237317, "uuid": "af9c328c-3083-446c-be03-5f5cbab76266", "value": "T1D4358E23F2C18137D2732A399D6BA365AD39BD106E39680B3BE41D4C6F3568139362D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237317, "uuid": "4292b748-36ba-44ee-ae3e-6f23b68fb842", "value": "24576:8Dre5GYxAzdgTh2K+qW5AK6OOxKtU/vsVYLX1vLDwITU+NuqA:8DOGYxeO/zKtU/vscDTPNuqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237317, "uuid": "158f5bb6-3dd4-4cfe-9eaf-84baa8beb176", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237317, "uuid": "451228bb-8835-440e-a42d-0f14a8e9eeed", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237317, "uuid": "945db422-07db-4e5f-b8d5-be0568baa625", "value": "Archive-P099383.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788da646-3628-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635230799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230799, "uuid": "bc1815fd-99c3-45c5-bd32-3e1e17dfecfe", "comment": "Malware payload (AgentTesla)", "value": "5aac80b58b2cbafc4aa79ed0e9282e72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230799, "uuid": "420947ab-719d-42b4-8ed9-7495e8cdd783", "comment": "Malware payload (AgentTesla)", "value": "4196b2e1248f1a299fc7ab90743042baa293dc7f530f2498fd406a40945cb6c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230799, "uuid": "1dd9d916-a328-418e-818a-0da2bdb84292", "comment": "Malware payload (AgentTesla)", "value": "e851b005e647510a4f9a3255478d6923280d2734", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230799, "uuid": "ba0714a6-8c56-4ac2-b4f5-48b4539a6cb8", "comment": "Malware payload (AgentTesla)", "value": "0e210d4828d2cee94189c10403f4fc0a852df9f90482daea87dbe84b028cb95c9282ef8e8a4aa6e08b1845df393a0794", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230799, "uuid": "736a403d-c01a-4cff-a760-000f57b3fc76", "value": "T12135E1E1B780C471D8635535843AA6A7A833B61D9E284A0E7BD1FF1F7D723424027E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230799, "uuid": "e2b3c822-c004-4f53-b163-7c3844b84c82", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230799, "uuid": "97af6b80-f567-4b06-8631-70e68e22b83a", "value": "24576:eAOcZw6AomRRV7DlgHryTP48oo0UBX+U1HC:kWApD+WL4M0Ulk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230799, "uuid": "71f4e0a9-2356-417e-a37f-790a9d0553b8", "value": 1096249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230799, "uuid": "0e6bac27-c708-426c-a90a-3097253541c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230799, "uuid": "32a23c65-7a03-4ce9-92df-2460b38e19d1", "value": "Order specification & Drawing_Docx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c45136-35f5-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635208854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208854, "uuid": "e8e58b46-4efb-42f3-b9ac-92e2a7ac0d9b", "comment": "Malware payload (TrickBot)", "value": "207ba122f58be5fedd88ee479693712f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208854, "uuid": "c28c8e45-49ad-43e7-86a5-e68bc62b816c", "comment": "Malware payload (TrickBot)", "value": "41c22efc0cbeb34043c579d51bf2fdf888bb4181331e9659cbcd2956bff50d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208854, "uuid": "162404b9-6d21-4abc-8ea6-0239cfea5cf8", "comment": "Malware payload (TrickBot)", "value": "d65b3050d554ce92a75c2bcfa0014d317fd1d4de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208854, "uuid": "6107dda1-8ce8-4ec8-9e89-3c9ac46acf1e", "comment": "Malware payload (TrickBot)", "value": "68a5bcd4d62cf9575f0b69453d19a0bc8632251e9907fde0b298ccd65884ee2bcd135eb7c579e9685a29d7fa36698fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208854, "uuid": "0b90bb2d-fd73-4246-90b5-793ea7b85df3", "value": "T1E7E4CF26B7A490FAD0F216360FEB673BB2FBEF204935824717917B5D4C309514B26716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208854, "uuid": "46393642-1560-4a1f-a0c3-adfb9f7bae2b", "value": "542db7e97024de0354d3af3fe3180ab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208854, "uuid": "4968c1a1-1535-49e4-a485-e62a7fa2496b", "value": "12288:c3OvNPnZ2TGqZbv0r+NFWjLF+qKguIKuPSuGqVuzRgZK:HvN/0T75rqfKKSQo14K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635208854, "uuid": "8007ea04-416e-4293-ad98-e9e2ee711a42", "value": 675883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635208854, "uuid": "e3bd91d2-eb50-4186-ab73-76e287ad7c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208854, "uuid": "26f07369-e405-4229-b9f3-215006f634aa", "value": "esmallruby.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1091285-3612-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635221525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221525, "uuid": "b8421453-c9f5-4c28-a014-1c0222accc4b", "comment": "Malware payload (Formbook)", "value": "98858aead7a9467b23aff17650074f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221525, "uuid": "58fc18d4-f7f1-49cc-a98b-213fad191160", "comment": "Malware payload (Formbook)", "value": "42342c618988f3ce6d4f350da12348be8033ea29d17bb6bb4f6be6e02e58328a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221525, "uuid": "8a189776-55c7-469e-990c-6c24abda094b", "comment": "Malware payload (Formbook)", "value": "106575d9257054ae91bda23a853f117772e37789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221525, "uuid": "fade1fb1-a794-4884-bcaa-10e09b1ca1ed", "comment": "Malware payload (Formbook)", "value": "324606000383650711ed43230a25da18983193ada10d4bef0789dae3216844bd971cf20ce669c0fc69f6aebbb8bc2cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221525, "uuid": "fa103cc2-8c61-444a-9337-3c2252bbdff0", "value": "T1A774120D8BECC335E6FB4B7924AA064502B89015322AF74E1B18B5E94D67311D197FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221525, "uuid": "5bead464-c6e8-4ffa-9def-beeaa969819b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221525, "uuid": "e65ac303-7c7e-4705-bbbb-027555243bc9", "value": "6144:MsuAd1ZPeQfmrdwRkL19W47zZZa0LUfbUD1NwmPb2p7gphAtMgprQ:ppPgwRkLLTzpLCAbnTN/Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635221525, "uuid": "9bc58bd7-59fd-4dc7-bd5d-5378412b60e9", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635221525, "uuid": "2288afb5-fb81-46c6-b10e-bdc2b63097ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221525, "uuid": "1d2f8dca-b962-4470-9cf1-12ba52bf5491", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fea386b-362a-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635231563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231563, "uuid": "89b42db4-14e0-44e9-b47e-70ce3a043c59", "comment": "Malware payload (DCRat)", "value": "7c6b9d0070775f719e6ec9ffea045175", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231563, "uuid": "520bc972-66f3-4510-83a8-8a0814e59531", "comment": "Malware payload (DCRat)", "value": "4266023dce868e5e4d326973c677658634c34b14901452f94a482d09b5deec5e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231563, "uuid": "1d1c74b6-eedc-4863-b636-1e06d058ace3", "comment": "Malware payload (DCRat)", "value": "e079cb7efa52c11a2c8054d5d2f5e0992b93f127", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231563, "uuid": "d464b743-834c-4081-9279-4300b2a3717f", "comment": "Malware payload (DCRat)", "value": "bce86718a711eef5a9e01437b29abf40fb580496498d5490092dc9abfd53a71d9c86615e23c987b2f2bb750e74d4a890", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231563, "uuid": "df5991bf-c546-4c32-9f57-541d2b54b1d7", "value": "T1B92633433B6EAC1AD57B2934CD79D8162C248E679812F5E937D0313EDE781E68A11B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231563, "uuid": "f61fd3d5-f7f6-46da-ad30-a8a37f93332c", "value": "84bb1ac192dd1d591766b467b12ade64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231563, "uuid": "e56d99fe-fb8c-4514-a4b6-227a274af2b6", "value": "98304:bmABBfAREVebim06Hu25p3eUv+vN4BrY0b0EcEt2ls4/sWcWHIyj:5oRh3/Hx58LvNpurtz4/L1HIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635231563, "uuid": "c53db6c6-9402-4ab4-8a39-4dddfe8dfc27", "value": 4530688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635231563, "uuid": "fe1312ef-2f27-4853-b8d8-48b1d73f13bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231563, "uuid": "2da05f1a-3c71-4c51-b029-0ec8cb647c96", "value": "FNLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a431385a-365b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635252776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252776, "uuid": "d8d70dba-9b3b-4a20-b852-2800b788d49c", "comment": "Malware payload", "value": "caecf3f0ccf479eadb39a56b71060950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252776, "uuid": "083beec9-6c57-4504-b6de-c855ee46a1d1", "comment": "Malware payload", "value": "42db3b50c7ee2256da2af8ae73b746de18977126529bbaecc9803d552b7c35d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252776, "uuid": "32adb929-c328-4f8f-b7c6-61fe75852b1e", "comment": "Malware payload", "value": "b4c1128715641311847182573b5644f7decb782e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252776, "uuid": "c7afc9a3-44f1-43db-bf52-0916980e369d", "comment": "Malware payload", "value": "d57f95384ae234d7cfa48196849dbbbb1fc318b62f81e9233e74e742303616bd62f0959477ab4089f386542ca822d852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252776, "uuid": "948f8807-728e-4edb-98a8-444c89d18d88", "value": "T1F58412497BC8DA61DAB24B3FD9EE804803BD65437473DB2A6989327D11E23E14911BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252776, "uuid": "0aa2b935-c202-4778-9990-1f827426a7e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252776, "uuid": "5c82c806-add8-4646-b7fa-ee8d66d4220f", "value": "6144:Hm1ajjq+k7xYDbLpXnhzTWIsWRjxKzjBDiIAuwRb/LtnwC3N3ZOqTPzQAhSNh:HA+lzZnhyfWRFKzjJ1AuGDpZgIPzQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252776, "uuid": "35a56bfb-9dd6-4fb2-8741-af7563ebd882", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252776, "uuid": "d48414ed-5218-4ba9-9acd-2aa9acbf8427", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252776, "uuid": "4dbcea48-aafd-4690-9caa-f7bb28baccf7", "value": "FEDEX DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ed837c-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635260265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260265, "uuid": "f8f3ed96-921d-458b-a412-651c65637a99", "comment": "Malware payload (RedLineStealer)", "value": "ad6a27b562b7e805fb707922700c7fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260265, "uuid": "cf31f201-4b85-43eb-af92-6fb414f44cc7", "comment": "Malware payload (RedLineStealer)", "value": "45168f804f0dfa97ec4079640e58a02d4c1097b11a56982bcf33f5ef0c6eae89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260265, "uuid": "457ef74c-7fdf-4f81-800e-205be61bd1eb", "comment": "Malware payload (RedLineStealer)", "value": "88c6aadcd7cc80fd2a3ce6b6a302ed3dbf1bd522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260265, "uuid": "24031d8a-4ab6-4d5c-a8d9-50183c313aca", "comment": "Malware payload (RedLineStealer)", "value": "ed378bb87c9974650ffc86be1a64bdbb453d95a0bc01625c4f262b1a238ce828b8dc16b079c34237a40c13033c81ad8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260265, "uuid": "5ae75e77-4812-453a-b4cd-f2b914f60b2e", "value": "T1FE64BE10A6A0C039F5F316F84AB693B9F82E7DE1676480CF52D527EA86346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260265, "uuid": "1e3ef1a8-588a-43c1-a524-642f1b2b5c8b", "value": "8db81cce9914747c7ca79cf056ce5ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260265, "uuid": "143f096a-a436-4ac6-8ffa-41cc2bc84519", "value": "6144:mTgmof2e+vDYj6KOA1x37NWHsqj0eXifslSYr5E7K9xxu3L:WPoN+Ejlx37NMsqj0eXDlSu5jCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260265, "uuid": "769ae2ad-d53a-465f-8cea-e1a5bddad66d", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260265, "uuid": "37856e38-ce64-4956-aef1-2a91665ef321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260265, "uuid": "6a479f11-726a-4de3-9519-1240658a612a", "value": "ad6a27b562b7e805fb707922700c7fce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4581e857-3637-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635237155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237155, "uuid": "4500559b-d818-46b3-bce5-445cfd9594a9", "comment": "Malware payload (RedLineStealer)", "value": "6fa1f80ef39cb08226266a92fa6ebfad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237155, "uuid": "fd79ba9e-7318-475e-9c78-dfcd48e24d9c", "comment": "Malware payload (RedLineStealer)", "value": "4574fe73015cf871d090eee41f1668e57e3fb700fbb2333176443be9328b8d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237155, "uuid": "15e9c3b5-ca10-4725-91cc-507c070da9fc", "comment": "Malware payload (RedLineStealer)", "value": "edea7ab6d81e844a300f1fa91c095d8667525909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237155, "uuid": "ba07dff1-f494-46d1-9a0c-aa820a4d9678", "comment": "Malware payload (RedLineStealer)", "value": "ecaa2dca652aa28c6f5c8ca89045eac25a9ff92478d4bb31b4d0f87e9c6d04d17ac064880d76bd9b3e5b41f57c799909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237155, "uuid": "d4381af2-b27d-4658-9e14-12cbca683c7c", "value": "T18274AE10BBA0C034F1B352F849B693A9F93E7AB1672494CF62D126EE56346E1EC70747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237155, "uuid": "f27214f0-39e6-45d9-be5a-d7b8b9bf36b6", "value": "2b0846a44910d81479e79ca83c930b58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237155, "uuid": "853945b5-f2a8-4bfd-9373-8ea3fff56dad", "value": "6144:aKfVwylXA2ffWctxvsmyUz7VYPRLQELSPZABTxxld:ZAqe2xUPGJ8RLQjPZM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237155, "uuid": "4dc45cce-8935-4f75-81ea-ec385c92f7c4", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237155, "uuid": "71c0cf5a-e4da-49e0-90e4-db7166a3afb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237155, "uuid": "35c2f30e-9ed9-4c7a-9044-005a2a01cf2a", "value": "6fa1f80ef39cb08226266a92fa6ebfad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c210bf-3659-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635251762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251762, "uuid": "58468f0f-2d79-4f15-a23a-25839eb5def0", "comment": "Malware payload (Formbook)", "value": "b8cf81e69b571ec7612d5b2ec8a66682", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251762, "uuid": "446b11de-4370-4ac4-a688-958adeebc7fd", "comment": "Malware payload (Formbook)", "value": "46ca11e597ee7173e77a1cd8ca582943b099afc05921bf566937637c34dc41d0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251762, "uuid": "907ceb64-220f-4343-846c-4c8d311f91dc", "comment": "Malware payload (Formbook)", "value": "d4da3acfca6d028d8ec56b92c84af760f8c075f6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251762, "uuid": "cca63d2f-d7a4-4809-b818-cee2fe3663c9", "comment": "Malware payload (Formbook)", "value": "b65ba371cc9f27c29c16a30bd2fabf56472e841049ba717afc7322da78d279d4704aa679c8de2d3bd6d0d8e5121656e9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251762, "uuid": "19f22f25-254d-4e85-857a-4f7c61560bbb", "value": "T121A4D02395902B73E52D4B3C3A1CE40B3D61CE2AE55464E1DD85F1806EB375BBF8A943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251762, "uuid": "37662c75-6d61-48ea-9f97-8faeb9df38c9", "value": "12288:7FRMvdCerkOvZggEqvLg3IHDkrzStCKTpoPkVOw:JRqdfJcItCKTuqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251762, "uuid": "a55b4a61-703b-400b-aa4d-794e7f7e01c4", "value": 451128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251762, "uuid": "fab9471e-6ca8-45e1-8fa5-48bfe4912ae1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251762, "uuid": "1e4c85c1-f0b9-489d-aae1-8a960e838d58", "value": "Unpaid invoice 76810091.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b07089-363b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635238838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238838, "uuid": "8fe9cbb6-cdf9-4752-8ba3-a8adcaba9ad2", "comment": "Malware payload", "value": "5b82fe9b0ebd1cc0bd2d1687a75c6a99", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238838, "uuid": "3a9a5b93-076b-44d8-84d3-b0bf4ee92a1f", "comment": "Malware payload", "value": "476ece884df5e730fdf2ea6c072f55526227ed820aeff1ad6c0f83291c364013", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238838, "uuid": "2cb1f29c-99d4-4057-998c-44b6750a052a", "comment": "Malware payload", "value": "88505202062ed96f8f04d17312cbbfd8251bef77", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238838, "uuid": "8b0237ee-488b-4f15-9c57-71506a6aacda", "comment": "Malware payload", "value": "67e0ae1001b6c0a466178ad532675b7472ce0c354935cbfb00ef25b67802d2dd9dded6657d97988a2ad8a5a49ba7106a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238838, "uuid": "7424f084-fd82-4b9c-b836-a554c6c14e21", "value": "T15244BF5ADC684065D0E70BFA771F0B12231B6D1F2E7BDA36A2E23A5C08B3B5BC651D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238838, "uuid": "2b345c5a-0818-47ac-8cdd-872dc10b28a0", "value": "6144:LlZ1T2l0tJRVibvj2SHvdC+tWvCO5wAjDbjfFms0fHMH:xXPJRAtPI+tWvZ5wO/jR0fHMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238838, "uuid": "d8a2156e-d68d-45a5-b3a0-b89c290a7105", "value": 265544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238838, "uuid": "a774f134-8b51-4810-8844-99951596286b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238838, "uuid": "8d2b2650-e4ea-4f66-b221-142f1eb2c754", "value": "RECEIPT878.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33361892-3623-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635228535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228535, "uuid": "b3429855-e853-498f-85dc-af058611c163", "comment": "Malware payload (Formbook)", "value": "5ba538f50905504a2cd72c688ea1e969", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228535, "uuid": "4ac43666-0692-4cc0-8668-874edf7e29b2", "comment": "Malware payload (Formbook)", "value": "479e318203aceb940cea4e73b5bc953a1ad3429b45b8b889c6b729202bc178eb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228535, "uuid": "97c2b2fc-06e1-48c4-97a9-e06f125bfbf1", "comment": "Malware payload (Formbook)", "value": "3c1bcfe8177c3647c8dea1e0090bcae303189caf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228535, "uuid": "79e69d0b-6822-44d6-9ea2-8fe5ba735bf6", "comment": "Malware payload (Formbook)", "value": "5ec0d42769caf2cda544eb06047cc1e1fa09b928d8c006895682d0ac70bb5cb987ab6491f286c945fb8e0229bbcab4d9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228535, "uuid": "f1449a5d-0c21-46af-bfd5-3d4c5a98f879", "value": "T145B59831B5397697C26604B0166FBE0A430C7D47B3DA1F58454ECBFC2CAA8F59309E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228535, "uuid": "145e6b40-8e1e-424d-8350-52322cbe94f2", "value": "1536:KxxxAavIR/f34HkZ03z3L3k3M3S3N3L303S3U3w3g3S3E383j3Z3G33303S3U3wR:KxxxOxxxzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635228535, "uuid": "1d4ba4ce-c920-4e70-a3dc-b399c9ba74ee", "value": 2345236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635228535, "uuid": "bdec1be2-075d-4670-93d1-2c9bbf7fda2a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228535, "uuid": "0b7c6b57-f8f6-4f2c-8fa9-a49d2a057373", "value": "5ba538f50905504a2cd72c688ea1e969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c0ae4b-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251351, "uuid": "feed7736-85cd-4d99-b61a-bd200f8e24dd", "comment": "Malware payload", "value": "2016cd32ee4a73e67b52a0639b8fcfb2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251351, "uuid": "53fe0808-dc57-4e4b-87b4-3b0501a4f6a1", "comment": "Malware payload", "value": "49c9d6f240c17a6703e560c51cff1e64958c4ff8753a0fc889a20a15fbeebdf2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251351, "uuid": "6c473e6a-ddb5-4436-8bff-cc9fa27a6373", "comment": "Malware payload", "value": "cabda55517228340cd68ea348f09a0300563d4c0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251351, "uuid": "4202b5f0-5eae-4459-88dc-208ce2f78afb", "comment": "Malware payload", "value": "e9dc36e9531d6fce47a224ebb1d229814191846bb38ba1d931bfea4bf8ce35dd0966725c0fe4a0a4fb24ee0c07d5ba4f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251351, "uuid": "ad68e063-d6ed-46bb-bd2f-666a00f9f5cd", "value": "T158C58D12F2928937D1732B389D5B9369993ABE502D38584B3BE83D4C6F3A6403D253D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251351, "uuid": "50dc8f65-d0f3-4374-b91b-22d3931e1acd", "value": "24576:r0iuT+SppC/2W5AR9W4htBnXD5sooeJGBvXGAAfUTU+qEDe5GYSASA:r0XqitBnXio5GacTPqEGGYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251351, "uuid": "5d052bb5-f4ad-452a-8b53-426d8297a3e6", "value": 2729984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251351, "uuid": "20a663c4-490e-4e02-b5fd-63095e00382f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251351, "uuid": "7f9f6d93-d1f8-4b9c-81af-27d752214a26", "value": "FacturaFecha2510.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c588440b-366a-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635259275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259275, "uuid": "a7b89b57-5535-4597-b2cf-72698a2c2111", "comment": "Malware payload (ArkeiStealer)", "value": "512c1f87b394c80725db7e6338a6078d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259275, "uuid": "d4f1dd2b-9343-481e-b2b2-e8b20a6270e8", "comment": "Malware payload (ArkeiStealer)", "value": "4a089b008e89593d11b0a7062c8c9741138af5fb15caf49c218e03f40a8480f6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259275, "uuid": "f03a60d9-e9bb-4218-b7df-204ba749159a", "comment": "Malware payload (ArkeiStealer)", "value": "51f1ece4dc03873ba4ce172a7ab0b6b5a6f382f2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259275, "uuid": "898bd874-7fca-4061-bdbc-c371fcc015f9", "comment": "Malware payload (ArkeiStealer)", "value": "87447596b904109f0bde46db007f2b013337d3d445105ddecb57335ba7ce5eba07bf385dcf4fc9d0597c3a8bd5d12a00", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259275, "uuid": "d40b5d8c-c9bf-4533-bdfe-bed0867b5f43", "value": "T12E448D00A7A0C035F1F616FC89B69379B92E7EE16B2494CF52D51AED9674AD0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259275, "uuid": "10943c64-2a15-4fee-9fb3-a45ffdf26da6", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259275, "uuid": "289bfd57-4c73-4660-8c60-af786b73fa34", "value": "6144:0rTXdappBRWMsM6r2r5e6bfXcPqIc9wr:0PNaXBRbsM6r2r5hfXCqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259275, "uuid": "9dce14a4-3eda-41ae-aa0a-5dacaede8839", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259275, "uuid": "2021304d-57b5-49ce-a090-e9936e68fb71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259275, "uuid": "873de3c8-2eb5-4390-aee0-d40cc77cec48", "value": "512c1f87b394c80725db7e6338a6078d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b77694-364e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635246960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246960, "uuid": "0885c3c0-d76c-46af-acef-85787388202c", "comment": "Malware payload (Formbook)", "value": "697ea1b8fe6f0102b3d0ddb885dcbff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246960, "uuid": "186c0b9b-c921-49cc-8d5f-27333b540bc8", "comment": "Malware payload (Formbook)", "value": "4a5cde9ad50981368ec2ee3448a0c1a059e01c5c64c4106cc1e9ca202637da3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246960, "uuid": "ef3f6d6f-42e2-4cbe-8e8e-8b6f37984332", "comment": "Malware payload (Formbook)", "value": "685845be109874f378544caf78b25c5ca0732cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246960, "uuid": "49f8fc98-4820-47df-84f5-7ce2729e9ccf", "comment": "Malware payload (Formbook)", "value": "f2bf2d9a6e7c23f8fb51cce4f03dd2325d7d469620b4b660bad7131c172ae93f62c7bffcc6670ddb1e78d4241ba18f86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246960, "uuid": "08ec75ed-89b6-4b93-83da-99e682596683", "value": "T17344125F93E084EFECB70AB296BBE344D5F2420040606A8B5794DF3AF5697C76C1A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246960, "uuid": "9c00bca8-ae54-4dc6-863b-71e2ba2c8b80", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246960, "uuid": "931a3555-14ed-47df-8e10-d5f38d2e8f55", "value": "6144:wBlL/cHmASAEgPYK4inBfnnBwWJoesY9pZi3qFSZFk3O/d0ZE+IiC/:CeGko1ihnBcesYhi6k5Sm+IB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635246960, "uuid": "62e5323c-d0d7-4b3c-9901-670545ba0aab", "value": 261040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635246960, "uuid": "01d56a2d-aa45-424f-8629-b873bf396745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246960, "uuid": "21e22224-29bc-46d1-a911-f0e38953e98a", "value": "RFQ_PI02102110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89139fb-363a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635238691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238691, "uuid": "0fbe28c5-ae5a-44f5-a21d-22d70ac9564b", "comment": "Malware payload", "value": "4c76c197ad69c6dd6b07e5af3670919f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238691, "uuid": "7eed7fda-69ed-4c91-8841-e0bce3f06229", "comment": "Malware payload", "value": "4a8d087028282aead26c8dde4eea38a5f4d88430457590e066f0f42765092877", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238691, "uuid": "cb8b5007-7c4e-42d7-a94b-376fe75e269e", "comment": "Malware payload", "value": "7252d61c5353d8925f39930fd4a783b1d746f698", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238691, "uuid": "ad6e1455-0c43-4b71-ae59-31d016316d33", "comment": "Malware payload", "value": "e2883d8fcca0721174baf6f5dce8f196b58c51bb8c6e6c823d0e61f27ea0e1cfdeaccf3d8a92c87a750974cf2e713e01", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238691, "uuid": "bc5218a9-5b8a-4b9e-94cd-c3aeb609a291", "value": "T15974C0A8C72EBB59C749EAB14448472297BB5E80CF32F1690109FDE715B1EBE049C7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238691, "uuid": "63817a16-9d88-476a-bca4-3b7d611ac557", "value": "6144:52H+gwvjnIL2ibGfUJPiphNx6ez7DwGNB+kHyA6yTawiS6sGlz3EoLAvXg:++djnILfbGMGn6W7UGNgkSsTawi7Ao8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238691, "uuid": "490d88b2-3eae-45ba-8d0b-2039a3cbf445", "value": 360360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238691, "uuid": "19aead9e-54d2-4c99-b4c8-56f37b3bb964", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238691, "uuid": "ff2898ff-c8e3-478e-8628-dbc50b22c9ba", "value": "Confirmation de commande MNS distribution.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31954b21-3638-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635237551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237551, "uuid": "316f486c-b559-4017-b469-830079039d5c", "comment": "Malware payload (Formbook)", "value": "ec21fd6d62b9550a6180467370d74eb3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237551, "uuid": "13c72c4d-9f29-4a7f-b3ae-e36f9a9c480d", "comment": "Malware payload (Formbook)", "value": "4b6d625421691bf21c5b3fcd8571fc26b16c604196715050ebeb55a15c90251c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237551, "uuid": "710c4fff-1348-4e4d-a39b-2392dd0ae56e", "comment": "Malware payload (Formbook)", "value": "01dfab38ea50ecac25129450b0120b303d59bf91", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237551, "uuid": "192dae39-ed15-4b25-9450-12a8febf6d50", "comment": "Malware payload (Formbook)", "value": "046cff2605b0616b4270a39b08f12c31c59b83e1762a3deab9ea6d0a6e9bcfac3fefe0dc7bfb0c1d09389229c7d66786", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237551, "uuid": "c1276251-941c-4dd0-9f85-b876a57708f2", "value": "T141948DDCDCA185E4CBCEC5DA49197F9920637A7CC6C37C5A4838B2F90F9353E5A1A860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237551, "uuid": "b23a8e5c-7c69-477d-b0d5-75331921f859", "value": "12288:Edg8sLeDizkhDxvYfAQT49s7GOWK7rIjX8TCP22YT:EG8s6KwDxvYfZT49shED8Tq2JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237551, "uuid": "8ca101af-92de-4b42-b12d-5f6f6bac0086", "value": 439541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237551, "uuid": "97486b4b-d406-4ac3-8aae-2226c9402950", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237551, "uuid": "11096ebc-e600-44c5-917e-51ea807dd694", "value": "SMC Req Offer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f7cfda-366e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635261079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261079, "uuid": "7406b764-3df0-4baf-8965-fc915b7433c8", "comment": "Malware payload (NanoCore)", "value": "788c7a25b15a7263c24c4060f0c0df6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261079, "uuid": "42ee0764-7f41-49d3-9de5-7381c042eeeb", "comment": "Malware payload (NanoCore)", "value": "4ba6a3b111db7d0e22339141a17eb368e1882734fe0a22641c46ab94c725bfad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261079, "uuid": "3488e899-40f7-48b0-9657-3cdef6ca9d41", "comment": "Malware payload (NanoCore)", "value": "c28333f296ea281d90610a0866d5cdb8885fc34b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261079, "uuid": "ec93d166-ce3d-42a9-bf47-2462db86e748", "comment": "Malware payload (NanoCore)", "value": "2062bac9f6741b4367b8531f85b363d0c685ff1a2e3324212ced99659c109bec9dafd930c94489dc4b7332d5f18af34b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261079, "uuid": "c9e4c560-ea7b-47c8-b6d6-4f7a269f8595", "value": "T1AB842860A2D848E5EC7A17349CB2784023B2BDAB8972DD1D9D99717C1A733C30677A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261079, "uuid": "dc8f06a6-ba75-45d5-ac23-44f73d33138a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261079, "uuid": "f7475162-b5cf-4233-9f88-c18263fe55ac", "value": "6144:tM3Xn0uE7DZNLjqQbdV0+VHXBB27gkHvJa9Y1C6g6fgtQ2i57rQA:t6Xn0uYDza4hjJjyVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635261079, "uuid": "1b7473f9-287c-40c9-b00b-42dc03efdf2c", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635261079, "uuid": "48338dd7-ba97-4819-8653-fb9fb5c775d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261079, "uuid": "663e1d81-d0ed-4a88-af5b-cbd445c24084", "value": "PAYMENT-SWIFTCOPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5ab21e-365d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635253726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253726, "uuid": "cd8ce39c-0a30-4283-88a2-4d7e86e214a1", "comment": "Malware payload", "value": "a86891b68dd1d03fda2074c33dd6deaf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253726, "uuid": "9516bfe4-4d82-4b56-bbc6-4895c21d0129", "comment": "Malware payload", "value": "4d1a2e62c2f1d7d9d7ef0b81152bfcc85d68bac0c7ab13b8ed6d03ae27f3dda0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253726, "uuid": "3a047aae-d200-4690-b6cd-bfd6ddf0f5a2", "comment": "Malware payload", "value": "5cf3701c2ebaff2be0ab2b0e4f65ab6e5d2bcec1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253726, "uuid": "5b8e3e55-cfc3-49c0-be14-7bcca1721334", "comment": "Malware payload", "value": "0febbc2197296b8d267168baac8d325b391608cdb8dc04c9ade8089d6e699d62baec03372867b76b981b7e7f0d1b746f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253726, "uuid": "f342b28c-f74d-4afa-9d0c-9a47b1e36d1d", "value": "T1C04308667A53D94AEA5613364CE2CADA7336FC509F5B47073244B31E1E7A6C0CA0370B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253726, "uuid": "80a5dd01-a626-404a-9259-7a51d22cec82", "value": "1536:IsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0V05bQK/6mqQmMCQN:IhlYkEIuPm3fNRZmbaoFhZhR0cixIHmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253726, "uuid": "10fb1efc-977f-41ec-a212-f547168a437e", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253726, "uuid": "f6f7adc9-71aa-4944-a310-bed6e3ded75e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253726, "uuid": "04c5d274-58bd-43b1-85c5-a551dd1f1318", "value": "MIL0001528419.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4349f8-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635250941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250941, "uuid": "a913b1a1-24ff-4543-a8af-9a88e1821dbd", "comment": "Malware payload (Quakbot)", "value": "756eee7b2465093ecfd0dcb429a1ff1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250941, "uuid": "ba0d2ba1-86fc-48c1-98ad-ceb40edf8fee", "comment": "Malware payload (Quakbot)", "value": "4d4790dcf2f69e649f20284d71b2c98da9b34c3354aca3edb221b8c4af9931b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250941, "uuid": "32b65c5d-d186-4983-b5b4-41d94e04c53f", "comment": "Malware payload (Quakbot)", "value": "c99b80f83325326b87cac8b809e9e684afcccac3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250941, "uuid": "5ea89137-17c7-4930-8268-51c8cd80e9e7", "comment": "Malware payload (Quakbot)", "value": "3eba3930090dfbbb559716e17ee7f97aa8cc4e4939be69be5ef66d5d7c33adac3bc4f626b670e6719ba63b410de19d13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250941, "uuid": "3f86f9d1-562b-4c90-a713-7e479e327c28", "value": "T174F48D103771C436E177123889F6D4E54EAC78214FB0ECDF7284276E0AAB6D2A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250941, "uuid": "cf0342ad-3da4-4b6f-aa9d-42c8f9ba9dda", "value": "d11410e20cbdb2178b72bd1ad82d1ed5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250941, "uuid": "e4f65df5-c140-4963-8e81-a3abad11ff0d", "value": "12288:+RD5ZM4/o2Nmq4twYY32OOHslB0a3yAqSqhwM8PZeMMK3YNs1dxS3Do:+ZB/XPa1HslHHPMMM3sE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250941, "uuid": "a6e056d9-67e9-4547-9f06-0f5c2b03540d", "value": 733950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250941, "uuid": "73f10b50-4794-41cd-b2f1-16407e0c87e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250941, "uuid": "18b98c83-6dfc-4ebd-83c2-1fec12693267", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bdfac3-3626-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635229824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229824, "uuid": "d775d6c7-fd4d-4f0c-92b0-b298e49f8ebc", "comment": "Malware payload", "value": "c66ee3813815c7e9f73455b6a70f2220", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229824, "uuid": "4de55494-27c7-4bad-8083-9de994141386", "comment": "Malware payload", "value": "4d699c03048c59cf28689acfe8abf527734fcc097e4a3ad75cb21689e63490a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229824, "uuid": "37d42129-e919-41fe-82b9-ddcc3ad76b2d", "comment": "Malware payload", "value": "b35cf12b17f23ec38afd622a1b334f51a4a1a912", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229824, "uuid": "10889d92-32e0-475d-8099-725ec8261f82", "comment": "Malware payload", "value": "54fc1ea2bb4a9649f37d7960d5d287b888e58d885c4a689535c6f099afb8fa5c684d33fe9f9a80c663bde1c1395099dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229824, "uuid": "0c0caba8-83e2-4897-8193-3dd02e71af5b", "value": "T1DDB1E52EC73CDA55E948C82CE438BEB82D1583AE2A253DF1310D65A82535B5FCFE4476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229824, "uuid": "40bcdaaa-6cc7-4ef2-85f0-6a303f7106ce", "value": "96:g2+dz8qVsVulmO7UIO1mWO7UI3myA2+rz42+Jz2CHDuCXDWVsVt2NBoMs:IWAmVI8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229824, "uuid": "a8eea4aa-e06a-4d98-9829-28585908be4e", "value": 5188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229824, "uuid": "3d72526b-f5ef-415d-9f7a-fac06bcc16bb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229824, "uuid": "9bc0d650-1310-48ee-b0cf-6e2710e19432", "value": "bypass.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41ae378-362d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635233153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233153, "uuid": "ef00e9d4-8fb4-457e-a651-8372e649902c", "comment": "Malware payload (Formbook)", "value": "0cf0b292ece4583c5ce710c2ca81243b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233153, "uuid": "8e9e26c3-3ef6-4439-8eb5-2c4c158bb47c", "comment": "Malware payload (Formbook)", "value": "4d6d12e951585311015e623e5ec2f97f9b8ab1249d729961a8acd4b5ebc751d6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233153, "uuid": "083904f8-e55c-46a3-97d1-b03e53c2b79c", "comment": "Malware payload (Formbook)", "value": "57e01aa214f8fec2277acd146f3a85fee33d0295", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233153, "uuid": "a6eb3937-38ed-47ae-bd56-d76fe5e8f094", "comment": "Malware payload (Formbook)", "value": "9cf2e9c8895310df43f1d7fd14f8cc497336ff0f5f9c3f75226cd9804124b4af3ff1e4e9c647b9f4ac995d791dc53cfd", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233153, "uuid": "8ab8d0f5-7fc2-43eb-af4c-89c7ef64c694", "value": "T10D442347C109CE8D25D4F7274E896BA9C91A1E0F0D9E4E42CB9D8A42CBD883C575DEB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233153, "uuid": "f5ee7a7c-b03a-44ad-92c9-56764b6b47b4", "value": "6144:QO05vzBjAiL52KvPB1Z9K48Y8vgUqqTMCoN08hs8:QO05vuilLvp1vQ/1oN08hs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233153, "uuid": "eb45171e-e7cd-4f61-b22e-3df782d39605", "value": 255646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233153, "uuid": "3a14b139-f6e9-45bb-a95b-59eeb1f155df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233153, "uuid": "46c426d5-aa98-4a39-ac80-33bb4387dd01", "value": "USD54,884.56_202110260056MT103_0034D.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489a2448-3693-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276674, "uuid": "0a572b66-e329-491b-a229-4fc5c2b1741b", "comment": "Malware payload", "value": "13ef1a65af8b3bf3993204953072c4a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276674, "uuid": "01e64547-6cec-4c65-9418-ed362a5209da", "comment": "Malware payload", "value": "4db7139dddf9e1c15eac1c6512e5cc2909d411d3bf2e2dbe8dad28a319018322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276674, "uuid": "226dc4e3-bd0f-4610-a8ed-a365b99ae136", "comment": "Malware payload", "value": "46848de3411ae08ce33403b30d027561621c4e54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276674, "uuid": "4caf5e37-22e8-4715-8ce3-bcaf21d6e56b", "comment": "Malware payload", "value": "b4e40ec1ac891c27b9fa26b321186c8b73a20ca4d0a2e6dea59cf96e2940864707e7155c787002f2ceeefd51014a89fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276674, "uuid": "d62616d5-258f-4de8-8353-19860b770d35", "value": "T17792CF7C11739CA1CE701439E76949D7535B13F414BE31BB70C8987AD44A95B50FE782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276674, "uuid": "a433ed31-ec5a-4f24-9246-9f03ad19170f", "value": "384:iA5eAWES45g1bJIGFMX5P0Z9CpbXDzJd/JhymdGUop5hO:yGGb/KX5PpbXDzrJs3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276674, "uuid": "904da30b-6cce-43fc-9096-0a10ba2bc585", "value": 19900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276674, "uuid": "1e898686-e380-4ea4-933c-2ff4c59472a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276674, "uuid": "86440ba6-377b-4da1-bcb5-7dae0c4aab4a", "value": "13ef1a65af8b3bf3993204953072c4a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800db7c4-3657-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635250998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250998, "uuid": "a722d343-b761-4f80-9fcb-9bec25c90fe1", "comment": "Malware payload", "value": "5aa159e60ad5abf81d821731a97179e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250998, "uuid": "8eaad02b-8ed3-4659-ad82-80db75bca5b3", "comment": "Malware payload", "value": "4e909266407d90f661b1a2408f61f48ea8d9340024352c769c5003a11c242758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250998, "uuid": "e6a9348f-526b-4426-b849-79425f43742e", "comment": "Malware payload", "value": "46d97e4f219b8256c7396ab8f5b915310579fe7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250998, "uuid": "1029bcf6-f617-4903-a6ff-c9d66d357380", "comment": "Malware payload", "value": "f70b9814923e0f2d8615f78982348cc9c8cf04060b265d1c0d4e023b19f82e10940586361e5ccfbbf488b8b45f3bb36b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250998, "uuid": "ff81ae96-eff0-4659-9d50-f48e1c4fbbc6", "value": "T1D994C59C3650F19FC557C5728A651DA4AA606C7AA30BCA13909336ED9A3CDE7CF840F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250998, "uuid": "fe8e3456-f7c8-42a4-a250-e675a6efa433", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250998, "uuid": "97765bdc-1fa8-4ac4-ad58-082c4f428f45", "value": "6144:eK/SoNYCvLLRsSf0d1EIBVuet1DEpT6YJT6D2onzf:rfY6FsSGBVuet1DEpT6YJT66oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250998, "uuid": "b2f07eab-16e3-45ad-a0c3-6f5a210d02c3", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250998, "uuid": "a614c77f-8653-462e-b999-9be4565e5c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250998, "uuid": "8cb65969-4db1-4a82-8fb4-1bb565c14515", "value": "5aa159e60ad5abf81d821731a97179e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb5ef25-365f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635254535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254535, "uuid": "6637d051-29b9-4492-a1cf-6ca70f9cddaf", "comment": "Malware payload", "value": "868e4c250530b90fd99424e0427de43e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254535, "uuid": "2d1b925f-aaa4-4200-b998-c40a7faef6e4", "comment": "Malware payload", "value": "508973b0475293243c7c83cf2c19087d640fefdb152cba2f2d30dee7ff274494", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254535, "uuid": "2d2f89e1-793f-44f6-9468-9a90637874ee", "comment": "Malware payload", "value": "f771a01cedf7df103832e433c97c98574d408934", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254535, "uuid": "0397a8dc-9a3f-4583-85f9-dac1e8bd0f54", "comment": "Malware payload", "value": "35c42d424d4205e4070ce5ba45281832389d08667ccb4e36ef90089f8a2783c1203da239beccee364f6fb2a57c973c41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254535, "uuid": "e3b1ea1a-aa6a-44d6-b5b2-3acdea14dee6", "value": "T1FEB1172EC73CDA55E948C86CE438BEB82D15836E2A253DF0310D65A82536B1FCFE4476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254535, "uuid": "d9eaae23-7706-4db7-bf8e-ee827f1c1ece", "value": "96:g2+dz8qVsVulmO7UIO1mWO7UI3myA2+rz42+Jz2CHDuCXDWVsVt2NBN/MSq:IWAmVI8nDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635254535, "uuid": "c5370355-1dd9-4c13-a5fe-f18d17a1821c", "value": 5308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635254535, "uuid": "6d2af990-c52b-4778-8221-f2d423337bd5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254535, "uuid": "76d8fe4d-cf19-4b3b-b03e-f936955306b2", "value": "pes2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555e3123-365e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635253932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253932, "uuid": "776dc455-6e0f-47b6-8da3-475f844ec367", "comment": "Malware payload (Loki)", "value": "baa2d491dddd1ce6432a762098e30f9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253932, "uuid": "eacd6cb0-005e-4d0f-bdf4-d5876e5cee97", "comment": "Malware payload (Loki)", "value": "50d78355f6a1009e18d33b8d3511a6d26b5e4145aa8b06ded6484cf8c683499c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253932, "uuid": "d67f34dc-eccc-4447-a337-208ba611876a", "comment": "Malware payload (Loki)", "value": "4d65667ddc802b995a13611af9839605d30f801f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253932, "uuid": "76dae32e-1346-48dd-8b6f-4eae4339327d", "comment": "Malware payload (Loki)", "value": "f913ec1c263c5097742608e40be32e913159b206844e6a7d7eb304d4b3825fb16a096b11d609f342dfba158be6fdf95f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253932, "uuid": "5cc0d6b9-35a2-4ff7-bb3e-9e4967c76cf9", "value": "T16041F01FDED066EC034513AF5B2A700AD5F2EEF5749981055021E4B47DD0239E7FAAB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253932, "uuid": "e52d5238-78b7-4196-8338-ff9a6037ac11", "value": "48:PP/sXE6AwdL2l61OnRxWAiqU0b0rqxfGIiGAltu:3SL2l6snDWLv0ArgfGIwtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253932, "uuid": "ecdb2ccb-e3b7-4adf-b268-7d261d9ef6a0", "value": 2065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253932, "uuid": "843d7117-ca99-4891-8ed8-9a7c9d0fa50a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253932, "uuid": "c5619a45-381d-4424-abe9-c834aac0d49e", "value": "EDLI0963216009.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a4007d-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635262922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262922, "uuid": "58d6b7f1-2f11-46c2-bb3f-a7c80978dff7", "comment": "Malware payload (SnakeKeylogger)", "value": "23d343d37b2f6361bc85785b45a0c0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262922, "uuid": "68a15bbc-3f89-47c6-b287-6afb5442b526", "comment": "Malware payload (SnakeKeylogger)", "value": "511bcecc11b0911f9599f28e8ee51ece06a0565c8fd8202dbd3b4b69cf99cfc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262922, "uuid": "d3e2c407-5799-41dc-92de-b58df438053a", "comment": "Malware payload (SnakeKeylogger)", "value": "d312ff3e8aa0ba385c86b57227d08d3537083e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262922, "uuid": "48b68f8f-cd87-497e-bfaa-33b687d5034e", "comment": "Malware payload (SnakeKeylogger)", "value": "78f88c010cb15a675e002ebf89a21497ac0f54c6a9e8577fdfc29db73d52938d4ab532aefca47c03b7199ad30b65f661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262922, "uuid": "0d69a4d2-f7aa-4c9a-83c8-b3b4889a2ec3", "value": "T1CFE46BA96DCA5911C6498C7CED5220C23E315F11E76698F30E75B9291A3F214C28BEFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262922, "uuid": "c4d9620a-bcf8-4eb8-97d7-8f58a3a17b58", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262922, "uuid": "da3c8ca8-79ee-4f47-9d94-439b35f285c5", "value": "6144:9BlL/r+FbTtKJ6OEmCsP5WgCOBENESF3HB7n98IugUBMoR1PO5EV/BiDOS9lV5Q4:LuTY8OE8wOBq7xHJupBNPbLaQPyHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262922, "uuid": "2c4305e2-9205-4fb1-bc0f-92b228eaeee4", "value": 711030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262922, "uuid": "c4afb509-96c9-473f-83e3-515772e912e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262922, "uuid": "2ef3144a-5cfc-482f-98ca-4c2a1309c3ae", "value": "209865420-06543223456700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089c86f9-366e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635260676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260676, "uuid": "22bf77d8-4e5b-4dc4-b7e7-75af7de26958", "comment": "Malware payload", "value": "cb5a20881c6d390e05314c654fad7b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260676, "uuid": "cd297d9a-8b99-4f3f-9aed-a1e6a4fa5149", "comment": "Malware payload", "value": "51a9d14874b9b6b222b02e55b5b7dba1493a32149a7e65c2a79056a4511d284b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260676, "uuid": "49d3724f-209f-4b40-aaf6-a513e7b0e351", "comment": "Malware payload", "value": "c7f5f7cee8ca6d9addc5b58c1f869b9236cb25e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260676, "uuid": "add5cfd5-61e5-4bae-96c6-67858ef29755", "comment": "Malware payload", "value": "230b17761fda16241259f77d3832b3614911a3cc221ef0422550d7d99f5f89383eb850bd37bb172b86004c77cf70ec8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260676, "uuid": "2051ba12-19ec-47d9-8341-9aa9937fd10f", "value": "T1A383CF3432D0C472C49B38348469DBB21FBC953215A95ECBA7A83E355F343D1667E2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260676, "uuid": "328ade07-86b6-42d8-944f-5333ca55027d", "value": "1536:uS1DZ5Ht86dSv/TGB5Yts/xt3EufNk5n9IaKEFbgKo1Cyg2HOGTfCFfaW:uS1D26a/6BO0fFaOLjHOefC5aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260676, "uuid": "0ed6285a-3d68-43c6-9f76-702fc0b12629", "value": 86566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260676, "uuid": "78a0bd0a-dbf6-4ef6-81e3-eb175fa3514d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260676, "uuid": "bcf933eb-e65c-477e-b470-c380db2548b2", "value": "cb5a20881c6d390e05314c654fad7b2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e653c7d-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635252686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252686, "uuid": "6bbd30f0-cc85-4bc7-b1f2-cb678b30a1b5", "comment": "Malware payload (Formbook)", "value": "475f2d14ded367c48ff4872b8e2847b9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252686, "uuid": "9275d5eb-bb94-4fcf-9489-491080b74d2e", "comment": "Malware payload (Formbook)", "value": "51cab317d94d0905e1d90ace78afb0bf74881cc14120cbdb034b99555ea52685", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252686, "uuid": "3948e8e6-4d61-4d32-8308-8e18928e59c8", "comment": "Malware payload (Formbook)", "value": "b7bb9ba777a4e7506b3c5a5c70c63c1e4e068374", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252686, "uuid": "58ef6967-973a-474f-a84d-517b033197af", "comment": "Malware payload (Formbook)", "value": "1620ba0eb027375c263f225d3069ad41c29d37a64bf0e739da7b8bd22ef0ce6fcfe50ba36f8c19245ba60efd421cf305", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252686, "uuid": "3b33bb57-dcaf-4776-85c1-23f2a0fb098a", "value": "T1ACA47D472B60C88EEC3A73B4DC57B334839957E8D521550549FC9E1EF9A1FC2AC2B889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252686, "uuid": "d01869b2-e65a-47c9-a5d0-0a8b5fb4429c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252686, "uuid": "c3ef5252-9b63-4423-bfe7-7f5824bfcd7f", "value": "12288:IZEv8S888888EB+8888883jVKwrRBnTuoxeW9vJJJwIFNUmY2Wyc2:4ETVVTLxp9NVAmYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252686, "uuid": "ee010559-4749-4d93-b774-60d996675103", "value": 462529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252686, "uuid": "85e0a771-c06d-4bd2-8b99-a296c9165cc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252686, "uuid": "8a4add83-b001-460a-b86b-a2572b10e492", "value": "DHL.DOC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866b601a-365b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635252726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252726, "uuid": "1492f1b9-32e0-48c8-b769-da6c46231160", "comment": "Malware payload", "value": "4e30bc40a8e409c7c97f15e48803c934", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252726, "uuid": "50f4d4e5-cdc7-49f6-b485-dd3f1cd2e82d", "comment": "Malware payload", "value": "52b65e7c2b466f1cc0cad7561145209448614999197a881f0f06dc936ecaa992", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252726, "uuid": "ab47036b-589f-4a45-bf52-a932e52f7073", "comment": "Malware payload", "value": "34c2ccd0074aee240291cddc7e303728db2d282d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252726, "uuid": "6a1984ad-8b7c-44cd-aa1d-c6393ce1bb98", "comment": "Malware payload", "value": "f5d17f9035c79c8aa3122d6746af32b3c149c5384e168fe98ce676424935233a58339eada3c86e04c8844a82618533b2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252726, "uuid": "2a847ddd-7b0b-4e1f-b311-d5ed1e53bf59", "value": "T1D6258D33E3E00877D0233D74BDAF76B998167E113B99C9001AE4AC5A5F782427C7D99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252726, "uuid": "8559d370-ce05-4aef-ae41-da2bebf4ea09", "value": "c408e5d23334aeef4d12e2007ba01029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252726, "uuid": "0cd660b3-3f0a-434e-a419-39117d0c8cea", "value": "24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCco+:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2AD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252726, "uuid": "0b1e8c85-cfb6-4372-89e7-9cde9f8d6a29", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252726, "uuid": "0ba813d4-533c-41a0-8416-07d58bf49d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252726, "uuid": "ec2799fd-914d-4e6d-a884-3db7e1eb18de", "value": "DHL_119040 re\u00e7u,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e29e629-368a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635272952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272952, "uuid": "82660951-b45f-48a9-bb73-40a280ae0260", "comment": "Malware payload", "value": "a31b8975d42aed0d34030f3f49e26f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272952, "uuid": "e4bfa83d-24bf-477e-b41f-b70a9049fd74", "comment": "Malware payload", "value": "546248753ac2ae7b4f4fccd32941bca077c14784ba02e5e6c99f62b40c61071b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272952, "uuid": "987f8e20-0e2b-4e3e-b421-8ca1294e85cf", "comment": "Malware payload", "value": "32d437660cd78a8918894b4f06020ba10174ac68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272952, "uuid": "9b79a200-f62f-449f-9192-a689b23544a7", "comment": "Malware payload", "value": "91ce96436a1ecb24fffa8607142186d1a24956e59f92700b57cf27265747f81f315a95b0ce4b7cabb1f22b9dcc21307b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272952, "uuid": "cca06a27-0bec-420e-8f5c-1edd4603a66a", "value": "T1DD26232762920011D1F1AC3A8937FEE174F692774F81E8FB96D869C51E317E1E2139A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272952, "uuid": "02dd5bfe-a2e2-438e-a414-fe1ba4cbaef1", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272952, "uuid": "3670af93-4e82-4fe4-b03b-5dca1d6c69d2", "value": "98304:yLud++0TqSG3QtaiX2ENKy/RQwBUB53r3Sxz7UQf0D+Gzi2DgTnKzJFL:ZCef426pD+jb4HUQfoDi2DgWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635272952, "uuid": "b1aa42e3-a5db-4050-9cfc-39d3439fc525", "value": 4476416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635272952, "uuid": "7904b965-5692-41aa-a540-6db6a2edc1ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272952, "uuid": "466a6b40-a224-478e-bd5e-e34c559e01fc", "value": "injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83bae35-362d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635233026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233026, "uuid": "7fa47967-dd16-4add-ac40-91253902f908", "comment": "Malware payload", "value": "30a6f72c252425e28dbfd7c071ab0198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233026, "uuid": "93bfa364-7549-463d-a35a-260f505738df", "comment": "Malware payload", "value": "5543373f3598f2faa387928bb40ce2ab8af77e257ca5cf855056cf70de514b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233026, "uuid": "75940823-839e-4314-a3b8-3b1d098c4703", "comment": "Malware payload", "value": "1f958f7615226494e080d4b32f246f17cbffe0de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233026, "uuid": "b7538531-2ee9-4763-96cc-7b11f59e9029", "comment": "Malware payload", "value": "e9be49e6078577b986c8fb4b6ed58c1b4c669b72e78e5ec8a0f51e862c72bafea05a39e51bba822aa0ae469fecde9fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233026, "uuid": "97ecf553-3e14-43fc-8db3-00555586bca9", "value": "T18C95332A76C779E3F03A453456D60604967AA78B8277EC533F0646DB2F0138B16DBF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233026, "uuid": "3f75f341-26cb-4418-a825-6213e9799bd3", "value": "49152:SLkw/nCB8BEr3yNStBnIY6igUiJnvwIALbqwj1ajZM:SowaBUCCNKR6A+vwL/1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233026, "uuid": "21090d26-1e1f-4c4c-aa8d-4bcb81ceb285", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233026, "uuid": "45027bb7-73a4-401c-987f-cdd71d637587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233026, "uuid": "625deda9-2cd0-4815-a908-e473540d2cc9", "value": "30a6f72c252425e28dbfd7c071ab0198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f168c84-3684-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635270350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270350, "uuid": "03fba036-ac34-4381-8168-4dcad9335b2f", "comment": "Malware payload", "value": "ecefcb58a9e50ccfad21f31534c92f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270350, "uuid": "be878b1b-85e9-436b-b323-035583f9036d", "comment": "Malware payload", "value": "55f2f87653261db48c7b8b8d74ca1add082b4f4ab58123d29950a2e04d45dd96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270350, "uuid": "f0497bf2-c438-4880-90b0-806e7a9febfa", "comment": "Malware payload", "value": "448a7034b2b01d7a5746c526ad9d28a79a1c3690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270350, "uuid": "2f8b978b-e9f9-4420-9c23-794d2f6eeff0", "comment": "Malware payload", "value": "fd6d572214e6736c53772b481d7dcea99a83cf95e84060b52b5bdeb381fa10f0f4f7ef5795658a19396f7c745bb03588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270350, "uuid": "60056447-4b4f-422b-bd01-7d5af3309169", "value": "T1C1553A0AB358AFA7E21D5F39C41B596883E58C237331F55F78C46ED661A4F890B1F0A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270350, "uuid": "cd41e86b-2efe-4099-b79e-4e0676937a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270350, "uuid": "3f3b3008-5a59-4282-bd76-0c0acefdfbcc", "value": "12288:z9TjA/xi3Wu5jJvEbFDQ8pr4dCXrmKsr3S5NTA7CJnwd+cjIy6kkzHJnCNwNaScY:+qWu5lvEbFDQUqaSC5dAMnOSIkz0zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635270350, "uuid": "4cf7befc-f967-4282-bbef-6da104215f91", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635270350, "uuid": "c0ef7d4d-27a6-49eb-8e50-bdb20c9ee476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270350, "uuid": "512ca391-e3fa-4bea-be5f-956f37843fb6", "value": "NewOrderPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43975fa2-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635233287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233287, "uuid": "6de23e5c-21b9-4db6-a05d-8e570544d600", "comment": "Malware payload (Formbook)", "value": "e98b3b25eb0f4f6e14a8b09ba517e340", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233287, "uuid": "ee288c02-ec97-4319-a723-870b536aa2d6", "comment": "Malware payload (Formbook)", "value": "55f6c8498be7ffc9b2b17673cb0033a75ee242d78b8bb36e13e849648ad2e912", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233287, "uuid": "727d27e7-efe0-4e84-9172-676801768d8c", "comment": "Malware payload (Formbook)", "value": "45ca2ddb8494faa931d666c14779a60dda902a3d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233287, "uuid": "f9ecd4be-8ecc-4844-be2c-4665f1f286ed", "comment": "Malware payload (Formbook)", "value": "8683c9e65c9a327c15fba45af0ec796d27ce390c7f86f292888dc95d694f0c04ff15298ac1193fc09dd1f47953b271d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233287, "uuid": "9e87f292-adbe-45b2-9ddf-044ed5266b29", "value": "T1436423BD9F4A052F8B41170A182F41C7572BAF00B8AA55DE7A347087FDD3B2E4D158AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233287, "uuid": "77938815-891c-41f6-bb89-98fc510e59ea", "value": "6144:+yTUfL33b4t+ybwSaen/566rwjRVsLul5UY7CaAqExmx70Xj:+yOL33b4UOwSaG/566MjRVo8DAwx7Ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233287, "uuid": "b8ad95d4-de1b-41a5-9262-3a0ff26c288f", "value": 311284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233287, "uuid": "dc80d317-38a2-4ad9-834f-d66892b75658", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233287, "uuid": "3d513c4b-21d6-42cf-97e7-62751ddf57a8", "value": "OS-QTN-0320-21-Rev1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ff1fbd-3676-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635264511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264511, "uuid": "1fd1cf4a-a7e7-46b1-b253-068ec7da39a4", "comment": "Malware payload", "value": "d3ef1254da2482d61ac735778912ce0b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264511, "uuid": "a68c0a75-033d-4d88-816d-fd27fcb590e5", "comment": "Malware payload", "value": "5662974190d5814d40e789fa944a8e7879337460b7980b2a37cc48f686053530", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264511, "uuid": "985d089e-50c9-4221-952d-a58d60731f6f", "comment": "Malware payload", "value": "8b99f4f8af4384474285a576a8ac0226f92b39a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264511, "uuid": "0a001a34-6293-4d57-b81c-7cb936ef62ea", "comment": "Malware payload", "value": "07f8a8f621dcafe853dcb186afbb7b0c9bdcfc739d762bdfb0c716626a5e798a4711c0f775259485503bda0591578bba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264511, "uuid": "a51b3605-1ed9-490c-8d52-b26680e7ee51", "value": "T1A162C5E356C028F902648ED9F7F1C122D2939A35140DCC31F6AC99AF2F4A06FB515BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264511, "uuid": "58038c2f-97d3-451d-be70-326afd1383d4", "value": "384:E0XjblW/wiU3w3wApFOO3ozAwiU3wg6FOgwiU3wgNjOx6cUWINg1sodX6MX:E0XjBIwiU3w3wAp0O3eAwiU3wg60gwiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635264511, "uuid": "091cb5ca-1d77-470f-b2f1-6a33ea799696", "value": 15108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635264511, "uuid": "174e6beb-4d09-47fa-b7d0-e9c919d1a11d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264511, "uuid": "4d7cf652-ad73-4b47-a2c8-01be137eff9d", "value": "injection", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2122ef49-364c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635246114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246114, "uuid": "f9815681-8933-42d0-b527-cbbdeae587f8", "comment": "Malware payload (Formbook)", "value": "1ab67b4ee011c1d0e1093c9d1f7bf5e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246114, "uuid": "37850264-59ef-4ac3-a70b-2d67354da185", "comment": "Malware payload (Formbook)", "value": "567a5fef6b29e55518559e2020951d873a53a73f14feb8e58d9fe746e9f2161b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246114, "uuid": "705ba0b7-6991-42e4-9f62-9ab3ee6f1b26", "comment": "Malware payload (Formbook)", "value": "34d79d3275f079f283afde12fb01a7ed50370c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246114, "uuid": "609e8f3b-ae0c-45eb-864c-4567bcf99321", "comment": "Malware payload (Formbook)", "value": "72653b8cb519f89b8292adefc58d9102dcb5e59074fba20b3462a7aac77e5b7cca61ad26de10a0e3ece59e584b2d346e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246114, "uuid": "9f30413d-1a54-4f51-b772-5079c789a0e0", "value": "T122257C6272D20472C1333EB97C9E72BA98257E217FF8E9025BE4EC191FB5341752909B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246114, "uuid": "eec0b3e7-c1af-44c5-9f20-ce915f520b07", "value": "c408e5d23334aeef4d12e2007ba01029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246114, "uuid": "1ed3e702-6d9b-43d7-b34b-899de82e9398", "value": "24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCco9:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635246114, "uuid": "5c22d6ac-1b1e-486c-bd00-86950a6ebfc4", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635246114, "uuid": "05c8815e-e3f2-4006-8b1c-3c04fcc2fb15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246114, "uuid": "a5fefd6d-91d8-4eeb-83bb-29f32427cd20", "value": "PO_PSLP20201201LASPRX36214 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e35c96-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251541, "uuid": "67674f3b-cd1e-4490-8f2e-9e38ff345675", "comment": "Malware payload", "value": "c97dbf0ab4fd4320811ecc4014e3b608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251541, "uuid": "c562a7fd-fd91-4a47-968a-0f192986d37f", "comment": "Malware payload", "value": "56e4f127f991f0ff867fc403eb857ee685c3c4b67c52695d5b8194e085aa1502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251541, "uuid": "eec5627c-e5f1-4c17-985a-f40b779d9125", "comment": "Malware payload", "value": "e4d4b106a5249bebe19b98c79cda8faf272b2e7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251541, "uuid": "856bacda-09e2-40b5-980e-8e77a927c792", "comment": "Malware payload", "value": "30adb6107942110dfba8a851132948063bb66a725ae41c5c6f820ac3f16ad1af9df478bf1ac4cf53f0f48f2bb12195d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251541, "uuid": "6f47a2aa-24a8-4485-8c06-4edaaeb2d5b2", "value": "T1D18192A7EA689D3AC05710352F72072577B683B724814B5BEFBC08F6DF06D82694B20C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251541, "uuid": "cfad78bc-c6ad-411e-acd7-f35109988d0c", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251541, "uuid": "2bf6cf90-cb75-49c6-bab3-09093f877d8a", "value": "48:6x9+ZQWcJ6wfc9y9uzkAmNdhtdtnZv8B13aLlzUR:NZQVAw09y9KYdr/Zkv3aLlYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251541, "uuid": "4a63e430-4f69-4343-986b-f7d5f31c7fbc", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251541, "uuid": "0c2dbd1d-a0e2-4d49-9697-4df536dd63b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251541, "uuid": "a930b396-29f3-4c59-8298-7fa9d7859ea7", "value": "c97dbf0ab4fd4320811ecc4014e3b608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911136f1-3692-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276366, "uuid": "c49a8779-d9c7-4d2b-92e6-d340fe89dbaf", "comment": "Malware payload", "value": "8f0808adbb577e37765155ce603934a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276366, "uuid": "65a2d45e-fdd7-42e0-a64b-be49b3178cb5", "comment": "Malware payload", "value": "577375f683f330fa8d520f0c70dcdc193f8127c2e01b98f8b023b8924e3ca522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276366, "uuid": "4fb27e7e-b50a-45ac-b030-7ac40547827c", "comment": "Malware payload", "value": "592c20ccda6ea2b1644b58db3831a9b91c1e5ce0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276366, "uuid": "5124e3ca-9bd2-422c-9a20-2339d0a65a8c", "comment": "Malware payload", "value": "cc473c8275564ade286d2dad1f483f701da19cbfcf02f28aae21accbf8a513adf2ac2c44bcc9c60f0bb1e0f17b6a4726", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276366, "uuid": "5bb90c10-aa41-4f93-9b10-2dba28878436", "value": "T1C6C2C090A513FA75C57928BAD6AC54873A40177DC0BFB85162619BB82ECB48313FD8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276366, "uuid": "b6b4807c-6846-4914-acf4-873ce851c496", "value": "768:OWN02LBP4v0yLq3R646ccujlkV9q3UELOY:pBEx0R64plkoLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276366, "uuid": "5776ed78-4f4c-4479-aa05-9386e52ded71", "value": 25784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276366, "uuid": "7d94dde9-faaf-4edc-b626-f4d31865882c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276366, "uuid": "ee89844f-1ac7-4caa-93f0-1d3c29debc15", "value": "8f0808adbb577e37765155ce603934a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f7072f-3637-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635237257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237257, "uuid": "195dc0d8-0f33-41c2-9dc6-8e63f535b297", "comment": "Malware payload (SnakeKeylogger)", "value": "48dc52974227afb0ed574c1c063638cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237257, "uuid": "024173cc-aa4d-4ef9-89fe-3e923390f7d0", "comment": "Malware payload (SnakeKeylogger)", "value": "578ac9d85bb3fde96a2df67c4f7ac1f56c51da774848157c550809bae42f5c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237257, "uuid": "e6898377-2e2f-442b-b3c1-341189211f29", "comment": "Malware payload (SnakeKeylogger)", "value": "1c4a7f814d766904f7dc84e48164a04669d02001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237257, "uuid": "2b1a17c8-e637-4942-ae63-3b2e1391f9c5", "comment": "Malware payload (SnakeKeylogger)", "value": "0ec59c9a82357ce5658d4421d31d2e52b77872f47a6607e2b81396e966e69edf7f7585dfc72e555b59401f4dc56d1d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237257, "uuid": "51f916c7-b4f0-4fd8-baf3-a4437248706a", "value": "T153B4F11CF2A1D0A6C80983B06826C1F16BD17931685597C73EBBFBEE0DF45527A7E062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237257, "uuid": "694fbdb2-3284-4d40-a845-eccc6b5cf1c5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237257, "uuid": "6330669d-471a-4ce6-8f7e-f5842512380f", "value": "6144:hBlL/Il55PMvDW4Y35rssBEOHBy2mud8khVbDXJldltrYSRjJwFyrWnr7D5Ruq:n+1Ur2lBJBBOkhVnJ7ltkqZ6rnjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237257, "uuid": "c01c0566-531e-4f92-b2ba-ea36dce6ee5b", "value": 519132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237257, "uuid": "172bb96c-fece-44cb-8ebf-db9c64a129df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237257, "uuid": "f0896b0a-4fbb-4e1f-904a-45cb57216d0f", "value": "20987654234567890987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d363ed31-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635263163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263163, "uuid": "ac2eddce-255b-4f01-911e-fa3b65861e4f", "comment": "Malware payload (AgentTesla)", "value": "302c8294c151f8cc018dbfe00211db8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263163, "uuid": "3a7a9318-a0be-4f2c-9c68-dc2efde0ffdd", "comment": "Malware payload (AgentTesla)", "value": "59a95c64df0146fb56dd13b25582965034ca1d9687b1a878af06d0e628b60683", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263163, "uuid": "340f7718-0265-4d2c-a222-46838686bb79", "comment": "Malware payload (AgentTesla)", "value": "e5657ec350c929f3435d791d645edadfaaa2ce99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263163, "uuid": "bf98dd20-2b6f-4eb1-a2bb-b2224a29e7a1", "comment": "Malware payload (AgentTesla)", "value": "f0fd092b5a002acf16431ea60442ccdc1db204710fc3130136fab2edc7fa13cf973edbbd6ebc587646ebdd1618f2a810", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263163, "uuid": "19c15678-4905-4600-a12c-810273fdc71d", "value": "T1C1C18D91F70C968CCB301E7C9CAAED9B5E9D94266D83F146302463101C593ED2F1FA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263163, "uuid": "99a59076-3cd5-4fc5-b949-9de338888c68", "value": "96:E7XwkNP1j2alEizu4hvDQH2xyPsScY543xCjtbXJFyf2duNVQXaof2NVX:E7XHPsNiiE+qyEkSxQtef0fXaF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263163, "uuid": "d76cde77-a3e1-4dce-adc9-aaed2217a49e", "value": 6117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263163, "uuid": "22e2d15a-14a8-494e-b65e-7dec8e790ddf", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263163, "uuid": "bc9e1e1c-17d0-44d5-96fb-15247547c017", "value": "DAMAGE CONTAINER.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388b025c-363a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635238422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238422, "uuid": "0c609b52-7d64-4e63-9e65-ece9ac58c7c4", "comment": "Malware payload (Loki)", "value": "7a91aa44c119e8888fd7e13af5dac76d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238422, "uuid": "c64f3c81-f22e-4b59-847a-bbe359d88537", "comment": "Malware payload (Loki)", "value": "5d065d9de6445769c8dc3880aae8a552532e6f893a8ea25b100961de37eb0c27", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238422, "uuid": "6a1db4e0-b00c-470d-b811-41247045a9a8", "comment": "Malware payload (Loki)", "value": "f90cfe2fdd653d3319cc2e90f1803bd4eda40026", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238422, "uuid": "2d5b5737-0521-44e4-82e3-7133a95e1a70", "comment": "Malware payload (Loki)", "value": "9823efced4ad033947d39dccdb9e9b565233e5c6abbace294090186b5277c6fdbc4a92c452e42d38f5b0cb512b829a05", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238422, "uuid": "c225a13d-da03-45f3-8a40-b648fc6a98d0", "value": "T180A4E182FA644FCBCE452DF488D5822790264DBC5F7DE0511B9AF7846BB86F1EE1089C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238422, "uuid": "11e99818-bac9-4e4e-b9fe-9ba36b22daa1", "value": "6144:+urG58jpMemTMjHvqsw8CX5Gn2eDetl+WopxS8+vPxmMk+KQEtYWBvvIT:5ppM9TSvsRADeJML+vJw+KRYWBvv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238422, "uuid": "577264f1-6778-4d21-8819-12ecfcc5b80d", "value": 451304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238422, "uuid": "64599181-1557-4655-9c02-c7f4fc345edb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238422, "uuid": "4c737d6d-9561-4a0d-adc5-d662e9dd8622", "value": "Payment Notification_New Expert.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbab5390-3642-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635242132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242132, "uuid": "d7354716-7c5c-4560-bc02-01288df8feb1", "comment": "Malware payload (AsyncRAT)", "value": "5edb28a841737db933bb282e67552281", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242132, "uuid": "c68090a5-d25b-4850-b835-45916ec6ca23", "comment": "Malware payload (AsyncRAT)", "value": "5d646368153b1186cef48e420d1022e9de2338af960ec27c9ce84efa01843ece", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242132, "uuid": "033bc800-95ee-4674-ab21-450f50d3207d", "comment": "Malware payload (AsyncRAT)", "value": "a2b508d11e0ede754608b5b09bce9aab1584bee7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242132, "uuid": "a5334757-e6b1-4b39-b6f0-9938590770f8", "comment": "Malware payload (AsyncRAT)", "value": "edb2361407c430cec631000c2bffc95d5d054a973f240e2ba12c5158467787afda4d9a4f2da53116b5a38f3933581e6b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242132, "uuid": "645367ed-b85f-4872-acb0-8a59e2ba7713", "value": "T1FE1402495AF9E734EEFF0FBDF4611815237493803492EB7E194061BB2EA3342C199A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242132, "uuid": "20d59060-9e9e-41d8-bd28-d19e9340b755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242132, "uuid": "4e0ab53e-e285-4efa-8849-5716ffe91c65", "value": "6144:Xk5YBIDxWwRnIhmAq2lxwxsWXRm6bMvBh9vow8f:YYCncmAq2lxe/BmhBh9Aw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242132, "uuid": "9179e35a-cc16-469f-a3ab-64eebcd0ae22", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242132, "uuid": "522ce0d3-c626-4f71-bb4d-2fee41492d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242132, "uuid": "a888bca3-23fc-4d13-9e97-7d17f6cc1f3e", "value": "Confirmation Transfer Copy MT102-Ref-0001030101_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d250671-365e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635253838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253838, "uuid": "7fbd8a60-2fae-4b67-ad86-811d8a58d890", "comment": "Malware payload (AsyncRAT)", "value": "2773fd27af8fa39f2248e9031f7629c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253838, "uuid": "5af4227f-a304-4851-aea5-d9ecd31b498f", "comment": "Malware payload (AsyncRAT)", "value": "5dd5699d2c2fbf3d3f5b876bf9fdcfddc91233b9bf47303363ba778e210dd344", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253838, "uuid": "37868322-174b-4667-8e4f-d20eb2a68559", "comment": "Malware payload (AsyncRAT)", "value": "d23b3cde39f40e60cc41f49adfe9cf3c74e766ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253838, "uuid": "bc7400da-7002-4eba-afc4-8f8c913636d9", "comment": "Malware payload (AsyncRAT)", "value": "be25daf468990069e3600bd8745fc6234359a80b511432cbb393d7dcfb1590d4fce4b1559d6e944bf2ef760cf3a9ce7a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253838, "uuid": "a8d8f69f-f8ab-404a-9556-54a7b1cb0a20", "value": "T123F0552FE81FEAE30E226917F1E6913E463140C20B94C97D9153839D4B358763E2547E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253838, "uuid": "43b5beba-a3a7-4be0-bd6d-ac648a4c1ba8", "value": "12:TaVLMUVb9wCJhIgmVeljehfMWUBAzdqsH3dLG1GCXg0TC:mV4UvXrp+fMWPndS5QcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253838, "uuid": "d16f0b4e-e504-470a-a9f6-e81ede92bc10", "value": 559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253838, "uuid": "239267f1-838a-47ca-a62e-28e59446d297", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253838, "uuid": "a74d0ec7-bd64-45dc-9eed-759bd3054600", "value": "HFSDSRHGEDS.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d70cc44-3657-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635250966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250966, "uuid": "3be629ac-f2e2-4da5-a0d6-8c1575710c59", "comment": "Malware payload", "value": "0b840b3b10b37c746ff725a72b81ccc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250966, "uuid": "f4127ebc-68e1-4668-910f-a23d2c0289ab", "comment": "Malware payload", "value": "5eacbec88fa0bf9472d36c532d96b01181b9d0526093847701faf29b1d1f03f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250966, "uuid": "88ae7ba9-b8bc-41a9-8d66-dc46e241abda", "comment": "Malware payload", "value": "be278a972bc3ab3be67789771ceb137cb488ac3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250966, "uuid": "762cf6d9-f5c8-4b36-82c6-ca3d14788eba", "comment": "Malware payload", "value": "5e3476e0f64abaa5aec1e2819ef0d048148ee35750d7e4e55c6769d3c7b88353f172d2268d525d9e794221fe59cedb47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250966, "uuid": "2af5736c-7ba8-4bd0-b138-f0e692b5d4b3", "value": "T16964928C7261F19FCC27C47689A83CA4AE912D76870B8747B41732AD9A3D997CF105F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250966, "uuid": "5da83bc2-7fb9-46d4-9d09-7db80ada8d2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250966, "uuid": "ae2a6a09-daa9-4d2e-96cc-c866d4316fc6", "value": "6144:1tum8v+EDgEvM03Tk0bIdvMAMuF59C1u:f8v+EDgEvM03TqfMa9uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250966, "uuid": "201803f2-cac0-41be-85f5-26b627bd5834", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250966, "uuid": "c5caaca8-7103-4066-a530-6c8b377453d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250966, "uuid": "045250be-0404-464b-a89c-11359c88e3fe", "value": "0b840b3b10b37c746ff725a72b81ccc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a4738f-3659-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635251651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251651, "uuid": "141858e5-8525-4a58-904e-77ec9ab6391a", "comment": "Malware payload (Formbook)", "value": "353b88ef182a879a18111d827df5f10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251651, "uuid": "39ebf571-d168-4433-b212-9238ec8549cf", "comment": "Malware payload (Formbook)", "value": "5f474b40c8bd056549cbf8b574f80bf8198d53f29bdb3ee5eb21db0700b71f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251651, "uuid": "ab4e8fd2-5363-4c7b-9914-8409c1c6749d", "comment": "Malware payload (Formbook)", "value": "bd9ca55653edda3cd9948b36598271fb89ac5f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251651, "uuid": "15d7cd4b-7c44-4678-89ef-1b99f321f664", "comment": "Malware payload (Formbook)", "value": "8a1a82d5a954e7565904556bf244112fff29c2dd830add6ca8261ab2c2d05025541c79303a600d66e3db0b57a9eae520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251651, "uuid": "b5da8ce4-3168-43be-8e67-835f7c3ff2c8", "value": "T1B184DF8C3A94B2DFC917CD7699981C24F6606477530BD347B15322ADAA0EAABCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251651, "uuid": "2e4771b7-fe9f-42c5-a981-12b8ee17da04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251651, "uuid": "3a976ab3-afe5-4083-a214-83eb1128c0e4", "value": "6144:0DjW304b7lKG5GGW3zDUCeJ0h3DBE4AZ/EU9eFyZebHVpF4Dae:0XatAcuh3FbK9eFyZenF4Dae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251651, "uuid": "46e36be7-d5af-42c8-b559-22b1b82ecf24", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251651, "uuid": "61f4b761-ee50-4307-99bb-0e1275714a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251651, "uuid": "35c12604-30a5-485a-9698-38829a733641", "value": "Order of CB-15GL PO530_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceab5808-361b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635225360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225360, "uuid": "5c3cb558-4f39-4732-9378-83b29ed5e64c", "comment": "Malware payload (RedLineStealer)", "value": "a69fd26cb9d1bc4955ed27b20107e29f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225360, "uuid": "0de0f43c-7b51-4461-95e9-dd2d9b714b6d", "comment": "Malware payload (RedLineStealer)", "value": "5fc1a999fafa73e4daf0c7c2bcc5d513610af6afe2fc46396975d577cfac87bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225360, "uuid": "e1b354c9-17b0-4835-bebb-b3703cf6cab6", "comment": "Malware payload (RedLineStealer)", "value": "a9fe44e8fef8b944f6e5e6e9b7c4373ca95f7920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225360, "uuid": "58d5899a-f996-45a6-aeea-942bc733998b", "comment": "Malware payload (RedLineStealer)", "value": "bfd3fa1cfaa535a11eb74b761322210a2e3f695acc096c056f2d6f2025c04eb08f13f6a1aa9db127ec6497b02f34aad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225360, "uuid": "d0e8ae80-78af-4272-9f04-753d1b1d6097", "value": "T1A7053B86F0B3608EDFA3B8790B0195E14A420E7E5B119EF46F75B95A15F36D18ACB303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225360, "uuid": "41449773-89b9-4cf7-9bcd-c8dd5b5da647", "value": "682b88463c7583e0323d7851be5034d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225360, "uuid": "02159ace-d95f-41b9-9773-1c24bf7ee501", "value": "12288:FTMUkd0co/nGF0OhO7qL0sKKAa8fZ73/8ci573Tmnh4zeisok/35QTgpqRD0:hI0L+p4sKhZbYTqh4Ki1w5QmWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635225360, "uuid": "b5670114-0c08-4ae5-9571-5ea8bc2ac926", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635225360, "uuid": "7edffe27-83df-4082-b15b-f60c6c74624e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225360, "uuid": "b97daf35-2115-4774-a2c7-6587bb734c29", "value": "a69fd26cb9d1bc4955ed27b20107e29f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b15377-3637-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635237320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237320, "uuid": "55ea5f27-9eb6-4c4a-b819-464e3033bd46", "comment": "Malware payload", "value": "348e46112e0aa9789d7fcd58f1341cb4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237320, "uuid": "466449ca-9480-4110-9d89-f823bf8a3b61", "comment": "Malware payload", "value": "601bb366b3a928942a881856cf553928854a1083d7018720a295d76fd51f3032", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237320, "uuid": "c5cb4b71-4674-43b2-83e7-2799a90633ae", "comment": "Malware payload", "value": "48559e89718ecd26582c3ea28307e811ecb8441d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237320, "uuid": "eaf55fba-cdcb-41b7-83fc-c156c515ae9c", "comment": "Malware payload", "value": "a1db81b02b79c84f0f2621a8f108090e4dfb656f81025f4e2a196ce744127e1a9668741f3e95d74b467ec85986eee903", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237320, "uuid": "387fb2e2-61c8-4039-a3c3-267cf8c1c510", "value": "T1E3B58E12F2D34537D1731B388D5B93699839BE502E38A84B2BE93D4C5F396813D292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237320, "uuid": "40aa630f-7f6f-44a0-afda-4802ee6af5c0", "value": "24576:HSpe5GYMfchXGgThayIW5ALx5IOxAnNEcY8bRNB7s0swUW/6in06O4brDeTU+1Ep:HS8GY2OWLhxwNEc/R35SGraTP13A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237320, "uuid": "f986db2f-4db2-4a34-9c55-69f6d0f3cf57", "value": 2377216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237320, "uuid": "727f93a0-082c-437c-9cbb-97307e070799", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237320, "uuid": "55c017bf-cabc-4daa-b680-e2d2da53986b", "value": "FacturaEndeFecha25102021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7791861-3620-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635227549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227549, "uuid": "b2a014d2-5f53-4ba0-b118-f1b39a620d53", "comment": "Malware payload (RaccoonStealer)", "value": "0d5d12f687657bbb91fa3dd4a6a1ed1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227549, "uuid": "00aa5b8e-4a71-4ec0-ab18-215bd0ceeb4d", "comment": "Malware payload (RaccoonStealer)", "value": "60be570850bb79ce77947842eddbe861c41be9d38e9ea8ba7fb8db8f4022075b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227549, "uuid": "ae4ad3eb-3ff8-4953-abd3-18a6286156be", "comment": "Malware payload (RaccoonStealer)", "value": "8ac068be9c2156a3e45bd9b60154302ad0fe220d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635227549, "uuid": "4bd9c33d-d25a-402b-a56c-dedf42a869d7", "comment": "Malware payload (RaccoonStealer)", "value": "1798ab8a58e18d901a6cca108b7082329203bc6c44bd9bc0656d3bf3c8dff068bb6991445857004e20d9f6a9f8fc5f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227549, "uuid": "5cdd9e7e-2299-4576-a9f6-8917ff860042", "value": "T1E5362362617001AAD0F2CC398A37BEB531F9176A4B466CBEBF997EC418119E1E313D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227549, "uuid": "11b14f5f-647e-45c7-a222-7025424298c8", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227549, "uuid": "3f0259a4-34e5-47ce-816e-84527d2bf581", "value": "98304:b7nc+d59bEZWKLmmr1c0UEw7s9AXY18M7W+fRXfnK12XAYK:8+f93Ymmhji7s9AXYrzfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635227549, "uuid": "6ccc92fa-b6e4-43d2-a9b4-c87e6d54a802", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635227549, "uuid": "880838d3-197a-447f-b714-a76fc060b3cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635227549, "uuid": "1bf2dc31-7110-4919-beba-079b914f7b08", "value": "AutoSetupYouTube.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cc6258-3685-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635270850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270850, "uuid": "d40c1c4a-e3e0-4fe3-8925-7424e6240dc2", "comment": "Malware payload", "value": "c90cd0959b85a3fe5fac84fa72e84522", "object_relation": "md5", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270850, "uuid": "adfdfd71-b40b-452e-bc39-e77c1c54e9b7", "comment": "Malware payload", "value": "60cd7c5e5b52883344c76f96120e96ba81d2a597c670d5864f25987fd0b67582", "object_relation": "sha256", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270850, "uuid": "b37f34d1-a286-45ff-9da2-b1f95efda787", "comment": "Malware payload", "value": "03f39b28afab37130d1eff21543176565738ceb9", "object_relation": "sha1", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635270850, "uuid": "9cf3c031-1df3-4586-b836-19394a5b104e", "comment": "Malware payload", "value": "82f946a20a2569ad677b4fc059ea5d5045fceb229d052260862323236979a8a69a6f7cda3d9c19a6315e680102d3b50f", "object_relation": "sha3-384", "Tag": [ { "name": ".XLSB", "colour": "#CD7F8F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270850, "uuid": "0e447341-0809-454f-b0ca-17a8c78074cd", "value": "T1A96412F0E9273FB9D60F18BDD3D9E49CD586D48E0126150779CA62A09CC3AD7397CA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270850, "uuid": "a49c9d82-55cf-42ff-a85c-1289810b23d1", "value": "6144:WG0fZOsznJtInItdbbGIzPy6uYYPis8+Fhv7G1MTIahzvjC08xY3g1Fu:WGcwszJtuEGIby6uYYPNFRGKx6xhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635270850, "uuid": "d7344a1a-3f07-4b6d-914b-cd0216e79661", "value": 332034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635270850, "uuid": "040c9883-5734-4284-8866-f9433e384213", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635270850, "uuid": "a0846f26-113b-478a-b948-ef961407faad", "value": "start_presentation[2021.10.21_22-01].xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41db3979-364c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635246169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246169, "uuid": "0c6e1b05-fcb6-4b89-b8e6-7440be4ba0e3", "comment": "Malware payload (Formbook)", "value": "0281f169cc3936c70570a2b6af0875c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246169, "uuid": "ae3fafba-f0c1-410c-9ae3-3864c6a1ab7d", "comment": "Malware payload (Formbook)", "value": "60f929f6d1333f24d1a53d62b81f538e10e12e4e3d8dc2e9481ab06e3355322d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246169, "uuid": "cfa82a77-8702-47b0-8433-0e23aa94ea49", "comment": "Malware payload (Formbook)", "value": "e2a0a0d5acc843e906d2f5e5a6638c40fbc0a29c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246169, "uuid": "5a5e8f9f-41e2-4c5b-8ed5-d0a7ebf8fc52", "comment": "Malware payload (Formbook)", "value": "6f55b36b492dd3b9b49aad7cec0fb89b37576251a5a07eeb24707bd418a4eac3085c1c65b1c2cc3e5ba8bbe2c98e0fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246169, "uuid": "f46c09d8-d73f-4bd6-87e9-a8a14e9aca8b", "value": "T170E4D08AF94459A0CD699334193BCC755723BDBEB834944E10E9BA6B3FB7783102B817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246169, "uuid": "59c33ccb-8af6-4219-9d87-617e2a242c11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246169, "uuid": "8554031f-7bf6-4d36-9c36-b5b54f2cdf3f", "value": "12288:HuH83cpGd439HA4PjBtP7zy3wO8RqwBfpV0WrIQg4JJKYpFL1ggzbL:3KK43G+dN7zw8qOVVMQhDFeQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635246169, "uuid": "9fadaa4a-72ca-4e10-8a39-644d9373cd9f", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635246169, "uuid": "1fbe511d-b118-418b-a30e-96eddee0ebbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246169, "uuid": "09eaadc8-c485-483e-a552-8dde921ac699", "value": "HIC INTERNATIONAL - REQUEST FOR QUOTATION DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e91e20-3660-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635254650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254650, "uuid": "0890d736-fd7d-4725-926e-5de51dd6100e", "comment": "Malware payload", "value": "ea745643308b3a8f137dd58b91303f7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254650, "uuid": "e7df7d1a-b2e6-473c-812e-784827e752f6", "comment": "Malware payload", "value": "6272c20115a66e3843db83c4f999a5729527c5d2a678f3d7aef83757a724159c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254650, "uuid": "23440ce7-b4cc-4f09-878d-d045c40c2ac3", "comment": "Malware payload", "value": "4a7f31418e6c3fa5153601dca1f73212c60d2ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254650, "uuid": "fc6bcd39-db75-4dbd-a725-07c66b3bc6a1", "comment": "Malware payload", "value": "4d4d45111a5f5e0aafccb8992f90af579ad4949b3b22e70f6776de3d8dd8377c140e1acd475c8976453dd201a3215827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254650, "uuid": "d36f4f0d-f2c0-420b-a8d8-364c469c35c5", "value": "T15224CF210DC4A462C760D43AB2C6D63B917B6C738780E882FF49FE933690A56CB1FB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254650, "uuid": "3e37a236-a090-4bf2-9573-ddac17d1c264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254650, "uuid": "c579fabf-db35-46e8-8665-c9868558ddd7", "value": "3072:63Xm9Wa8dLXefepMO0P3Is9N9bERtTHI0+Kx9CbnR/Jx1:MmkZRD0PLNhwTd+gCbnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635254650, "uuid": "d3879af9-e067-490c-b265-f5fefc03ad55", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635254650, "uuid": "86dafd95-2711-4436-a7ff-fc26e2b329d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254650, "uuid": "c22c8c0e-bf14-40f9-add1-ab8fbc0f48f1", "value": "ea745643308b3a8f137dd58b91303f7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb1f969-3674-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263345, "uuid": "09a5fd7a-abdd-477f-aac4-22c58b820aa2", "comment": "Malware payload", "value": "fe8f45ce0bea8fd5ff117457c2abbfc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263345, "uuid": "9792f710-b385-490a-bd81-592056a6463b", "comment": "Malware payload", "value": "62b59047bb95293921419b1711da347791456aa112d96108be944e8ebe802b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263345, "uuid": "0237c43f-3ac3-41db-a03a-323b8b3bf258", "comment": "Malware payload", "value": "83f84fb0076f571c9bcbb15d9d804a203934bceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263345, "uuid": "e1ecc3fc-7b50-4e3e-b47a-cc1cb5c55021", "comment": "Malware payload", "value": "480e46731e08033e22c466f417ffc3cc311a5e7764392a3ccbdb18bfc8e0b105015ae450d362cf74d1a7042842592c83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263345, "uuid": "d6b347e9-d3f7-4e20-b62c-216e0f5c4bf8", "value": "T1D4D40257396ACD07C3AD6F3A647082013BB1BC761912E35E38C8399E097F7D44D396AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263345, "uuid": "0f4bd144-9bca-4edd-82d0-9be334e3f85d", "value": "12288:JANTdXQBp9LbKV16MeEDyW89RQWQgZ8Wp:iTdXQBjSeEDyWwLQOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263345, "uuid": "87d20f28-250c-4858-82b8-7d0bcf8487ab", "value": 602038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263345, "uuid": "7358560b-3a42-4aad-b4e7-a45e4e5a6e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263345, "uuid": "1b56ce25-a8b0-42c6-b231-0cf67c6639a7", "value": "fe8f45ce0bea8fd5ff117457c2abbfc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02588247-3643-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635242197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242197, "uuid": "0e74f874-dfdb-4d98-8069-3390e506d108", "comment": "Malware payload (Loki)", "value": "c30565830025332db48b9f38ddb2ab3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242197, "uuid": "93bdd6d0-b913-46fb-8a9e-e1910ca3bf10", "comment": "Malware payload (Loki)", "value": "63302fc8ec38235750576f3a3c2e0566cd3392074d0a56aeb466e5c8611aeabd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242197, "uuid": "d97d137f-1f66-47a1-86ed-7479a086b8c6", "comment": "Malware payload (Loki)", "value": "63219e001fc7baada4d0168d2b64dbb73dfdcd3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242197, "uuid": "7ebf6b77-cc4e-4808-9590-26e49fa7ad55", "comment": "Malware payload (Loki)", "value": "e0730146c99f5803f12d511ec5b0b9e50544581ea44f2a7e1e8d6f2ba22e2c158f124abce29f03feefa2e9628e794e75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242197, "uuid": "d7b103b7-2b3f-4f14-b7fd-ff26876693ad", "value": "T1FB44029D5AF4E221EEFEA7B2D47210190378F0113126F7DA2E45529B1F7F70580B3A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242197, "uuid": "48739007-5032-4c86-9587-3520c1425280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242197, "uuid": "43bc547f-ddee-4642-856c-5c48760daff3", "value": "6144:tinUVAMk80nmnINxvy0WBiBc6vyj8y4jKznn1pFNX6:4R8Imqy0QiBcejj+1pFNX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242197, "uuid": "7e4cb642-2c7b-4383-b0d9-a9798a48cb82", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242197, "uuid": "55588989-1475-4b33-be32-5b4a28bc4cd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242197, "uuid": "c123b0f3-0fe9-458b-bd56-3440dd8d1160", "value": "c30565830025332db48b9f38ddb2ab3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913af8de-35f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635208506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208506, "uuid": "834ab2ac-46f7-435b-bdba-f1efe7c98330", "comment": "Malware payload (Mirai)", "value": "e2fb3aff35db4095fec074029218b603", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208506, "uuid": "0e78d5cf-88b0-4fdf-8488-e006c2d8a14d", "comment": "Malware payload (Mirai)", "value": "63473c4f7460e03264030ecb655e2367e1fa6090b4d4ca83f79aaf49a85d2985", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208506, "uuid": "e6ea4516-a7fb-4101-958d-96d98dbfd540", "comment": "Malware payload (Mirai)", "value": "71fcc344fdf2764614f77dcb36cac08c311c90d7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208506, "uuid": "da0981c7-4d08-4157-a495-0642fe34fb8d", "comment": "Malware payload (Mirai)", "value": "69c03bd222b8958e5e62675c861ea1e4e781d6723989a73225a47e210bfc14525b7e2cd134c446c2bd388b376b489cd1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208506, "uuid": "b698adc7-d365-472d-b27f-5f755d3bcb2d", "value": "T1B133280BA58181FCC599C17443FBB53AC876787E0239B1DA7BC8FF176D85E605E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208506, "uuid": "ea441cce-7e4b-44fd-9a8e-546190f0755f", "value": "768:j7s093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7We0E1rjWb57Vn7TOngg:M0937QAe6CAQiWexKg1BZ1rs7Vn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635208506, "uuid": "7f4e60b2-082d-4834-870a-1f9ed5eb4f03", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635208506, "uuid": "fc2db02a-0f44-49d1-aab2-1fe5dff93159", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208506, "uuid": "7931d650-8725-4630-8bb4-93bd576b1869", "value": "e2fb3aff35db4095fec074029218b603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c85e68e-361c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635225463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225463, "uuid": "5ee696e9-5a82-4027-9694-555d6e1b8eef", "comment": "Malware payload (SnakeKeylogger)", "value": "69249d4df7fd94e6b3239110d0fc9baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225463, "uuid": "103673e3-a011-4517-97bc-bd9937419cba", "comment": "Malware payload (SnakeKeylogger)", "value": "6460f6edf1b9f4547b701a252347f715c3424c58381a82dc2a6ea53eb373c182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225463, "uuid": "f9dc4fd4-fa32-4dce-89e6-ba6d1ff3f3ab", "comment": "Malware payload (SnakeKeylogger)", "value": "7afe46eacff89fea4b23ef0f49af7b196ba13f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225463, "uuid": "34cc8f49-e92c-4b10-85df-30cf026d3e65", "comment": "Malware payload (SnakeKeylogger)", "value": "ef9e0196e0042830144fd94707554b3830407e1819deafb7b24dac966a760de49b44a910f8043e700f021c2bb9096e77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225463, "uuid": "2a6c9b52-8695-4df3-98e0-e03cfe004ac2", "value": "T19F5412694BF8D332EAFA0BB97441100453BA72613D13FB9D6E50B2D9BEB77064353889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225463, "uuid": "d68b84f7-06d5-4463-b564-31bc6308aab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225463, "uuid": "7b72e8b3-2f2c-4f65-99cb-7dc2a8b96b64", "value": "6144:oD2acRa4ixvlyzziSm1l+3N6guUYxoM9F:e46NyzzijlBVUQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635225463, "uuid": "e1b37946-0827-4cb1-a5c8-f0a20a0c26dc", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635225463, "uuid": "f8140146-eefa-4e67-949e-f2fd795c031c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225463, "uuid": "127e2cae-00ad-4787-b03e-747251f96f3d", "value": "Shipping invoice&packinglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5a5cf8-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "0af1f00e-b332-4f32-9142-013e6b5c7ddf", "comment": "Malware payload", "value": "25f68703b3c4cafe28763f3b0252a263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "1bce3b75-c262-4b30-96ca-62fef999562a", "comment": "Malware payload", "value": "646b3b060413acc9710f72c0d7356cc4806189874403dde1af180f1eaea03a78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "e1a522f5-65fc-474a-ba9f-ba42c7da6ad5", "comment": "Malware payload", "value": "7450e4cdeefd91e7296aa7726a153fa544c40176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "30eeccaa-f9c8-40a5-8053-d0eab5dca794", "comment": "Malware payload", "value": "e38a802dec0a80b770302efcd3c5037066afd4292477448f6ad61bfc0ac5b5dde5168dca5e26dead37dfc949f8f95c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "57382a9f-1b2b-43bf-90cf-b79213f4bd25", "value": "T1AB9533265E385D59C599AD3677E5B60F9C78B108580638CF6A23CAD030120F867FBAF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "5301a761-f844-4632-9c23-e9a70644f0fc", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "20e10df2-d762-4003-93c2-aad8e0672d69", "value": "49152:0aNiF720mrXFn17AYpDtuF1mfQsemNu2OvXjAPB2F2AjmoPFdfy+66:C20mrjAYpDtuDjmNuH7A5hcrQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251530, "uuid": "e7a62d42-8f47-4694-931e-2e88c23cad05", "value": 2042880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251530, "uuid": "12cc1222-4b6c-4ecb-ab0f-082e52d7a6f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "7ad89512-6334-4718-87f8-c77fad47d5e5", "value": "25f68703b3c4cafe28763f3b0252a263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78256c53-3645-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635243253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243253, "uuid": "ee377008-3e2e-407d-b411-f20b2ce6098b", "comment": "Malware payload (Smoke Loader)", "value": "5b37f8513ace1f30fdb1c1dd50cc7d1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243253, "uuid": "d75b3142-38a6-4d87-886d-9727425b8099", "comment": "Malware payload (Smoke Loader)", "value": "649c27ade517aa8c4a85d43cb8f5b40b8543c0305bc110eedb08dc70ec758738", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243253, "uuid": "126909ae-680e-4d61-960d-3ee69b20a2cc", "comment": "Malware payload (Smoke Loader)", "value": "23ce9df2f291db9191ef249cf18a9edc1e566f05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243253, "uuid": "63d0956c-acc3-40fd-9b76-3efceca5f917", "comment": "Malware payload (Smoke Loader)", "value": "6f95df569975604a1de861f72da12a34e0da573e3a703ef0ef2bb9f34111010c167c7af82e783f885490e9efac1f5635", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243253, "uuid": "3e93cb4c-8c77-435a-b6c1-9d66bdecbcea", "value": "T1B024BF1032D0E477C7BA0571886DCAE1567ABCE3D97D414B2FE7362E2E70290592E37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243253, "uuid": "002131e8-528b-4db6-a29d-cf50027b805a", "value": "a756627435b382dc3646987f64d479a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243253, "uuid": "56fffd79-3ecc-4c30-b62b-a1c1754e8531", "value": "3072:H/6VpSsTY4cnn41JiQeV+29Zy6jujDzqJPkBNmcjTDTSuG2veuVMO6P2+BwvHJ3/:yVNTYxn4DijH9Z8jDz7Njc2veynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635243253, "uuid": "d7fb11bb-fa84-4f18-ab53-139b1d87e4d7", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635243253, "uuid": "36e813b6-2069-43f5-838b-cfa345e7e566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243253, "uuid": "ae98750b-b652-4219-9e55-85970835aaed", "value": "5b37f8513ace1f30fdb1c1dd50cc7d1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d75e40-363a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635238681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238681, "uuid": "9a524ace-441b-427d-95a5-fb71904bc9c7", "comment": "Malware payload (Formbook)", "value": "23425ac1b705c8df5532996726932b5a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238681, "uuid": "52e7538f-a45f-435e-bc4a-39e39d42b650", "comment": "Malware payload (Formbook)", "value": "65a490fdf8eab2cf5a97addd4ce7b35d48d13e7bded25ab782f52cb1f8d89d08", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238681, "uuid": "25339906-7fff-48d4-b790-975758e8c397", "comment": "Malware payload (Formbook)", "value": "d961cf102219841147ad11e057def216bbd2fe84", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238681, "uuid": "e09ba906-a41d-4eb7-99cd-ee4736fb100b", "comment": "Malware payload (Formbook)", "value": "b270312086fdb90782024a408b646967925558156ced2acf050dde460dd5964ba23f7b0cddb0085eacae96869a5e20ae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238681, "uuid": "7b50e296-d514-4981-ab2f-8d66a11ebe88", "value": "T1E574CFDEA6924D9FFF65D4F8D12D0D86A7B65C088702E001AE12F25E253907E91EF12B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238681, "uuid": "fcf8d87e-e500-459f-b5ee-b995fcafc32d", "value": "6144:wYjAdmnyibRWtfAnm7lcYVgoZ/cdNVpF4lNLgU6kDJDdElzrmthw0m4BjLb:QDqRWtYtYvKmlNEU6kxeR6w0RL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238681, "uuid": "28980bb4-1cb4-4142-ab2e-2b92336b270d", "value": 350104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238681, "uuid": "7c1ca64e-6f41-40b3-87df-1272bbec1404", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238681, "uuid": "f55907a4-d1b0-4ba6-9e40-bb85123dfec6", "value": "Amended Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85999399-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635253584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253584, "uuid": "55965d1a-57d5-4490-a73f-ebd85783e0a8", "comment": "Malware payload (Formbook)", "value": "a1c481bb9474e04781840009a3c10664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253584, "uuid": "025b7c8f-2936-437c-83a0-1bde721f53d4", "comment": "Malware payload (Formbook)", "value": "68aba64ef9b4e5af747005ea8efdd213a80e86e45e9b4f480a54af016e3c6c95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253584, "uuid": "19b36661-09c7-4174-af14-c10d40aeb3e0", "comment": "Malware payload (Formbook)", "value": "c432b71a2f493e7c7a120d42d41bf7e4de2053f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253584, "uuid": "3f762e3c-c2fa-4c73-8fc7-0671a5d1266c", "comment": "Malware payload (Formbook)", "value": "72d12633a01c89ee4619aa98fa006db31325227cbc9a983a1e0a96481af4b963da83dd8791135cfb8dde33039a80a2b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253584, "uuid": "dce7d685-9913-4c06-ace7-0830f71ff693", "value": "T1EC44122672D588EFC18347B25C72A6D9D736C39C6160870B53A4AF7EAE2C9CB8703117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253584, "uuid": "fb9eeddf-604d-490f-beaf-3fad73bff2e0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253584, "uuid": "c16bad72-7414-4c7c-9a05-a3108b080849", "value": "6144:wBlL/cn5CnbglA3LLH5llsSebCn7y4wbtZL4Z6cDvjMqujTHV2R1:Cen5tk/H5llsSebGO4wn4en/gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253584, "uuid": "14a6dd0a-9dac-43f8-93cc-f49f56b8ab5b", "value": 260929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253584, "uuid": "ac8e97c0-3a1b-4734-a24e-beb5c2620c84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253584, "uuid": "779e2b0e-0f2f-4788-9eb9-4df81a20f38b", "value": "payment advice_16000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acac9bdb-366f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635261380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261380, "uuid": "2c3678f3-461e-45b6-8cc9-bd10493d7cf4", "comment": "Malware payload (RedLineStealer)", "value": "8b6d1d742c069f530f923a20306f1c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261380, "uuid": "03f7be02-3ee7-4d75-a8ab-2cefe72ca9d7", "comment": "Malware payload (RedLineStealer)", "value": "6ab053ef6e1c83d1a8ed6a293b0d19f5cbb0f0f4b033614deda9e767b0147200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261380, "uuid": "36ea884c-c9a4-4bbd-90a6-0ddbeebe21c5", "comment": "Malware payload (RedLineStealer)", "value": "83450ebd52a96b826b17c7af7aa779f1088728a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635261380, "uuid": "4690d9ec-92bd-420c-bb86-8dbb15d757a4", "comment": "Malware payload (RedLineStealer)", "value": "7089924a72546bba62d08211f872644a832e556f8b49335b28ed533b1d4709ca632faab4f591ea05d4b427a204e88c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261380, "uuid": "f9b89fbe-086c-4bc8-92a1-8b2304b38e31", "value": "T1B104BF0072D0F672D5B645314875CAF14BABFCE3DA3C894B3387365EAE71E809A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261380, "uuid": "0ece2ec0-2dc6-48ba-8aa4-31d8168f9b46", "value": "fa148d0c70a978454538a9c9c0513fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261380, "uuid": "fcdfd238-56bd-4a81-86f2-64fff2e20ad2", "value": "3072:GBdiMmCHgvC6AHxj2wOXQt0JIMQdH/IyuVMO6P2+BwvHJ3/RA:QdiaHgvCvHxKwY5QV/RynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635261380, "uuid": "d2ebe7ab-3a88-4f65-be4f-bf42d09e6270", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635261380, "uuid": "7c96b8f5-3e14-4511-9a6c-2a5618febec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635261380, "uuid": "6b7990c4-a2d2-4e34-b6a9-8bfc67c76da8", "value": "8b6d1d742c069f530f923a20306f1c3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9695569f-366a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635259196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259196, "uuid": "5dd666c8-bc76-4965-849e-22e38ed5a337", "comment": "Malware payload (Formbook)", "value": "83a00ad620a300149c0f6b9c3791f821", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259196, "uuid": "0e716675-8cf2-48f6-8d88-15df8ab99f52", "comment": "Malware payload (Formbook)", "value": "6b808cf78989a505d346c7a9e3d8d571cec2c21fe0ef9b3c1f5e04bbad6be3c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259196, "uuid": "ea03dc26-6d7a-469e-8212-6a9857e98583", "comment": "Malware payload (Formbook)", "value": "6d557f2743fb7ea5f75ffa211c645bded1305dce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259196, "uuid": "c4122688-d707-4961-80ec-3d88f667b992", "comment": "Malware payload (Formbook)", "value": "41b2d128f941e887b93d49f53e1a439160e5b65bf46f62187b4a53b23ab9d145c7a8dafa1fd4f4a571e9692a28a64c3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259196, "uuid": "1351a29a-93be-4a48-b6ce-fe3979df8599", "value": "T104442326E2D150FBE44B4FB11EBE5325EABDB7001730B5EF6354CE76162B1C6692A203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259196, "uuid": "88bc8b7c-a920-4acd-bbe6-a9b8bdf4bd19", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259196, "uuid": "3c688f7b-11fb-4149-9d6c-0b01aa1a4c9d", "value": "6144:wBlL/cYS4hxXUfJhB88MaqxdxW/hqdhwBDeXJhSRk4Qw:CeKEr4xdxWZNceRk4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259196, "uuid": "c01e9a84-f1ab-496f-9092-cb4bb01ca14b", "value": 261674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259196, "uuid": "7afd72aa-66c2-4bdf-9606-c36ce92351c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259196, "uuid": "84e37642-ebc7-4d45-8599-8222ec8a237a", "value": "83a00ad620a300149c0f6b9c3791f821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d80e70-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635233389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233389, "uuid": "a4bcf401-03a7-451d-a672-7c7051af363e", "comment": "Malware payload (AgentTesla)", "value": "f8f556291f188343fb61560420999421", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233389, "uuid": "0c2ef9f6-e55c-40a5-8ea8-7ecad39c8802", "comment": "Malware payload (AgentTesla)", "value": "6be7eafa1607a79407e43bdfa79164b18f4e9ab3c95684b7d54e7395e74407b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233389, "uuid": "129f48b9-4171-4738-941e-42dc6dee23f1", "comment": "Malware payload (AgentTesla)", "value": "f02d71cc246cbf11a8e14929a24fca83c927f2ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233389, "uuid": "7e9bbf4f-0d2e-4c13-a0fb-d5012b08a87e", "comment": "Malware payload (AgentTesla)", "value": "59d2b4827eb3493df3a7593074f76cc0ba711bd23056c18f51fff3805c9579a369e080271191bb69c81d912256a3974a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233389, "uuid": "32bcd861-0924-4321-9397-0bca5d4b8d49", "value": "T10474220FC6BFC673F4F55131A8045E282C45BFC828C7B8B84129E6D892ECEB46C1861B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233389, "uuid": "0d5d63aa-caa4-4c7c-9e01-3dd9e20e7004", "value": "6144:AUcfpaSDv1kI2L8mn5Yf6VhRI2BhOUOs4WiT8QUAhjaT5D2xKwqyeaR7Do:Av8quH55ZL5gWZZbTd2beQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233389, "uuid": "972a7afb-e9db-4880-83cf-60203d9f37c2", "value": 342159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233389, "uuid": "60ad14e4-c5fd-4741-a367-7f86a9d0aa6e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233389, "uuid": "3bc4e833-02c9-4490-a81d-4dd7a5da345c", "value": "Lebanon Khayat Trading Company.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7664cd0b-3627-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635230365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230365, "uuid": "7571de0a-041a-472c-a911-bfccf54e7b46", "comment": "Malware payload (NanoCore)", "value": "5e43ecd7972ed7e8810c6249411d9b22", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230365, "uuid": "74704609-85c2-4844-bdcd-1c5ad8c81638", "comment": "Malware payload (NanoCore)", "value": "6c7c8b5aa8a3f0e067ae9e55f33b3e7d3b772e441cd8585fdadaa72561e5c6ed", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230365, "uuid": "08f5eb65-4eb4-41e6-9791-fc244d05530e", "comment": "Malware payload (NanoCore)", "value": "ada2026907aa0099abb395d02795ba6a16e2de03", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230365, "uuid": "959677f9-d3be-48fd-a6ed-e2c0926015bd", "comment": "Malware payload (NanoCore)", "value": "6ce2c442319160b110099fea1b1127f5d99c567238cfc674bb1720763bd7326b32d55e28abd51197ad05a7c310ec842c", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230365, "uuid": "a4eb6742-29bb-4ef0-809b-86a42fe0bc39", "value": "T1AAE533D02284E634A50C12F2381787E663D3D74570DA63DD61AAE73AE0FE6378B74786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230365, "uuid": "1c45ca50-41a2-4679-85b4-cf484358b709", "value": "49152:w0ZcBMs/KvsjMOQB8wkXDGroUg4IsYKtwEIebNuyBeHFtkiXQg8flFwiCEYd+jXl:hukvO4YOdrxBtBICNu3TPsflbu+rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230365, "uuid": "42ac2b57-3aaf-4281-b438-12bf6c3f22c1", "value": 3198366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230365, "uuid": "fe3d1e44-0c4c-4de0-8e0c-5f935ac77ec2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230365, "uuid": "598b8f41-fd05-4c52-ac6e-8445b7fbeaa5", "value": "credit notification pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a0eea6-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635252883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252883, "uuid": "a15b5a5d-f72d-4edc-bd4d-9644a2512a59", "comment": "Malware payload (Quakbot)", "value": "b34551496a7754456ed9c2ee18332299", "object_relation": "md5", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252883, "uuid": "534a0285-b429-4522-8452-b8cecffe3552", "comment": "Malware payload (Quakbot)", "value": "6ca376cd53db43cc7781db3e03782ab28213ed722a52e0d38927d3aba516d9b6", "object_relation": "sha256", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252883, "uuid": "fedca0f2-d23d-4d01-8903-f843098697da", "comment": "Malware payload (Quakbot)", "value": "96c5c422004450e392dd7f0552df8e17ab0167e3", "object_relation": "sha1", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252883, "uuid": "ff8e90a7-952e-4388-ad78-e749ac99f501", "comment": "Malware payload (Quakbot)", "value": "dd697c19d99ac9a5ff62a935c8aac2a01ad336e4635f8ad91f6bc08f0d2d243c0588ea27473bce09788f14effd7cd96d", "object_relation": "sha3-384", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252883, "uuid": "1bc6febc-54d0-4e6c-9f52-de68791b0147", "value": "T120D4015672D8CB6BE58717389DD5CACA7722FC209F6B8A033049731E5D3ABA09D03716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252883, "uuid": "12a8f72c-711d-4b9e-b8ef-cb621c244dca", "value": "12288:VGJ/Y8SUbfbInMMRDKoUEu/x9z1EsjOxKJRQgiFMSVmW0XfJ:8JAQD0aEuDz7jO+hiFMfW0XfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252883, "uuid": "1da34380-c41e-4c7c-9c86-3d1e8ac249d8", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252883, "uuid": "29882234-bb6f-463a-aac5-f469f116883b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252883, "uuid": "f7f56e50-68ed-4041-b623-37c800cb3506", "value": "REF-556824694-Oct-26.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e1b0c0-3693-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276945, "uuid": "e4a47763-f8a0-4c6c-a040-badaba150485", "comment": "Malware payload", "value": "9823539bf5abaf8e99d5bd302095a339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276945, "uuid": "2d75be0e-02bf-4fa3-87a3-c9449fb0a159", "comment": "Malware payload", "value": "6cd0b31875869bf752394a9cfe9a70defd0df6ac988898bfe5dc3871b5bce231", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276945, "uuid": "4c677150-70f8-4a8c-8369-f33b85b90575", "comment": "Malware payload", "value": "62ff7eb5d3c09ef7c1bfa989bbd529e95ead125c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276945, "uuid": "07817b2c-5e71-43bf-8fc9-dcb75e6db520", "comment": "Malware payload", "value": "761a31c7fd34d16bec75368b9a05827941c5a289d43a3a83da9a77f2b91fe25e2c5bf24bac3f0123f78f9a7ef258d939", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276945, "uuid": "3670016f-d46f-440d-86c6-50a2208838d1", "value": "T1BFD2D175E7277C76D9E12C32AF10498375B0DFBCA0797EB73548425C88BA14B6ABE002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276945, "uuid": "0fdf39de-4579-4346-b989-5ec34bc39025", "value": "768:XG+oSAkYnCJW5PAjz6So49deiC/aH3LJLcBBkX9q3UELs:XsDkYnG1zZHeisc3eBjLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276945, "uuid": "3e1316c9-33b8-4499-a4f4-72a7c0a3677b", "value": 30340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276945, "uuid": "d51e5b80-d3e4-4813-8fc4-480c0aef036f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276945, "uuid": "9f9154da-62ff-4f02-9245-a174c47776c2", "value": "9823539bf5abaf8e99d5bd302095a339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642c97e9-3671-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635262118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262118, "uuid": "011091c9-5295-44e8-b58d-d19581c9b181", "comment": "Malware payload", "value": "9de2f0442c62e69236a22d85f0520e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262118, "uuid": "f398a060-713b-46af-ab5a-c3bacf23faed", "comment": "Malware payload", "value": "6d52f1e3076f2b2d9bc1b796d2c0279e951ff18dd7d0a8924425ec9345ee67ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262118, "uuid": "47cf7cb4-14cd-40cb-9fa4-886297455a50", "comment": "Malware payload", "value": "3c3e370f51c51d389968a69ff6f3e2cc8d9a6ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262118, "uuid": "8f2541d0-8616-4deb-bae9-d11075fed1ea", "comment": "Malware payload", "value": "a89324ca1f41216b34039c143acb777ed940db48739cc4b569e5e848943b679fc9284c61860c66f13ee32a918c528fd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262118, "uuid": "62d769fa-48df-4080-be4d-14ce4aac4544", "value": "T1A5130814BE95CD03C26A4FBE8460A01056B1E8632B57F78BBCC436ED165B3ED091A7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262118, "uuid": "3eadbe25-cfe3-4e4d-8b8f-bd1bf62b3e62", "value": "768:I2FGfb1GxEJHjkTXvTwWA+Z/VkYT2aui9Js+2++8od/9HdLAI1uLy8pcH:FFob1XIvTlwbVi9G+2+Kz+I1qx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262118, "uuid": "b8609f63-5e14-4480-acba-a1ced3fa545a", "value": 43110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262118, "uuid": "9ab37c04-eb25-49bf-aa51-9a583d499267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262118, "uuid": "1201e673-4e98-4258-93b2-37749c28ea80", "value": "9de2f0442c62e69236a22d85f0520e90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4748eed-3637-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635237315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237315, "uuid": "323a43a2-6129-42e9-9c46-a37e259ac95f", "comment": "Malware payload", "value": "e70ae1d6ad88c6091057f7666a4838cf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237315, "uuid": "0bf1111f-be4e-48f4-95d7-099a71fc51b6", "comment": "Malware payload", "value": "6e4073421c32c6e59f2e074543f38908c2300596f40d8320c7377c95ac58a616", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237315, "uuid": "b749f805-d9b5-44b2-9a80-38929e16e273", "comment": "Malware payload", "value": "d6b6d60ad992ce22028081c6bab072b02034cd4a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237315, "uuid": "11d7a7c5-1f63-45cf-9e46-b2e078d4df23", "comment": "Malware payload", "value": "bfec4b0ad2fede2362b64dde1eeb82418cddd45da7f265f0493f00dc5dc9b809963081450b16295c5c6dddc99bdd9a0a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237315, "uuid": "d6f7c837-d68d-42cd-bfcb-0236558d5ec5", "value": "T19BB59F12F1C28537D1732A398D5B5369D839BE102E38A85B3BE43D4C9F3A6817D292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237315, "uuid": "69178eb9-98fd-4d39-9166-3afa6a35fc09", "value": "24576:yrNaV0MO6dW5A/rwAWn6eYfwuS7+Bpw4+m1CJx80IGbOqNaracgTU+Befe5GYrAR:yrCwBn6eYflBLobbTPfGYr3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237315, "uuid": "86c91a09-26f1-4d8b-8542-c55d127d532d", "value": 2492416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237315, "uuid": "8267a8b7-a55a-47da-9fd8-38e6812c8099", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237315, "uuid": "463e01cf-0074-4023-9406-837431e91b0e", "value": "_slvnrtyngkhwjmtdwdfblealkxpdunzrdbkle.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9494f758-3692-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276372, "uuid": "e6915b49-3be1-4e7f-a238-be7bf9c3c722", "comment": "Malware payload", "value": "9dc0548ea1a6659699e37cb5f853bcd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276372, "uuid": "084d7167-f150-4b65-9f2f-f4c8f18592fc", "comment": "Malware payload", "value": "6e5e595a928355efd2b3e4c74e7e40fafe0247689a4f4e50f8ac9b88078a950f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276372, "uuid": "8159aed1-dd09-4351-af02-396633294884", "comment": "Malware payload", "value": "c365f4760a6b8457033d2d5fd13c1556db9993b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276372, "uuid": "3c4e2855-ff3d-4c7f-a9e6-3c4f7d8efa25", "comment": "Malware payload", "value": "94e1a9d5ecebd4232d6503420e36df2b00749533f364fb2b32d6741017469f242fc0245907f2c0ffbee500d4878ad2dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276372, "uuid": "991646ac-d364-48aa-8c24-e5a419a29555", "value": "T185A2D071853DB924C5B14C323FBA4043BA921EF9F1F0707D465051B8BDE2A46DABCAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276372, "uuid": "fa1ca5c1-51eb-4eb9-97c0-17e28ad362c5", "value": "384:e/8tx0QfY608l/3S5ICBejmdmKqPszeGBLKNX0PgqRJRhymdGUop5hL0:e/qOQgry/EIzVXPsiCVoQ7s3UozN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276372, "uuid": "c109b177-db97-4dad-a742-26f79c65bf1e", "value": 21344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276372, "uuid": "7677a559-12df-4bac-b695-9f8d8080650d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276372, "uuid": "ceaf0734-672a-446e-8651-dde59e7e6b60", "value": "9dc0548ea1a6659699e37cb5f853bcd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19366cf-3671-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635262355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262355, "uuid": "939b36ac-1e7e-4488-a024-e3f4e0253dcd", "comment": "Malware payload (TrickBot)", "value": "104f28b29d17c4cfe17e516a49ed0f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262355, "uuid": "f662da14-4f06-4bc4-b7fd-cb414e27a008", "comment": "Malware payload (TrickBot)", "value": "6f761ec9553b07f28b3c11c481fdc1da6113d4f301639de8d29e8f01cc574d9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262355, "uuid": "1d135b51-ae8a-4a3b-96f5-411cd3428949", "comment": "Malware payload (TrickBot)", "value": "e5457fc87347d68dfe08ff1ed9220cb9f95cabc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262355, "uuid": "eacb2f6e-7656-41f3-8a5f-cfced0330279", "comment": "Malware payload (TrickBot)", "value": "59cc5fff6aaea4ed27f22341e5e4a68aab9604e1b2ff6767d9ac9bfacafd9cf0bbad8e8b16915b54e8f1311f08eca9e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262355, "uuid": "2daee21a-ccdf-4d26-b3f6-ef781b02e16f", "value": "T109E4CF26F3A180FAD5F206360FE76727F2FAFF20493686431B967B5D4C349114A2671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262355, "uuid": "10d1a6b9-6212-48d7-8e86-280140ec739c", "value": "542db7e97024de0354d3af3fe3180ab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262355, "uuid": "5d0e27ed-0050-42d3-a347-56e08241f351", "value": "12288:wCupqS2vN+nx4pnKluq2NAyBZNdaTwhb3rAc9FAVc7g:zS2v6irnfZb3rAM+kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262355, "uuid": "b08c1113-5542-4b47-a505-5a2fc34d4efa", "value": 679979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262355, "uuid": "f30b285e-cc0f-4768-a8fb-d7fe4eeabeb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262355, "uuid": "d999671a-09e1-4a90-9245-26e25b046948", "value": "104f28b29d17c4cfe17e516a49ed0f4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946646e7-35f2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635207652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207652, "uuid": "2ba1c728-6d7a-4ccc-b1d6-f139b85e658b", "comment": "Malware payload (Formbook)", "value": "0a509e3ea3c1d1a6a778c6a4fd2f2c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207652, "uuid": "f084ac08-71eb-426a-9581-beef7a79be41", "comment": "Malware payload (Formbook)", "value": "6fd5c640f4c1e434978fdc59a8ec191134b7155217c84845ea6a313aecf25bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207652, "uuid": "a023b75b-16f7-4087-9870-bd98728d3392", "comment": "Malware payload (Formbook)", "value": "e04dc2a139d40b078542f35d18fbf8771f6fb38f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207652, "uuid": "0b7031cd-deef-450a-9027-2252860b4cd5", "comment": "Malware payload (Formbook)", "value": "6ef089e9687a091c74d73784f8b7667c9b2d21a723ff7f7d7c303a8f50195eea26d7d8108af4950398f42fdd6f6a8d47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207652, "uuid": "43cdec86-014c-4807-98d7-c62f78f03e63", "value": "T1206633109EA2D0D0D643A779BBD6728E0CAAF50DD66CA6114B189BCC399FE3DCD5C0E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207652, "uuid": "cfc93e33-f5d3-48d1-95b2-04768a99aed1", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207652, "uuid": "01507951-5476-400e-94a8-0d0792180b7e", "value": "196608:ypmr8XvO6VdB+Cqlu1bgp1aej05sX1wYe4SMeCS6ufoT3A:ydXvJVX+Cop1a02KC497YwTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635207652, "uuid": "498c010e-57e9-4a49-844a-8cedd717355b", "value": 6592210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635207652, "uuid": "a72d118a-4dce-4782-95b1-96a9d8c8b6a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207652, "uuid": "f9a2ee14-ab3c-47d8-a1a0-46b9812dccdc", "value": "6FD5C640F4C1E434978FDC59A8EC191134B7155217C84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452e1e56-3693-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276669, "uuid": "ea66704c-bee4-480b-bcf0-8e2d9c65aa38", "comment": "Malware payload", "value": "ae80f32ab7dac7fb5b4dc25fce3766bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276669, "uuid": "78742477-5b43-476d-ab66-6f4a342dff52", "comment": "Malware payload", "value": "70b7b25a2568e71aa0dff75eac3da2d30a978a89c110d17bd2ab743231c9f2a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276669, "uuid": "c53439de-7332-4669-90d6-7d76415ad802", "comment": "Malware payload", "value": "103315cf684f46747db9592be86a471d6531d057", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276669, "uuid": "c7db66f3-0d68-46b5-b398-0741f269bd24", "comment": "Malware payload", "value": "b8397465e55996d86f3f5119496f8ef57c1a3cc8aed017e397cd6aab43924ce7e22abfdd2c37aa0ed5cc4189daf33cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276669, "uuid": "674728b1-b2f0-4f13-bdfd-efb7f8e7ca0f", "value": "T17182D0354DBE950AFAC9927EB34F9EC5B866DDC14F09F0CA628EA614A85200DC70BD70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276669, "uuid": "c060d2c3-7c63-4c38-81d6-d4201f9331de", "value": "384:Mj7Sg6SJZ1tBiTtDEZvyRuzKItzmPz90ao7GwwsPE4lVLv1RD:Vg3v4YZ8IWz9rBwzc4lVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276669, "uuid": "0f4d96da-309e-42f3-8063-75fc4194f944", "value": 18868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276669, "uuid": "501a51d7-8dd6-43ff-9e23-35854e4b18f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276669, "uuid": "98db2719-75a8-45a0-a55d-4b00b074d945", "value": "ae80f32ab7dac7fb5b4dc25fce3766bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0d4c52-3658-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1635251531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251531, "uuid": "7b19dbeb-dbe1-4624-82d2-b351cff72fcf", "comment": "Malware payload (OskiStealer)", "value": "aa8389c34cb620485eb8dd8a85c0f8ab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251531, "uuid": "fc523431-82db-4d35-8fb6-78b5563b4d96", "comment": "Malware payload (OskiStealer)", "value": "72eaa8de39509cc335820bb9220ecf6f08b77f72613c2baac86328fee8d49e05", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251531, "uuid": "35a4af51-4b9e-4543-9be4-06078a84f368", "comment": "Malware payload (OskiStealer)", "value": "203af430cd573268320c7c696a7731c60f1c6820", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251531, "uuid": "1d067c14-9213-4dab-abaa-4a9493a99691", "comment": "Malware payload (OskiStealer)", "value": "21aef88742251cc5e9970afbe0b3724a1144e26883d25f51951a5672706d4c2fa44a8cf0188c5967df2ca06c4741bc66", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251531, "uuid": "a31798c5-4650-49cb-b7aa-9adfc67a3322", "value": "T1C7948EDCD8A189E4CBCECADA49197F9510637A79C9C36C5A4428B3F80FD367F4A1AC50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251531, "uuid": "a14bae62-96d4-4146-b0c1-c05847bdc637", "value": "6144:McHyQR2wRkPZwzcRkzcGT+rcF3AXTqwz1e3p/8mpzisGZmdxotQVCmglHuTdAihx:MelR2fYcqAGT+gymwYVpzTGcjotQAIS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251531, "uuid": "ae8e5e74-2210-43b8-8cf3-aef55c9c525e", "value": 446686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251531, "uuid": "da754776-5c5f-47c3-a74d-18eb4e822bfd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251531, "uuid": "7c8af93b-bbd5-422a-add6-6c83a20fea16", "value": "RFQ for _RTO system packages product details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702acab0-3623-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635228637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228637, "uuid": "2ce42538-939b-4e27-a0fa-e2e854f5e8f7", "comment": "Malware payload (RedLineStealer)", "value": "73cd1c631d2b16bad553f6544b3ca81b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228637, "uuid": "dfa8ce8d-a196-4a23-a64d-3e6a45d395dd", "comment": "Malware payload (RedLineStealer)", "value": "76e52695140cea67ab0a37de1c2b89353df8b64dc43522f02ddf28abe72b21c7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228637, "uuid": "4a7b741c-fdb9-44b9-ad4c-a6def402b383", "comment": "Malware payload (RedLineStealer)", "value": "49a8bdd9c4077d760d725c6e6aac4c7bc108409d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228637, "uuid": "298531a5-fdf1-4678-9d8f-f8e372739cf0", "comment": "Malware payload (RedLineStealer)", "value": "d202ad0ebf6f05e68cee93d25d83b3dcd4ddf874d6d100ea2ab6807a2503aa9a3423a82573ff79e3c5d3b27672d79d29", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228637, "uuid": "f88fc81a-827a-4526-9a88-84e26ffe5fa2", "value": "T1AB153AC6E0B3604EDBA2B8780F0195E24A420E7E5B119EF5AF75B95A11F36D1C6DB303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228637, "uuid": "81b53dbb-2a54-4f51-aaff-9f2e179e0484", "value": "d26cda7fbc3119c8d37f8670fd6d80ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228637, "uuid": "a308535c-2248-4051-826f-94ec58f62208", "value": "24576:OWBi5SXrfTQUNZrlgKxfZEGDKAaFfLerANm:OWNbfTQU3B3+AgjMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635228637, "uuid": "37175369-372e-4b1e-8b98-a83102c0debe", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635228637, "uuid": "01e3de35-ed2e-4a4f-85eb-51fff2b62bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228637, "uuid": "53bea114-832f-41ba-8527-fbfffe8756d3", "value": "LauncherHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cb92a2-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635258518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258518, "uuid": "cdbdd42c-3c80-48d9-ae70-f997a374c5a7", "comment": "Malware payload (Formbook)", "value": "05c21bf3df38d5b8365db71d94dbca37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258518, "uuid": "1e685765-c114-4fe4-8492-26c9ab541e24", "comment": "Malware payload (Formbook)", "value": "776df245d497af81c0e57fb7ef763c8b08a623ea044da9d79aa3b381192f70e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258518, "uuid": "ede3a955-93b0-4ea4-8f81-569fd6431351", "comment": "Malware payload (Formbook)", "value": "b26796f41c9d265995a608adc51d604d7cb47851", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258518, "uuid": "5e1792e2-ec71-41a0-a948-fcc1c8ac373b", "comment": "Malware payload (Formbook)", "value": "c1406993a60e34cdcb021cd9265cc667e45a2b0af336f146ea6975c5facd0dca5e95bc0c91e81f152c8e6db0ff589dc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258518, "uuid": "c47f25e4-fe51-4c8d-9f8d-c82e6d773b0e", "value": "T19FC4CE52736ADAF6F69620B00D94EF3518A4A9F53F3F0483BBD25D0EC438A841776726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258518, "uuid": "5f37a98a-f6df-4bb0-bf3c-e26b3dd11c80", "value": "50fa96e8bee8392937d77d1999426e98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258518, "uuid": "d2b80e34-060c-4741-ad6d-8478ab6419de", "value": "12288:ZgdncS3vl2J8aN/EYA3lxI51aU0xLNoSrdhBWaCBKzfgE9AdORCjdza:Zgdnc6l+8m/ER7I51aU0RKSrdjWaqKzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258518, "uuid": "956eb9be-c0a0-447b-946a-b748fc1af3b4", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258518, "uuid": "a4530bad-76c5-4593-99d4-c6a6d165a1f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258518, "uuid": "e12cda6f-584c-4021-a57e-bcaa2112a143", "value": "05c21bf3df38d5b8365db71d94dbca37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c892553-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635252736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252736, "uuid": "30a8c7de-f8f6-409e-ac39-22ae39580694", "comment": "Malware payload (Formbook)", "value": "a3148395965c93d7c7a0180970e35bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252736, "uuid": "86549406-9fe9-4db2-9709-9fbcd8364196", "comment": "Malware payload (Formbook)", "value": "78670e73101801526b59bf2bdead06d95cad399ff72abadfc0e00ba557643c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252736, "uuid": "66dce60e-89b0-4967-96bd-fb7b81a7be31", "comment": "Malware payload (Formbook)", "value": "6cf6843a62d1ecb45f00aa1354242154aac61e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252736, "uuid": "f2853573-827e-48e0-a2ae-c03068242fbb", "comment": "Malware payload (Formbook)", "value": "8f46e1dc5ff3842705a286c8dcc3e1434fba0e9f9e4d7d5b1e98df84ef8acf717f6a712af0fb1eae3e92ecd51c1889ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252736, "uuid": "8beb1504-0744-4cd2-bc31-fd49aea27b7e", "value": "T12D8412247A64CE32C2FA0637C9AE905003BCE6467952EF1E3D8E729D91533850D1E6EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252736, "uuid": "5e6b83e1-5f8d-4b09-9157-1e2d9a021395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252736, "uuid": "1a46b63b-06cc-4a41-9377-d5b9917368ae", "value": "6144:/KqV3KskgR1tU/S2gUSulhry81/8CLM1FvTHxO+KGZcmZlK8qPMTJMkfaslo:/v7HR1tnBulhb5SvTRO+tcYjqPMTFfaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252736, "uuid": "69574258-d8aa-4a90-a0b0-d50f9340deb2", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252736, "uuid": "596d92e0-dd93-4c4a-836c-c1fbf5c50ff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252736, "uuid": "a0e25c19-0151-4d28-9945-21793bfa7917", "value": "dhl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe36bab2-3660-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1635255075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255075, "uuid": "997133e8-1064-49f0-b695-c1f9a435349f", "comment": "Malware payload (njrat)", "value": "289bce792735d436f48355e55ea0276f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255075, "uuid": "f63443bb-8d17-4aa5-a699-db13a43db335", "comment": "Malware payload (njrat)", "value": "78b5fb7cbde356e0620afee36e4908e1985fbe17aaf30eaa896ecdf7c5f10f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255075, "uuid": "36056eba-a643-4cf5-acd4-dfbd8678a654", "comment": "Malware payload (njrat)", "value": "1438cd6b0e96ee1b6d9d3d17e3bc0177c9034ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255075, "uuid": "3adbfb2c-e565-4703-90f9-30768d25b070", "comment": "Malware payload (njrat)", "value": "40421207224006719fa0aabce7374a5efaa0bb95a4b362a261bd216bb48e03fe19aa8eec542d3e78294f756d56a6ef69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255075, "uuid": "0176407e-ed5a-4abd-917c-038bcb6eff6e", "value": "T1D534D02D328A8A32C599563885D7651043F3F7867633E7097E8D226D1F133EE8E4A78D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255075, "uuid": "18a1e5d0-01af-4569-90b7-ec75a2ea5a9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255075, "uuid": "6801bc06-6c38-49fb-8108-8f14abad42e8", "value": "3072:lb2hAhSt5GmyI5XCfn+SFZLPcS1olbq3RLJNz72ZjaDAZ6TEiQHcxp4kh3rs8EU0:l2hXbupPb1oS4Z2s0VQ8x/2kb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635255075, "uuid": "04c2f1ff-9389-49c6-a32f-06c7e6f15279", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635255075, "uuid": "d1bdbbd8-ac63-4ed1-8853-54c2cd6403b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255075, "uuid": "1335483f-b7fa-4501-ae6c-bc7d76a6806a", "value": "289bce792735d436f48355e55ea0276f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4eef468-3661-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635255462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255462, "uuid": "4c1077c6-c09d-4924-8273-a018d214b9b3", "comment": "Malware payload (RaccoonStealer)", "value": "9a0552e9c51d8e3ad96622728f980e78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255462, "uuid": "e9ab9093-ec03-4446-88b1-177bba8ee99f", "comment": "Malware payload (RaccoonStealer)", "value": "796cecd1c22ba9ee8ab2281253b36c7e82df4e7fc90621e6650d354202b37272", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255462, "uuid": "23c7eb03-8d8e-403c-8fae-06cace517a2e", "comment": "Malware payload (RaccoonStealer)", "value": "b9401dd7eae31120266513840b4ac05512d03792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255462, "uuid": "e4bc9e61-5474-4872-80bf-4f997f77f816", "comment": "Malware payload (RaccoonStealer)", "value": "099ead1ce56c1a3d14da834204b831db81bbdcff96a8bdc023610fc17e8442c9dc507c469d2e6bedb1a7e2782dbdc886", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255462, "uuid": "63118932-7a06-4546-b908-dad220ea7112", "value": "T1CF455B81A873604DF3A6B2B94B0955850A421C77DB139AFF6FBDB91A31F26D1C687303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255462, "uuid": "ea346f81-9822-4333-8436-d7cef573b99f", "value": "4aa82b91dfdd0eea976043de209425e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255462, "uuid": "ff9b5160-6052-4a20-95d1-ba6c09982688", "value": "24576:nEkSLRyKFYfKpK6TfWLOLpgfrz3OAsYR6jeqmSIGvfxd7pUD3eU:EflYfKpvfBGfnOfO6CqmS/npQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635255462, "uuid": "a1ee43c2-e228-4735-bc3d-b581fdac96bd", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635255462, "uuid": "0436925f-7206-4798-8724-51b9605b8e99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255462, "uuid": "cc17d0ea-396d-4de2-82a2-b3d96f068379", "value": "9a0552e9c51d8e3ad96622728f980e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0a44bf-3627-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635230536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230536, "uuid": "e2e4868f-ab72-4a6d-a71a-e32dd4ffdc0f", "comment": "Malware payload (Formbook)", "value": "7e05385a7f581bd4aa51c70e216a2ef0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230536, "uuid": "4e9c5269-b223-417f-89e8-1455f42bd6a0", "comment": "Malware payload (Formbook)", "value": "797d9b18dcc820b02e9a22a8ed6e65bc944e5f097509335853237ac733f339d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230536, "uuid": "63a366e6-f8a7-45b3-ae11-01c9cbde6d34", "comment": "Malware payload (Formbook)", "value": "0b1e549b6d750e7023a13c419eb361b374ffbbe3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230536, "uuid": "a3687b39-d2e5-4244-81d0-002214226c3f", "comment": "Malware payload (Formbook)", "value": "77484625de1e0efae60f9e580d7fc02f8621429576966beb6a0bd08553151f4126aad39767d4e11cd44651ae36fd54a0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230536, "uuid": "a2671477-07d1-4d18-8df5-fab4af302b24", "value": "T1C364232110EF0989EC2FFCB1CAC89A8A8D8912D6FD61907919E29FC51D534F953C3B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230536, "uuid": "a7302651-670a-481c-995c-dc3c316ab8b9", "value": "6144:u/O5SqgbCAiZRCtYCnbEPlZemeeNUGF6TUtnBDZU8v:u/weuAiTrjNUS0uBDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230536, "uuid": "b2272678-c12a-46e8-9675-2b9dc86839d7", "value": 317443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230536, "uuid": "9eb86e5e-5a95-455e-b8df-989860f56ae1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230536, "uuid": "def4c1b7-f688-4bee-9651-a5a5c6a1acd5", "value": "PO 800A3E4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afd4fc8-3671-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1635262102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262102, "uuid": "fb529425-7419-4eb2-929b-28dd62530ccd", "comment": "Malware payload (Gozi)", "value": "b938df3257c4c0f916955b0a689dd280", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262102, "uuid": "aa10caa6-1473-4946-ab44-4b60d6c0cb70", "comment": "Malware payload (Gozi)", "value": "79ab62103a0d4eb9fe40aa94aa9d2f2f669c1bcf29119930ede17bb4cd1a9d6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262102, "uuid": "dfa3b33e-4759-4d5a-8001-7c6d62edbfd7", "comment": "Malware payload (Gozi)", "value": "8058abf1aa17283ab8c6fe65e303011f46cda884", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262102, "uuid": "6af66d30-0145-46f5-b7ec-6049fed3fd55", "comment": "Malware payload (Gozi)", "value": "b9a43af34b14a1db3f5f172b1870e48132873a00ee6a7039b5abc6d571a1c84e7fa2d678dcf5d9233c338b2e416c2761", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262102, "uuid": "0a34c75e-74dd-4726-abbf-d90d8f1ae6a0", "value": "T1F6253B1173B04034F6B707B584BE6164A97DBDE12734D4CBA2C17ADE0A6AAE0ED3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262102, "uuid": "eeca50bf-e341-4d54-baba-62cdcc8f1ff5", "value": "31c0cba4202be19cd6397bb23d27b9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262102, "uuid": "4f00b377-1f71-495f-9ce1-b3be79d4c859", "value": "12288:eIHNms2RwzI/NO+Q5QVBiboBdQv/7kSpLzRSueb5LQortLDZk7rY/MBSt:eJRwzIlO3QlynpLdGVrkfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262102, "uuid": "b8789c8c-1e96-46dd-b3d3-049e12d5bfff", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262102, "uuid": "f5a31800-9a22-4d04-b634-a70624a976cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262102, "uuid": "1ee2d6cb-6f70-4d04-a329-b22f46b54f46", "value": "b938df3257c4c0f916955b0a689dd280.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce91993-367a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635265864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635265864, "uuid": "e939f38c-a173-43c0-a151-a6c64057b0ca", "comment": "Malware payload (AgentTesla)", "value": "ea4216e97a3007309295e8a7b769208b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635265864, "uuid": "c8e2d513-cab4-4d51-91c8-f81ecfe87a8b", "comment": "Malware payload (AgentTesla)", "value": "7a4b1e5015937985613975df6c4f2046b0398c6e32ea10b780da1cce61ef3d44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635265864, "uuid": "025ca704-4c0d-4e7c-bc68-1781478e6f21", "comment": "Malware payload (AgentTesla)", "value": "bf86f6614965d6ebd5d2ea10d46780a86b225c44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635265864, "uuid": "f9c11eb4-b991-4798-a281-dd1fa64ac7a1", "comment": "Malware payload (AgentTesla)", "value": "535c36929a2fbb39db5392a5bf44cfe23b03047188f479d2e26cf04579f1f9528df6c9bb33307153533dc3ded0960ea5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635265864, "uuid": "f40a69a1-cebe-41eb-86fd-1dc85a4511ef", "value": "T151D40151D3A3C8EFF8B55072945AD93866E1593ED0E01E2F12EA2D67315238B207F86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635265864, "uuid": "2e1907e8-4697-4208-bc24-5f75b48e6654", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635265864, "uuid": "7139c72b-a174-4d9a-bd51-dbb80354f982", "value": "12288:vfml5dMB84ObFiJPQdhePXVjU3sEi+PdGYir0PnPE0N:ml5C84OblCVjZEiEGhr0PtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635265864, "uuid": "f720f245-b091-4378-98f2-5e6ff53517ab", "value": 625425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635265864, "uuid": "7c120cf7-8b5d-4fff-9228-3914fbf445e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635265864, "uuid": "3ada1e70-80d5-47b7-b36e-6a5d26a907bd", "value": "COVID-19 Emergency.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde638a2-35f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635207346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207346, "uuid": "a406f272-e012-451c-b7b6-2d22f40fab56", "comment": "Malware payload (Quakbot)", "value": "fc007038f720e8d44f1c767243be7619", "object_relation": "md5", "Tag": [ { "name": "clinton38", "colour": "#6770F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207346, "uuid": "70fbe863-1695-4adf-9e33-d7d25850c7ba", "comment": "Malware payload (Quakbot)", "value": "7af572d912a2bff85817165acc672ef17f1fd776ea03bcb5cbb848604ba46fbf", "object_relation": "sha256", "Tag": [ { "name": "clinton38", "colour": "#6770F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207346, "uuid": "34ac187d-694f-498a-9715-51daa2a6d3c4", "comment": "Malware payload (Quakbot)", "value": "451ba8d9ea27a1c8cd8e51fd37290eb336acf68b", "object_relation": "sha1", "Tag": [ { "name": "clinton38", "colour": "#6770F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635207346, "uuid": "ca7dfd93-2842-484d-8c99-11610fc7ddaa", "comment": "Malware payload (Quakbot)", "value": "afcb57107616a3dacec5b90f09b707c4aafd054ef9d62fed1efdf45152a0945851c38e6a4600d6bf2a83591ba5e8fffe", "object_relation": "sha3-384", "Tag": [ { "name": "clinton38", "colour": "#6770F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207346, "uuid": "55ce18f5-7309-474c-873d-d507a7e5f1c5", "value": "T17A159E1032F1C432E5771238DDB6E0F95A7DB8220A709CDF73C4276F1AAA6D1A62571B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207346, "uuid": "2fecae2e-a77a-4039-9d62-f114bc45cbec", "value": "872d6435491f96e52884db7db42182b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207346, "uuid": "97a880ff-0af4-4728-96d5-2f092025b724", "value": "24576:aMIMGDjG6eSQSZ4o3LGLjLUs4phbCa3FDahPCKp7OIP:/IMGDi6ySZ4o3LmL++a3F2hPCKpqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635207346, "uuid": "697af258-c9ff-49d5-babe-b83e8e9014d1", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635207346, "uuid": "3e29a275-0843-4133-86ed-835de18e6455", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635207346, "uuid": "44f2dee7-9a5c-43e4-a8ee-9510379d3097", "value": "44495.0291481481.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c036d6-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635250958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250958, "uuid": "9a37de73-158b-447a-b42d-e27b176f3aa1", "comment": "Malware payload (RaccoonStealer)", "value": "4185c4256f10ce9fcff982a0dfb951a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250958, "uuid": "0d41dd60-168e-4ce0-9016-57d67028d7ec", "comment": "Malware payload (RaccoonStealer)", "value": "7af9e7e44d7f033837b7bae0f23f2bd5d7eb5e31b2067fcf31be2886141517be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250958, "uuid": "7c28ccca-ac89-497a-a285-e894d9329325", "comment": "Malware payload (RaccoonStealer)", "value": "9ed03f2d92d68e65c82e9646541504d81daaa2d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250958, "uuid": "da297f82-1e07-4e8d-b112-0c1099a74e09", "comment": "Malware payload (RaccoonStealer)", "value": "2bcaba9ffff24c6b85888fca59c27e4fe39835f84ca5f863f0ffc7585993dc8e66def05f161b71ca8110ffa64f87579e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250958, "uuid": "9ec096fd-9700-421d-940e-e5729eb58d4f", "value": "T138B401C132C1E477C5BA4A318835C6B56A7AF9F3D96D848F779B3F2E2E602C05A21345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250958, "uuid": "f2d76bcd-2164-426a-8c3e-5922d616e1fa", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250958, "uuid": "615e15c9-047e-4837-828a-eb0685cf2048", "value": "6144:4WXyXLGbd9qj6rg5YP8Df/t8wsALI64nCv5yipBD9THMqCSXzcgOdFSRfrnLFynl:tlbd9qu05YCGw5cvoy2BD9T5QhIpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250958, "uuid": "3df4f2a4-7098-4d83-899c-11614a6c558e", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250958, "uuid": "6f434755-2113-47f9-b578-3eea96ac269a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250958, "uuid": "dd133453-b525-4af9-9f62-d59e8869ce68", "value": "4185c4256f10ce9fcff982a0dfb951a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd6a847-3624-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635229222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229222, "uuid": "f4c2d83c-b990-4806-9262-efe8c21dee4b", "comment": "Malware payload (AgentTesla)", "value": "ddcd48976f80bda499c5bc8ed8aa82bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229222, "uuid": "748f6fb5-58ae-4e0c-aed1-ae10f3b0d5f6", "comment": "Malware payload (AgentTesla)", "value": "7b29ebd698e954234fbaf01add7f1f446cb156b3b93aad312d810b33689ab6ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229222, "uuid": "909f491c-8817-4500-9442-515d66864c19", "comment": "Malware payload (AgentTesla)", "value": "6f864affa5e70d7441fcf7b03620d8d86a7ad072", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229222, "uuid": "3a886af6-f860-433a-ae4f-74499506f32d", "comment": "Malware payload (AgentTesla)", "value": "28c5f68c0643746224d956e45ad8d138b7ee846f78f94aaa18dcc55a719dd0ac5236b61a291052adde3652de1ec7c3f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229222, "uuid": "4289d374-54a5-4dad-83f6-c5a7529bf69d", "value": "T19E1507B1623239C8F827057820213AA4FDE23CEBD5E1EC695EB2B7FD45F6C81452651E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229222, "uuid": "136bfff9-8302-406e-9c5d-aaa16b85b7e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229222, "uuid": "7b5addc2-63cb-42cd-8b40-a7fba00f9883", "value": "12288:buzbW0qJFTP7eiDtd37VzftM+qY5fSOETmqFroZktH8IRW:bu+0q3JDtROSSOBUrx8IRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229222, "uuid": "a65975ff-3c82-4d49-8a9e-927f69cfc5e6", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229222, "uuid": "3f8bdeb3-08b7-45aa-8a72-efed1516ead4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229222, "uuid": "b432b9d4-cbb8-490b-a175-7e864ccbfab4", "value": "RFQ RM261021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27e608d-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635253713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253713, "uuid": "c45e2b57-0af2-4252-9b00-a183cd301620", "comment": "Malware payload (AsyncRAT)", "value": "10071963fc9cee68fdc288a436a6aaf4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253713, "uuid": "66a8fdd2-724e-4da6-a3a4-a379d5d65341", "comment": "Malware payload (AsyncRAT)", "value": "7b49f7dcd3d884bea2917055cac0f52c2c5bfaa7d13c4265a3892dd0f721e64a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253713, "uuid": "90af69f1-3dba-4a5a-a9a3-affdbbf8cda4", "comment": "Malware payload (AsyncRAT)", "value": "ec6d220c4071a0ef4d4b09c0c46068f951938249", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253713, "uuid": "4b0a9829-7040-4e33-afe2-beac13a8c952", "comment": "Malware payload (AsyncRAT)", "value": "b7ab141d5a94f49a9c431300e3f236b891ca507a4bf8ca6eb42ba0e87e88580c1a6d7d81fd58ebee2550ded8f8a83d2b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253713, "uuid": "56097cf1-efcd-46ec-9d54-4db4af055ea8", "value": "T1E801104BC5AEE6B68783B36B89867844E83449831FF36E76302CC10DD53F5F459E9690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253713, "uuid": "f3837729-7802-48a8-8f11-d86e649c8332", "value": "24:GTkLh0wjX92EUMg0ZK7UuCSZcHth1WMgiWwv:GTkLh0wjXAEUMjSZc4MGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253713, "uuid": "7cf3f1c2-3f3d-4370-b06d-01ac27f84111", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253713, "uuid": "0812c67e-8135-414c-ba27-32c0f43df62b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253713, "uuid": "9ffd77db-2a1c-4185-8ec7-d935e536e083", "value": "DZCNWFE59539.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5213d2-365a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635252384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252384, "uuid": "00da687b-b703-4337-9525-a2df36274286", "comment": "Malware payload (RedLineStealer)", "value": "f1ed36675a693ff819bf7bf545b45da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252384, "uuid": "caf293ec-e520-41a9-ade8-2cb494eba791", "comment": "Malware payload (RedLineStealer)", "value": "7bb68f7b44def879deba98dc1011bd9b933323133938629a28ba830b76be4899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252384, "uuid": "a150f43f-79af-4830-852d-8493bf055226", "comment": "Malware payload (RedLineStealer)", "value": "349c43fd4aafb300f651aaebb0538983f8c82721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252384, "uuid": "37f68e3a-29f0-4bde-917a-519cbb5654a7", "comment": "Malware payload (RedLineStealer)", "value": "455efc84aadcd54b90ae49be1a33c57a3f0de627b1dafc3209d6bba136203fd96d29a5ea6458a38eb96ccbbca783b4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252384, "uuid": "62c0d0bf-4049-4059-8d88-cf43aeaa5b29", "value": "T17A74AD10A7A0C039F5B312F445BA93B8A93F7EA2A73491CF62D526EE5634AD1DC70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252384, "uuid": "88c4118d-7c75-40cc-97b5-7c8fde4df5df", "value": "b740a98397765fd7611816be8978d373", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252384, "uuid": "99eab0ea-613f-4dd3-9060-2102b2f92b80", "value": "6144:NyseztON/w+IkKVwHVi1dTF0o5QvyKngg0E8z/wHq2QF6AUYuFcxxDl9:otiotjOHg11F0CWhiz4Hq2lAUYtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252384, "uuid": "dc890ea3-c467-46dd-bc90-85c2598cc464", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252384, "uuid": "ae46653f-ec7a-453c-bb36-831bcdc65a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252384, "uuid": "3eea6097-70a9-4855-a123-54f1e07df024", "value": "SecuriteInfo.com.Trojan.GenericKD.47252791.7056.9378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9994dc-3672-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635262538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262538, "uuid": "92543db3-22e4-424b-838d-fd4147687c34", "comment": "Malware payload", "value": "6f78118b606c3c7c9bad1a9e0671cda8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262538, "uuid": "527d7269-9df2-42ad-b354-7fb094175dbd", "comment": "Malware payload", "value": "7be5baa4d9a45af1e6f15fdf6600537ed78e1694f9daa37741b5e8c3e58d7005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262538, "uuid": "3d4c167a-9bd8-4b56-a693-74f30ecdb3bb", "comment": "Malware payload", "value": "00abbc6a45d7009d8e166794289b39d0bb709ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262538, "uuid": "7c164917-daf2-4126-aae0-a8fc4edc01c9", "comment": "Malware payload", "value": "181886b310d049399afc2208e8523feabe68e573a887cced0747e11788e8bf4317a60f365d7cd783d33b429d7d77646e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262538, "uuid": "a055bd37-a6c0-4bb9-924a-c73564965e70", "value": "T121E533F0808472E0C1FF54F9FAB0E7A5C81D8273D09855F5DAB595EA90BB527B3D9280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262538, "uuid": "6c395563-063c-43f4-a1cb-837e2b8026c3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262538, "uuid": "57b40816-5c33-4310-a684-de5bbf8a7cb0", "value": "98304:Bdb8T8lq8QlichCypby5gVraEog2F36dklnAqG:BOT8cUcQypbDVrEg2F6d0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262538, "uuid": "01df9e43-2390-4918-ae51-fb3bef39bdfc", "value": 3303436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262538, "uuid": "8cd708a7-472d-4a8f-9ab1-19939743df0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262538, "uuid": "806fa14a-da6e-4f62-96a8-baab7bbe530b", "value": "Software updated by Dylox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743d5c79-3676-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635264292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264292, "uuid": "ad321e99-89cd-447b-97b3-ef9e3a6c443b", "comment": "Malware payload (RedLineStealer)", "value": "99ae920cf008daeaf509944e9cccf9b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264292, "uuid": "0cf188a9-b644-404b-a3c1-9596063df055", "comment": "Malware payload (RedLineStealer)", "value": "7e2e3c2afa138eed7d919a3660a6a46cdbcf936523b307a6033b18cdfa92d95a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264292, "uuid": "2eac7572-5f19-48e9-8a58-6169c1e46fea", "comment": "Malware payload (RedLineStealer)", "value": "a23155eb6251f4a6da1011583e35e88fe098c448", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264292, "uuid": "3855ef6e-af2a-4d10-a059-8350b84fa9a3", "comment": "Malware payload (RedLineStealer)", "value": "d046cdcb6a94fb0129268c6d5eb96faf4cce21b2d298e8bb1b9072bcea3483480cc402d896433dabf790aff02afcd7c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264292, "uuid": "21ecf5cc-84f8-403f-af6c-6de5ac0908de", "value": "T13D54E01036D0D874C136567089A1C7E1567ABCD3DA7D814B27AB3EEE6EF02919E223C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264292, "uuid": "bfb43847-6533-45c5-9701-1c96edc8e1f3", "value": "fa148d0c70a978454538a9c9c0513fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264292, "uuid": "17858936-05e4-4d3b-bdd5-7ccdd118d68f", "value": "6144:RGlaeshp4STY3rtJjH4m/EqMZEb3zJUimpTayynVP:reshpzMbvH4m/kEDz+NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635264292, "uuid": "d29dd656-ee12-4509-8a7b-8578f240c923", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635264292, "uuid": "d1704a13-99ff-4d85-becb-fdd8d8f03c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264292, "uuid": "8c3bdad9-3a6d-4abb-9c8d-b08e18c9e3cf", "value": "99ae920cf008daeaf509944e9cccf9b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43272af-3639-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635238254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238254, "uuid": "3e5f4e0a-f947-43ff-9dac-09a2ea4ebc31", "comment": "Malware payload", "value": "714f862a687434039f86051feb190697", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238254, "uuid": "acab7b4b-0a69-4f94-a1ed-d89557897fad", "comment": "Malware payload", "value": "7e4c8ac1d5c57880db3720e28982634c63b922e3bd12b05991518c5c0e28fa1a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238254, "uuid": "660a0a2a-6415-4067-9349-fc9a10f0dd0f", "comment": "Malware payload", "value": "c28e968909adcd3cd9799fbf9aa00d9ef6eef28e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238254, "uuid": "a37e5e6b-f52b-46c7-9296-a2ae0812acd6", "comment": "Malware payload", "value": "d2e3467bd621937b229823c768c47df6933f8471385891d26fe7a8ac09b6ec786583d61846fdc7ae066c22af16133b61", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238254, "uuid": "01461d82-fe66-48e0-9d30-5cd61eb473d7", "value": "T1C6B5B931B5367683D2660070166FBE4A530C7D47B3DA1F98854ECBFD2CAA8F49309E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238254, "uuid": "76d26067-f6e5-4c23-a936-7c1af8726f6d", "value": "1536:KxxxUavIR/f34HkjXQMQUQHQ/QNQ2QUQXQNQ3QTQDQNQnQvQ8QCQhQQQXQNQ3QTC:Kxxx5xxxzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238254, "uuid": "f9ee000d-6587-418d-99a4-38684aac2ad4", "value": 2345154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238254, "uuid": "ec1989fc-4ba5-48a3-aafa-f3d56561ae81", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238254, "uuid": "6226f252-f6ab-4a7d-b458-7ccdbed675fa", "value": "Purchase Order-262021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0cd0f7-3677-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635264547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264547, "uuid": "bced8416-3461-42d8-8870-d69325855e3e", "comment": "Malware payload (RedLineStealer)", "value": "ffa982fe5e044c8c8e1e302cf979bd2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264547, "uuid": "aab832bb-5621-416f-aa05-e87cfc0184e7", "comment": "Malware payload (RedLineStealer)", "value": "7eac25033c33b38363949c2f8d342e085891744924f2c35d951265b06808a7fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264547, "uuid": "aa1b3ec4-f92d-49e3-9b12-6d051ad0b261", "comment": "Malware payload (RedLineStealer)", "value": "576c63ab4c8c30569b111ad3071896018c636d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635264547, "uuid": "e97d5066-ca66-4ff5-a16f-cc997556df14", "comment": "Malware payload (RedLineStealer)", "value": "1ca7e7ba1e55d3853da4b80fee87274a257bddf1f648893643d199fb7051c2e6aeeb54c7f064cea47c6ad051b0753a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264547, "uuid": "302df338-843c-4cd0-83a5-5a98bb06a3ed", "value": "T1D164E01137A0D876C3B68E707821C7A2467A7DD3E93DD5462797322F6E302B18F2635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264547, "uuid": "f9845afd-bb86-4fba-9d48-65537cdd8831", "value": "fa148d0c70a978454538a9c9c0513fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264547, "uuid": "94257979-fb11-4059-9955-e03823bc0ce1", "value": "6144:d17VuF6Dz8o5zEijIWIY9yaGb5AuqtCQiuct4qgbN4WynVP:d2F6DosnjIW/yjjwnPDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635264547, "uuid": "b222ff38-e0f5-4857-8c8a-c43af951b9f7", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635264547, "uuid": "2f2def2b-2762-4d8d-b0c8-8ce01ab52ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635264547, "uuid": "429113ac-961f-4f5f-9e63-6f2d1f330e26", "value": "ffa982fe5e044c8c8e1e302cf979bd2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd43cf1d-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "e2cec855-e3c4-42b4-9c5d-83addf6463a4", "comment": "Malware payload", "value": "2b24ad8292a7db0e34918af97b523726", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "7942e341-0b9a-431a-91d1-04e34b4974bf", "comment": "Malware payload", "value": "7ed143af06c6d44c98de7296a417058b07dba87ae2e22b9e55952abb49296f8f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "b83d097d-4854-47da-855d-7693627a7dcb", "comment": "Malware payload", "value": "4913a9d696602b82145ce612a736ad83b2fd6f4b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251530, "uuid": "cc36ef71-9f1a-4c9d-a8e6-b9597423b163", "comment": "Malware payload", "value": "b8454a10c123f164b60d593edc11832c9d33ae942f1c524865b4a82ba80ce3993404834c30422c77a2a0049232eb183e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "188dce53-04da-4013-8c27-f878176c0b97", "value": "T19734CA7DE1470A888F8693B8170B6F85154CF51DF3D884B236B8DB386AD4D7B962293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "13a41ad3-0ef7-4a65-b8d3-e9aa59665ff4", "value": "3072:t/tyYKSQZDrm4wb/WGSFr5UrJWnYk64DwJ6tyR:t/0YQZDVwb+tUsYkbway", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251530, "uuid": "20db3a9d-02a6-4ecd-b66a-a79e6854880d", "value": 234223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251530, "uuid": "6781251f-2d84-4de3-9512-227e1a39a5b9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251530, "uuid": "cb8d6ce6-77aa-40b4-9244-57e21f67863e", "value": "Original Shipping documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32498181-3638-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635237553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237553, "uuid": "cb084487-fb2c-4462-826c-582fd9bcf18f", "comment": "Malware payload (Formbook)", "value": "21f845742c01993685ad8812a04ac6ca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237553, "uuid": "b7f53617-7bae-4ae7-9fb4-7e92c382a428", "comment": "Malware payload (Formbook)", "value": "8016b5244c4074c1f7dd68bc4bbddf44adc5af75ef0c90383d9c9b0bc36ee4e2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237553, "uuid": "7c2d1041-6f73-4858-a271-719f1e25cc1d", "comment": "Malware payload (Formbook)", "value": "d818e8338e7ad52c4974f3f9cf7f0effa5822682", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237553, "uuid": "1d03f4a7-c34c-4736-888e-c4604252fabc", "comment": "Malware payload (Formbook)", "value": "6fff8c43588ab586a2dce5fe011485b4d9efdfe078673bf1b99f2d25f7f08a7e64534adc2e20188f9309e480eaa1fe0d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237553, "uuid": "d88c6766-9b8e-4f2b-aabc-eb909e533f46", "value": "T1FC948ED8DDA1C9E4CBCEC5DA49193F9920633ABCC6C36C5A4838B2F90FD357E5616860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237553, "uuid": "4909d443-3e60-4ea8-beed-e61ed697affa", "value": "6144:ObZ9o1N//MQGMtwrVvaatt7Kxd4S7pFyf8VMF0+10fk9/w/T+1m6hu7gy2TNWj0w:u0nIBtt78tFykVHk9un6fy2unVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237553, "uuid": "391f6020-d494-4e8b-a1fb-2b464872a968", "value": 446780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237553, "uuid": "e14b7222-d819-45c4-b6e5-238c213a01ff", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237553, "uuid": "01522e7b-5891-4206-9df0-f9542c1c04f5", "value": "Original Shipping documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a0cadc-3646-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635243677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243677, "uuid": "2edee400-4632-4750-a26a-795c7afa25bf", "comment": "Malware payload (BitRAT)", "value": "8a5bb69d1ac68afc6c24103475a840d8", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243677, "uuid": "08b8f7c0-23c2-4404-868d-874fa2b2cc88", "comment": "Malware payload (BitRAT)", "value": "802dae09bd70c15593862b7a343219ef19ab72f560c932c7059e1511c5643bb8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243677, "uuid": "a175eaef-f77f-4409-af14-4170722d050a", "comment": "Malware payload (BitRAT)", "value": "7f642c9c41615de8772852865325583678640bd7", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243677, "uuid": "063ff7af-06c3-483d-9047-0cada2574c0b", "comment": "Malware payload (BitRAT)", "value": "973bc7a914c9bffc583f0600f9eaf741577303f8ca0273e2a185ce82caa209f6c87f8606ca8ca5c12d54734721450772", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243677, "uuid": "86d1c41d-52e1-45f3-9802-600e70afe684", "value": "T16326F103FFCA3452D28228B0061BE9787465182A141E9F5FF76EEE1179B2B8395F83D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243677, "uuid": "9e2818ab-53b3-44e5-892d-fb158fb39ca0", "value": "4688138aa56f51df0a1bf9af39c02fc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243677, "uuid": "6da9e54a-5a21-45a9-bc48-ecb89b2516c8", "value": "98304:fiC2i2ubclaVsgG4gQEtb6dkfVBg/v26ucnl:f8aVsgZgtbdVBgpuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635243677, "uuid": "d65ff849-127a-4886-a33d-e04ea0849e45", "value": 4737949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635243677, "uuid": "5198ee46-d8f4-478b-9962-a3f9b7c9bfe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243677, "uuid": "0c1f83af-9609-4505-974b-9016a359c55e", "value": "8a5bb69d1ac68afc6c24103475a840d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67265ab4-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635260405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260405, "uuid": "c08e8ddb-1ef2-4775-b837-762fcd6a6668", "comment": "Malware payload (Smoke Loader)", "value": "8ffb55c8bb1feadab5aa66f2d718179a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260405, "uuid": "2591829e-a5ae-4264-aa94-d474ee79a519", "comment": "Malware payload (Smoke Loader)", "value": "80749d64c842ab8b769ca1e36cc755005dd2f67b3bbf5b0f48f647769fd71d20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260405, "uuid": "41ff4f42-8d80-4c02-8e5a-31ee214d14d0", "comment": "Malware payload (Smoke Loader)", "value": "4e98fc287b95f3c54f15902729b12e709928e383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260405, "uuid": "70ec4f1d-20f3-4fa0-bda1-dc6c5d145aa8", "comment": "Malware payload (Smoke Loader)", "value": "8c3ef2b059138a63d322e749f843511923ed9e965c9a23e2acce6221c176793b70c246ad73968545f46c8baf6873e17a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260405, "uuid": "027d2cbf-4723-4088-869b-49b36bff2b77", "value": "T13B448C00A7A0C435F0F716FC49B6936CB92E7EA16B2494CF22D51AE99774AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260405, "uuid": "10dc705d-8db6-4c7b-b1c7-02c033799415", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260405, "uuid": "b6b453b2-1765-4444-aa13-a54b1424669a", "value": "6144:HTabm8LW/mVwFuyWKsEami45uiAqHXco4My+YOeWQ:zqLWbFuyBsEami452qHXx4lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260405, "uuid": "a5b63836-47cf-4140-ace1-4fa96a956ff1", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260405, "uuid": "bad37807-e02e-41fa-95ce-985a1619c864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260405, "uuid": "1f1dfa64-f422-4d50-aa1f-2a9a5ae3a1a6", "value": "8ffb55c8bb1feadab5aa66f2d718179a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72a531c-362d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635233158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233158, "uuid": "60c69104-b47d-48b0-8720-5cdf5ff3aa00", "comment": "Malware payload (Formbook)", "value": "9eea5277e11627651e1628b7da56044d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233158, "uuid": "f50402ae-6bf8-408a-bad6-72564e72440c", "comment": "Malware payload (Formbook)", "value": "827b490e3a19a6c6e1fb7766e3a85957648c133fb6fb6a15cb48100dd8b06422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233158, "uuid": "8bca7810-faef-41e3-b880-a289df1f42f2", "comment": "Malware payload (Formbook)", "value": "b6b160d2d53f9b55e186b809654519bb095399d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233158, "uuid": "1a8747d9-cf52-455a-b946-33820a642b4d", "comment": "Malware payload (Formbook)", "value": "79be5284e9e3776b433b59b651a76ddbed362245422e222483ad257e10d7628321a10a83d63b40fe4e82e12577b19267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233158, "uuid": "b0ee9272-cc6a-4cef-aa42-58550c854181", "value": "T1A44412077280CCABE086AB770D66E7BCC7366D050D655A4397E8BF5FB9B1084870D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233158, "uuid": "6e74b5af-24fe-4067-862b-c7dd8adcfa80", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233158, "uuid": "04f61b91-bf21-4b6e-9ab1-206be58d0902", "value": "6144:XBlL/787UgpL52Kv7B199KA8Y8vgCqqTMCoU08hsh:Rl87UgplLvd1F2/1oU08hsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233158, "uuid": "5b4a1ead-7676-4d80-8c91-1e488adce9ba", "value": 274198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233158, "uuid": "eca853b9-0357-4b8d-b2d2-0e1c83e88f20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233158, "uuid": "98e40762-96f9-40e5-9fcf-c0c66dda214d", "value": "USD54,884.56_202110260056MT103_0034D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949aad97-3665-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635257045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257045, "uuid": "5406ea43-261b-4040-9f84-cc7bd901c8d9", "comment": "Malware payload", "value": "6a189d7a893a37769edfb5b87b23743f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257045, "uuid": "60b792de-dbcc-4195-8c1c-b1a57a031634", "comment": "Malware payload", "value": "828c15d94722cb54496ea5305b792b2cdca80134121af96b0c65a2f5f72aaad2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257045, "uuid": "cb51ea72-f3fb-4244-a283-7c51e3ec370d", "comment": "Malware payload", "value": "f8ad8ce3c3d71d92e3b68f1c8fd9c19fd17cab69", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257045, "uuid": "e112a5b3-7f45-4331-914f-4ee776deb273", "comment": "Malware payload", "value": "5924c1eaaacfaa8f228ed649cfed908fae631e5c161641d6a1df72f4a8658948350733abbcf1cc5ca606b1feabdbd6ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257045, "uuid": "cb878239-c804-4ab5-87d0-000366576e39", "value": "T10E56AFF876047DE6266F536BDA96ACDD03B617639ACBA4CC80647BC305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257045, "uuid": "683279f9-ea70-4b10-a446-7b99d039732c", "value": "24576:XHOzhB8IlMrN1+xCW9W93vr822wAZEzFOEZOtKTLC+ACDDl9dWJPu7D9Hktsh8GS:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257045, "uuid": "ea5330bd-eeaf-4cda-8603-741720e2fce3", "value": 5948517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257045, "uuid": "54cd4ffa-be91-4d3b-b175-b55cbfdc911a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257045, "uuid": "854f2398-32dd-414a-863b-dd0ba8f09a6a", "value": "fyi.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ad6a0a-365f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635254632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254632, "uuid": "e8c22629-3567-46b5-82c4-f1b8b3b31430", "comment": "Malware payload", "value": "8387655dcc741f8326377060ca17ec11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254632, "uuid": "a711b9d3-4f57-4a7e-97ea-f9eb0ddc867f", "comment": "Malware payload", "value": "82a883718d5a4b9be615e8e09270f662539449b8165f7b128b5cd787ce27b0fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254632, "uuid": "099c629b-0723-4c2b-913c-d7eb5b345356", "comment": "Malware payload", "value": "9354b07fa9e3e4cab2166319ade94f3659650c17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254632, "uuid": "5bcd76b8-a52f-48fa-9f49-59a3700cc02b", "comment": "Malware payload", "value": "5b0f985122f63105b24101ffedbf5a0266072592dac62cbc45dd1cba46a0f9d7aa700accbbd109abb362f4cfc5617d48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254632, "uuid": "6d344ca0-903f-4bbb-9543-d083d3eab89d", "value": "T16C4396A936D969EEEB775D768BC4B51E0A32F1631A01B64D3055478A4B03AC0CEE2F70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254632, "uuid": "db267297-b0fe-46a7-bdc3-ae9bafe36563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254632, "uuid": "7f0a1ca2-4c8b-4148-b10d-625952add494", "value": "768:ztGzXWlRNRQanIFcGczAx1ZzG5IHenQ1T6Zs4YeCYbJ917jf:4zmlRNRQanIFcG2AXtG5ser6jY99x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635254632, "uuid": "63105a43-7b6e-46e1-90f5-bbf316f13254", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635254632, "uuid": "320c5e9c-5a7e-41c0-a41b-343f9652735d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254632, "uuid": "7b26bff7-d891-4d33-abca-70abcbf525b4", "value": "8387655dcc741f8326377060ca17ec11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33969ec-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635258787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258787, "uuid": "c5b71a2f-eba9-45f6-84ee-d0c8aca81f13", "comment": "Malware payload (RedLineStealer)", "value": "8365263ceec31ba7713cdffc4fa20891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258787, "uuid": "7325c4c2-963f-4357-bca6-df69073f8f25", "comment": "Malware payload (RedLineStealer)", "value": "83066fb7cb6cf09b0ba0d7816de14f68cba12de1309e4a8d4f75643b9c1c0c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258787, "uuid": "c403c814-9439-4925-a5fc-8d8868697996", "comment": "Malware payload (RedLineStealer)", "value": "633d7546f9821911565cc0bbfb3aae45a242650f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258787, "uuid": "9ce85b53-a4ea-423c-9298-63310d59a95f", "comment": "Malware payload (RedLineStealer)", "value": "079fc2ee6930e5a60cc3ca5941bb3713dd6e8a5e7b9ae33ad08d4a61fb202f6896164130c657de41dc41e05eaf72f570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258787, "uuid": "eff5a2f2-1889-4448-a9ae-0db34df74170", "value": "T19664BF10A7A0C035F4B716F88AB693B9F52E7EA1AB3484CF12D11AE957346E1ED30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258787, "uuid": "ab335858-322c-4181-8b41-e5db1b78f8f8", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258787, "uuid": "f39f9c88-5076-4044-ac93-bafc97e301da", "value": "6144:CTH6pmf0br0DyymKrcP189BWZ/Z7t7BRY7jW4sayzmeX7PX9Gc3Syu1e:qa54DyyNwtgcZe7sayzmeXT9GGSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258787, "uuid": "1808c603-3b65-4647-82f9-3b5e5b127766", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258787, "uuid": "167f9c16-aab0-4c92-a233-053afb9afc21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258787, "uuid": "29c57016-1549-4f5a-8496-e3023dcd3288", "value": "8365263ceec31ba7713cdffc4fa20891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4a7262-362f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635233836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233836, "uuid": "2b012648-767b-4e54-9cd5-b2beeffed6de", "comment": "Malware payload (AgentTesla)", "value": "2705ca9846114cc34fd8e3909292b128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233836, "uuid": "343c3827-2f46-4a83-a1dd-2b42c3e06675", "comment": "Malware payload (AgentTesla)", "value": "833b7028bbc8e154e3f45fd0a700f022847208bf6706389ef61620f8d242e49a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233836, "uuid": "03c0b336-0708-4c97-aa34-1ae73854b25e", "comment": "Malware payload (AgentTesla)", "value": "88e4834154ce5694a1682be5762bcede3471b88f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233836, "uuid": "e34a1d46-c4a6-4458-a915-afed501c03ec", "comment": "Malware payload (AgentTesla)", "value": "b63485094f179f414e9874d2acb1510407996e6fa60f684d4f90b6a84b507a960c2d96dcf4be3f9466fdf0d0a6578dae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233836, "uuid": "81f05b0d-a3aa-4d09-b0ae-14579978b1c6", "value": "T1077423982420A3A7D79523054BEBD9C6C1512C054373E73CF90AE7B8EE4D4F822ABED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233836, "uuid": "609f4dcb-d38f-46ed-9fb7-ddf49a8748a9", "value": "6144:e6CdfvMZAjLi5LmCjWlTmxfBGQueLqxpA/mig/3D9hPIniDWwbLWmC9:ezNZKxf0Feexur235GiCwbLWn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233836, "uuid": "ff4b0abe-133b-49b0-bb19-12d7855d5ac9", "value": 367600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233836, "uuid": "9392f8e2-e8a1-450f-9464-f2fb9f3392ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233836, "uuid": "3e00c404-6097-4de6-ac38-34ac9e3d978a", "value": "AWB D2101002050-292.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e702440e-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635263196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263196, "uuid": "e5673bc1-82e0-418c-a19a-2809cf61d764", "comment": "Malware payload (Vjw0rm)", "value": "679df3b6b61c718977460885468ff91f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263196, "uuid": "c86ad017-0257-41eb-be0e-4eed2fc16398", "comment": "Malware payload (Vjw0rm)", "value": "8349ae326502162f6bdff870f1247b57d2bde1e552563e3b87182a10ee608943", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263196, "uuid": "dbb3f031-e4d7-417f-9e26-89477bcad736", "comment": "Malware payload (Vjw0rm)", "value": "7908e02a5b6ad2b772cab2f0e8b86dea46f209c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263196, "uuid": "5cb34de9-e4c6-4dec-879d-16d97dda70b8", "comment": "Malware payload (Vjw0rm)", "value": "d7fecb3b19e4b860f3a09c74b607bbc519fc5a6f378ec027b1b44f7c9375257180eee448c4b26bf57b2ba830b52a58ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263196, "uuid": "1d3cf405-952d-46aa-8ea9-c3aa1e3ae191", "value": "T17E8381459E401C4BB9B4D693109D0428DD15A2F4CF6E686AD1C1C9FC3EEF24BA78FEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263196, "uuid": "9c322cb7-d460-4b5f-80c2-70d6c6c8657f", "value": "384:t6/Hai4Vw4DrBwpJWfDwO7qr5JfAf2fGfgffqfdkkzP1fACaWKw0wP:td+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263196, "uuid": "dc12f6fe-c7de-43a3-b020-cfa4a9165b77", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263196, "uuid": "5619bae1-43e2-4f31-b36a-f926ef14379a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263196, "uuid": "55ec97c8-5ebd-4dc1-90bc-edf6f8b62fca", "value": "i3ns6_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9c7c76-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635253409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253409, "uuid": "a7acc413-5b84-4e9d-b574-731f39567f2c", "comment": "Malware payload (RemcosRAT)", "value": "a865f5d6cbf0f2bcf1fbf4c756f48865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253409, "uuid": "950ff6af-d8d8-4d2e-89d6-f06eee764112", "comment": "Malware payload (RemcosRAT)", "value": "83c047d51108d3d539e0daff2f024a1c49ce71f99e94c0b94cefafe0ef4bfb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253409, "uuid": "3e433166-19db-46fa-9626-17fc88c41efc", "comment": "Malware payload (RemcosRAT)", "value": "efef860bf3e38bea20710d720e70b0558bbcd025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253409, "uuid": "ea9ea9cc-5911-4956-bfaf-7849dd618cf7", "comment": "Malware payload (RemcosRAT)", "value": "c75fefb4ddbcb089eb4dd7616935de3365f2353981d19b76fbe1d249b8d13f4af4d1d374abe9e7f226090edb155dac12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253409, "uuid": "0b2e04ac-97e4-4541-bffa-93a587d75b79", "value": "T1573412981B6CA335E9BC1BFDA0285169133D95113153F34F9950F2EB2E7BF12C497A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253409, "uuid": "ccfb5fae-9cb4-4de2-9209-299acead0235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253409, "uuid": "50c4b4fb-c004-414c-8938-c294e9503d01", "value": "6144:dfd+sk089+UeXyw+7eZviYLHlG4UlHbmx8r8eH23EuGl:WxZ+dLFpUlmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253409, "uuid": "c37b61e6-72c1-4cfd-ab50-8b3a072df363", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253409, "uuid": "38db6ca2-342e-4eef-9692-8425faeda1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253409, "uuid": "b90b0d5c-9f8e-4226-a53c-c8dfcb7c1ce1", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51538a57-3659-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635251778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251778, "uuid": "476cb119-5592-4917-923a-26b56b1c433f", "comment": "Malware payload (AgentTesla)", "value": "8b3d1b7fdda39e30d23ee57a27696e40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251778, "uuid": "66f4bf16-db82-42c8-b7c4-3143cc6e7861", "comment": "Malware payload (AgentTesla)", "value": "841ac3599867f5d30d1ebd8be8191595321c3c619a9fab3d4503e93bee3ac42f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251778, "uuid": "ae9c3be5-e01a-4c04-a5c6-de3f356f6ca2", "comment": "Malware payload (AgentTesla)", "value": "cc60e11ee7084787dcb4b2000a23778c1f837e06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251778, "uuid": "dbcfc6e7-0c9d-4b54-aa56-237bc5fdb475", "comment": "Malware payload (AgentTesla)", "value": "5255eb7722a079c2b47f31207b8cef6684a089befff7d5ab25bc99c3c98680658861e83fba9967a40fb61e966db0ac5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251778, "uuid": "03d8d516-6166-43c3-b99b-f4cf7b920582", "value": "T19FA4E0B219D36A24E3CEED79F506785D23BEAF4B0D62683B7C6832CD2A75250C144D63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251778, "uuid": "0a99a287-e69e-46b2-928e-173b93e85b0b", "value": "12288:D/Wt0vsPy8n8pPm0wrvLrzC/TXTJSCcUY:imE68n6e0mjX0TXTJSCcUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251778, "uuid": "7f7c83e0-f222-49bb-88e6-d84e151104e0", "value": 451688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251778, "uuid": "b5c66cd8-5084-4739-b0f3-6c8cb8f6237f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251778, "uuid": "a3d88c9b-27b5-49e4-9b46-997380b87ed2", "value": "DHL Receipt_AWB811470484778.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4007592b-3659-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251749, "uuid": "1464d079-281c-40d0-9b83-ed8f27d42b62", "comment": "Malware payload", "value": "da76747260736f12ef17d6c193f8f08d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251749, "uuid": "42f1a9a4-7b2d-4708-9943-8cf69c8be03b", "comment": "Malware payload", "value": "846a4128ed0d2a10089631d13da49a6a001bd86bd9993abd21e763163a32b4b5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251749, "uuid": "21653cc7-df31-47f4-88fd-633c8a80cc7d", "comment": "Malware payload", "value": "289c348020b4a78e529d82fc1f964d3254613429", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251749, "uuid": "57c6234d-1a75-4ba5-8647-271d7726a25c", "comment": "Malware payload", "value": "18cfdc4cfeda4b82990f4d05d63cd8d942c1a6b57e17dfe1d5abf18ce6b92d1be57008060534757b2cfe9851cadc85b9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251749, "uuid": "63ceea4b-1fdc-46c3-9cee-d16888865bec", "value": "T11344BF36BF7AF671EBA3337D1DA4F95093598E025120CC64981FF6AA81741CDAC9DA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251749, "uuid": "74ce2f8f-a19b-4f65-b533-62629915afba", "value": "6144:iN4aPCpleqkkkkkkkk21+kkkkkkkRkWU1pkkkkkkkkkk1IzdFoOZLUqg78vbmkmL:zaPCEcqIXqg+nmP2wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251749, "uuid": "2cb5ef21-17c7-44ac-a91d-24f162646cfc", "value": 260504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251749, "uuid": "7c5a20b7-ebcf-435d-bcf8-413451980898", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251749, "uuid": "3a90467d-5107-4436-9d2b-313f376273d5", "value": "FDBP043221.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad52a1c-363b-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635239124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239124, "uuid": "273e96f3-631e-4558-92bf-168b164452ec", "comment": "Malware payload (Vjw0rm)", "value": "989740b7f7dab7211c4005e833f37954", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239124, "uuid": "ef8b6daf-cd5c-4908-a803-da0d08908e43", "comment": "Malware payload (Vjw0rm)", "value": "85bd3b83fb8e9310068cc155999c11d8ee2a71e88f757d59927a3564a97699e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239124, "uuid": "3eb3c291-5000-4873-8bd0-fbc735737596", "comment": "Malware payload (Vjw0rm)", "value": "a814fbaf107d44cbf8ae69a766cb5e7e90a08e4e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239124, "uuid": "6dcb1745-cdc2-4886-a706-7ff7c2a7bcc5", "comment": "Malware payload (Vjw0rm)", "value": "8a04acd1f33318bceff70b5f35ca362666316e5f5d2f1ef45e29fea4c06204a94fa3ffd83aa19ba18656f91bb994a6e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239124, "uuid": "f7b6dea8-981a-47c7-9ef2-d9c2145dfb26", "value": "T19F838F1192612D46B9B1DA02F71D0510DF14A6F4EF6AA0AAD143C8CD3EFF2075B9FE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239124, "uuid": "c5a2bb9b-bc39-48e6-b8aa-3a6a0ca75c8a", "value": "192:PjTKDrSsWruBc3N19eFb1ow9yQ9y9JkLE6+61Wsz+fr+5inP7TvsC+U6OEsO+Rhh:7TvPkrvmgpR/4K/KtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635239124, "uuid": "04736616-77c5-457c-ad11-86365e872ef7", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635239124, "uuid": "cf3dd4ea-215a-4c84-99c2-d300aab4cd38", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239124, "uuid": "8981b91b-0b65-4d83-b64e-c143d921fb6d", "value": "rq6cPaymentreceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cc443f-3649-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635245177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245177, "uuid": "ff048fb1-e101-4976-b726-dcf851e64904", "comment": "Malware payload (AsyncRAT)", "value": "0a55e4fb5b090402488c140ac4645dba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245177, "uuid": "3b13d389-e782-4f9d-9464-fa6443dc7702", "comment": "Malware payload (AsyncRAT)", "value": "8865821e232bb31b1db7b1220c933ee51fd7508af48d79d1e7882dd1bf624f62", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245177, "uuid": "692f4504-0108-4744-9c21-a8d5a5d4131a", "comment": "Malware payload (AsyncRAT)", "value": "d8468a555490ec956a61ff85c62d1cdb7bf9554b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245177, "uuid": "4b8f60b9-f85b-4480-9082-2b4181ebaebc", "comment": "Malware payload (AsyncRAT)", "value": "5075cffbd49c3a88b2148d6423af2ce8d6fa3a304524753a6f9283a289c4aafbb6a36bb845a27dbe6fb96c2d49452c33", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245177, "uuid": "286ab2fc-5ff4-4e4e-88a2-f04eecb3cc7e", "value": "T1D1E4C43A247D66AE680F51A2389795132CBBEA67E041CDDF17F1A6C388ED6350FC5C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245177, "uuid": "3f548d35-ef31-4676-826f-1b7cbdb4c982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245177, "uuid": "04ec7645-64b8-497a-aebf-72aec5639d58", "value": "6144:icv1meqx/+nCVYRccG5ne2Sf1zgFWB9WWOxu0WhfPJPP53vUhse+1Ye2q9Z:iPx/+nWc32E2Kg8Pz3vUhsP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635245177, "uuid": "0351bb10-7381-49ca-9a25-a4c3055df241", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635245177, "uuid": "65987ac2-4d7f-43ca-9071-85d538652046", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245177, "uuid": "ed1a0fae-5a99-4672-808a-6d17af012ecb", "value": "8865821E232BB31B1DB7B1220C933EE51FD7508AF48D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d6e412-363f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635240892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240892, "uuid": "e64884e2-5aeb-4cce-9461-0e31694d0dae", "comment": "Malware payload (AgentTesla)", "value": "55ff387a80c933e2e27651d205702c77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240892, "uuid": "2d7ec41d-73b2-4bb3-931e-93f92d081d57", "comment": "Malware payload (AgentTesla)", "value": "89eaea72efe8a887238e15f528cb2d5c463c052c31eeb4a0b24366387cb633bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240892, "uuid": "7c445072-7477-4c4d-bf6c-c48292776c34", "comment": "Malware payload (AgentTesla)", "value": "730e8eca9b7c656aca51bd087530143ee39aa6ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240892, "uuid": "e22858f9-f1a0-45fe-8aa7-ff1096cd0400", "comment": "Malware payload (AgentTesla)", "value": "0f19499233f4cecc990377cb8bb6db7318fb8d9901e290b02202f7bba3050e4c9929d169e09e6421be52ebf9345fb557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240892, "uuid": "3c3d81ba-406c-4c70-9a99-571349feb26d", "value": "T18C8412A93668DA35D57E06F7CDCE02400BBDDA437223D75C3E9C62AE51A27D10A0E2DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240892, "uuid": "2082246d-caea-4825-b6a6-dbdee3977322", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240892, "uuid": "778e6146-7eac-4311-9b88-5b0a264ef425", "value": "6144:dKsC+4BvQXtVejEOMLEDuIz1bNEL3bzVD2xi9lLukjVuGriv8ou4TVfdzqJiO0K:dKsCVv2tV+VMwDfDELtD2s9lLxfiHu4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635240892, "uuid": "2b87d91e-ee3b-4904-b28c-5dcbf5bd54ba", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635240892, "uuid": "b2d243ed-857d-4ee8-854e-77e3bff58cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240892, "uuid": "f5e77dad-abd9-49ab-aace-1f5175b2f5d1", "value": "PO0112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c5e0d9-3623-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635228745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228745, "uuid": "14601f65-d41a-44a8-9d93-21d598905f8b", "comment": "Malware payload (AgentTesla)", "value": "ab9198212e9f4e06ac1f1be4f35ec090", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228745, "uuid": "64511837-35db-4d77-88fd-41a71aa36cc9", "comment": "Malware payload (AgentTesla)", "value": "8af9699dec593ff53e17ce600215e2d8d36890a50b501ebb631123416b1aa636", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228745, "uuid": "4ad220d6-cc0d-4d22-bd28-85b6a1db6436", "comment": "Malware payload (AgentTesla)", "value": "7b17412e421b41644e8059c3e36d093dc5a14026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635228745, "uuid": "0fab1124-50cc-4c45-9ffd-7e5e99662c7e", "comment": "Malware payload (AgentTesla)", "value": "97bebd99af5a97118948dc4561c27022eed68a9cc2b48c96c9f364db74b7f5320facc28db2a9c2289b7ed7b0595d91bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228745, "uuid": "b3084492-9b9d-457a-8988-68991f75bb3f", "value": "T15D74123A4F58E374EEE703F9A5E6085403B430C43866F7674D96A9ADAFA374200279D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228745, "uuid": "91431c69-b84b-4e8e-b973-27ca61292107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228745, "uuid": "e81626b5-8f49-4ddd-a93e-96d8e7a8f41f", "value": "6144:gwsrMQWvfEgD0yXvRD54N7mpxUY5/6BLsy3mPTmUgnLczi38xoW:ZkWvLIyfRG4pxQnmbmLcz28x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635228745, "uuid": "afcb0307-59b2-4f9d-ba9e-b8c983bcb1b4", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635228745, "uuid": "3013d95c-f294-4fe0-b3f0-ec60cde17819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635228745, "uuid": "ef0cc4f8-35bc-44a1-bb66-5011f39721d0", "value": "SecuriteInfo.com.PWS-FCZFAB9198212E9F.25458.3821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d847ea-361b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635225325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225325, "uuid": "f93b02bc-ca79-4c5c-977c-4da423cc8c71", "comment": "Malware payload (SnakeKeylogger)", "value": "0d20e6334179eeadad75c218d0d9dca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225325, "uuid": "0d33818e-f684-48cd-81da-73923e84b394", "comment": "Malware payload (SnakeKeylogger)", "value": "8b94440478e3c9fd0991d121ef5ab7144425da4b074a65d93fd9111a515c0b8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225325, "uuid": "82a17563-bc93-4ac8-b2e8-5c6f152d8d89", "comment": "Malware payload (SnakeKeylogger)", "value": "ab19c8e05121be1bfed70591477610cd12e066ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225325, "uuid": "811e6bcf-92d2-4a66-a04a-d0700e3cc346", "comment": "Malware payload (SnakeKeylogger)", "value": "2c6609600d08357c345a2610bebb9a47e252317f8a958d1b758cb20102ddd411b669752795b475b29055216cf1eef7db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225325, "uuid": "333605d7-5ed5-4eb6-88e3-8fb9798662f3", "value": "T132053FC2F5C3EA1FC5D825B096818E2074546FD8442FB995FA6A7F9EE33F690A90C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225325, "uuid": "550aa19d-675f-4e78-9af2-d5c11bb4fd69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225325, "uuid": "9740599a-8a57-41d9-bc07-1afd06f757a1", "value": "6144:HUUQauRQfYaeOrR4XX5grW/kkb95CtphhptttcZ/wXynRqqeP3nZWoyElmLc15s/:qaGnoWJf5gl6iEC/MHmg789IW1dXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635225325, "uuid": "b78ad381-e883-4aca-beac-73e09876e61c", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635225325, "uuid": "9d46f748-0224-43de-b3a2-5f54ac0ac8ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225325, "uuid": "01695263-90be-44e8-9af0-bab748bee1f6", "value": "0d20e6334179eeadad75c218d0d9dca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef66fc9-3648-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635244580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244580, "uuid": "28ad2985-90d2-4b7b-a512-0e6aa4d85898", "comment": "Malware payload (RaccoonStealer)", "value": "eae52cba49830d54a7f2d6ec22739f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244580, "uuid": "856f2144-cc71-4795-8fbb-5fef055caf64", "comment": "Malware payload (RaccoonStealer)", "value": "8c721ee9cb909ee67cb5fdedb5c4cf84826bc6460ec6bb97a88015a031adce59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244580, "uuid": "1a09b836-a875-458d-b3cd-ac62c9f4d3aa", "comment": "Malware payload (RaccoonStealer)", "value": "0f59173f5667003819ba4a65499867fac2ea0d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244580, "uuid": "d052f2c3-1ddf-4b48-aaf9-b6b957ee703b", "comment": "Malware payload (RaccoonStealer)", "value": "08bdba27aaef88e32735c399f48be6ff7300487ef6f16c8174965cbcc89e8d31310a04a0cfff07a719535137428721f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244580, "uuid": "a96ccad4-0cb5-4f3a-8e48-6e9b8155734b", "value": "T1ED249D113ED0D871D4B606308869CAE2367AFCE3D93C5D8B77DB3A2E2E703905A65356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244580, "uuid": "6a0e7538-fc67-4e40-aa8e-4f002f519954", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244580, "uuid": "adc009f7-80fd-47e8-9b47-5d9621dffc4b", "value": "3072:AdtDT6a/6BO0fFyAFKWBYN55lcDKIb9QzY5IuVMO6P2+BwvHJ3/R1:ODX/6BOSFaWWeKvzY5IynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635244580, "uuid": "4eefe864-9eb0-486b-aaed-e9ee7f3d8ce2", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635244580, "uuid": "42bb4b52-7547-45cd-9065-6fff512b5497", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244580, "uuid": "e7a0432b-92f7-4c50-b53a-8f5720eca30b", "value": "eae52cba49830d54a7f2d6ec22739f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdba3cb-365e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635253843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253843, "uuid": "8d7f6767-d7d3-45d7-be1f-1ba4b3359cb9", "comment": "Malware payload (AsyncRAT)", "value": "27440071269793c618be07b874a84c56", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253843, "uuid": "b73c99cc-facb-4e58-90de-9dcc0bd51d7d", "comment": "Malware payload (AsyncRAT)", "value": "8d531c6802622720ec9f7a0e05378cb28b1eaf6501017500f3bf42271fb7c65a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253843, "uuid": "d8bcd557-b4a1-444a-a98d-e62cade5ca3e", "comment": "Malware payload (AsyncRAT)", "value": "4620f62d5bbe4ba34ce3f464440e2eeb335e2853", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253843, "uuid": "1f6809a9-b613-491d-9dea-fd10566c296d", "comment": "Malware payload (AsyncRAT)", "value": "64f837c598e69cfa66e0f7d386a7a5628a63aa95a46ec3e4bf8ec72ccd4fbbf82ef3f2a30e2acca981158886b2235f3b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253843, "uuid": "b17c42a4-80ed-49cc-b4c4-b891ac0541e1", "value": "T1B001F40282BEDF7B5586757A0C9A6C81B03846C717A0ABF77010D211E03D0F885FE5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253843, "uuid": "ca757fda-2f5e-4cd9-be5f-90ed1deff928", "value": "12:zTsQsM2dgrM3j0NHpTgd3pm9iV5R9Ggu+jZK7UuCSZ9y5HxYIJSyL6tR9Gg8fZPb:zTxr5NHpT2EUMgu+jZK7UuCSZcYI0YQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253843, "uuid": "55a3428c-3e71-422d-b5ae-77bcf0c74cbb", "value": 741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253843, "uuid": "6c1b94e9-872c-4c4a-8fa3-d39e2aa2bfcc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253843, "uuid": "5d9fc131-a4fc-4fc3-9e93-377df8931325", "value": "PMYIIWQ10054.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd1872b-3693-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276683, "uuid": "906a7c52-e51c-48c9-8550-d502913b9ccb", "comment": "Malware payload", "value": "6344c924caf43475e006e589cbcc73c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276683, "uuid": "cfadc8d0-1fb1-4caf-b393-41f8b0b17249", "comment": "Malware payload", "value": "8d71237ef97111bdfdc83650586751e5814c5d789d0cfeb06330c2d37447dfe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276683, "uuid": "07fa631c-59ab-4bdb-afc9-9bfa9406e338", "comment": "Malware payload", "value": "cc2bdc7d8a3e9c74f01c3257a71cc75ea426d917", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276683, "uuid": "98c45c48-a311-438d-b107-36107ac97b45", "comment": "Malware payload", "value": "5fa6582d3ee316db1b23358a719eb4ddc84054c81d819e35a3afa92a6d71dc911dfc60aa26b8756d52e5adaad6e2c203", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276683, "uuid": "61d372bf-5143-48c4-9624-99744d79d7d8", "value": "T15BA2CFAFE1E9B85AC0AC1C3E869E12721D84B0D176D757194352DC8DBF7384FB6850B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276683, "uuid": "3e81d8da-2cbc-4b56-af6a-38859bd30031", "value": "384:UD6/b5jD5+NuxSJIGiD+ysLZ2yuFUKKsx6sU7RMZPRWGVCz0NvqB:o4bqNvJJiDTyuxKhsakW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276683, "uuid": "2c188f44-4556-4d07-bc01-e620109804b2", "value": 22284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276683, "uuid": "f6a06926-7282-4986-8424-21b581bc050e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276683, "uuid": "e7689e90-295d-44a2-b446-b8ca98fdf541", "value": "6344c924caf43475e006e589cbcc73c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b50fc6e-3674-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263338, "uuid": "615921b7-d594-468b-bad5-dcdcc5b160e4", "comment": "Malware payload", "value": "40fd9adf4535d37c84ac1f809b05d1ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263338, "uuid": "58e14e85-c85d-476a-9d7e-20469554a06c", "comment": "Malware payload", "value": "8dafff3eb70fce71d878729b833f9b540877db8074c04f4c3c16abc7e37b65d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263338, "uuid": "8bc473d2-6541-4dac-a2ca-8fa2c8e2732f", "comment": "Malware payload", "value": "2f515dd02347d341eaa69d36f22572c5ec655c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263338, "uuid": "e1f49cff-109b-477b-b4ac-fa6e87273b3d", "comment": "Malware payload", "value": "a3cda7fcc1b3a00a7289f8f4a4401436936e41123d5c98b5967189ea79b45403f7f3f40e14c730d53ca791539afe886c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263338, "uuid": "685c9160-2419-4aac-97c6-7e9868e8b94f", "value": "T11AA47A0436E94B02E5BA67F41631544097BB7DAE287EE24E1EDE34CA1F77F444A60B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263338, "uuid": "3b54ad3b-3f62-452d-a838-b38262a52dc6", "value": "6144:VGxhLKPIuVvL78nUp+6dXQJWF+OD3vFCYaSPYhUez2Uj5nrz9IQLMz3JWp:UviLInUpzdOOD3vsYaUDKPr5GtWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263338, "uuid": "572b1b5a-e57e-4549-8a75-1cec61188e1c", "value": 490542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263338, "uuid": "13be66b3-5bbf-4335-8b88-c03cb744b819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263338, "uuid": "730ab1e6-56a2-45d8-aa7a-6860d29cee70", "value": "40fd9adf4535d37c84ac1f809b05d1ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2e2deb-3668-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635258351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258351, "uuid": "9f373b64-47db-4d13-a9fd-1faf64c6f306", "comment": "Malware payload (RedLineStealer)", "value": "76ce9287280a3c3d90e3ad7fcbf6ebb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258351, "uuid": "d00e8084-e7b1-42a3-8d42-34c1c0db0932", "comment": "Malware payload (RedLineStealer)", "value": "8dd7d227b91f847a521cd09a07baf54a0ccb9ac43c4ef41d482d9e3c06617d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258351, "uuid": "1582cd86-b8c8-449e-8d24-d172f02da8c7", "comment": "Malware payload (RedLineStealer)", "value": "d03059cf896ab8f0d7f1a885dc336f90108b37ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258351, "uuid": "2119a8f5-9cec-4d4e-8205-b09ef9de6e3f", "comment": "Malware payload (RedLineStealer)", "value": "ea50281b58581144bba6ea5d93370d1f4a0a8bb2591b57f3ada36010f39efb5b6785a21fa85c0b4a342dbf1e9b0dc379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258351, "uuid": "c3729317-b354-40b8-bea9-eec9586de117", "value": "T1D764BE10A7A0C035F5B716F84ABA93BCF52E7EA1AB2494CF12E516E947306D1EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258351, "uuid": "6926e6cc-75d5-48ae-ac09-29b1527d9753", "value": "8db81cce9914747c7ca79cf056ce5ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258351, "uuid": "1e6b89d2-c00f-431a-8804-4de1b9802447", "value": "6144:dTFmB5OFWCSxV8m5VQrbcGY8FW0s+c/fXTJhdGYxISD7xx:Nwa8QaykD8FHs+c/fXzdGcIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258351, "uuid": "334cb9a3-2b62-4c53-b3e9-20cc1df70baf", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258351, "uuid": "5f8c07d0-e2d2-4886-b9ad-236e72d35b69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258351, "uuid": "35c4784d-7ee8-4931-96ad-37d15dbd111e", "value": "76ce9287280a3c3d90e3ad7fcbf6ebb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691b9756-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635252677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252677, "uuid": "abf7060f-5c4e-4070-a3ef-c90af960db87", "comment": "Malware payload (Formbook)", "value": "30fd8c90836c14fd9337433cd48cbea2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252677, "uuid": "2a09a4c7-73ca-4f0d-a35c-42b001074c37", "comment": "Malware payload (Formbook)", "value": "8e8a9a1bc5147d7a70bd176acbaedeeb09c8eaa3e2fcbd25258f3ccbdf574e50", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252677, "uuid": "a8c60539-3917-48ad-ba2b-5a44197adbf4", "comment": "Malware payload (Formbook)", "value": "48ca0c038335879e545f5eb4585e6e6e355522e8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252677, "uuid": "524b67f2-57ad-4309-a86d-725a1cb15aa1", "comment": "Malware payload (Formbook)", "value": "aedd67864db48b05b33a39618dadb0fc82499143bfee4bf9e7d84ee5986795b89dcd87917a118111d5937c4618cd5a07", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252677, "uuid": "5d347788-4681-4e4e-9d13-b8134805acfc", "value": "T1277412293BA4C530C8BB1B36DAAE940007ECD9423A53DB1D3D9EBB7E54923B205591CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252677, "uuid": "27496931-1a24-460a-bffa-e416b54a6631", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252677, "uuid": "5eeff6c0-3f6b-4134-a618-069fe70a2c4f", "value": "6144:5cauQqijuoy6o4vaeZFYeDOood9KN2bvoNoL5kq6K4SBO2s7JkuDiJc:5cIfpo4SeD75w9SEoe5fpBGsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252677, "uuid": "cffca73a-14db-46ef-b8bb-368973a06e09", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252677, "uuid": "6eccf980-67cf-46d2-aa05-b94d4a2f79ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252677, "uuid": "5bdbd267-1ec7-4182-a4c1-14f1c52b21b9", "value": "DB_DHL_AWB_00117390021 AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb4a339-365a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635252388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252388, "uuid": "f845551e-61bf-4550-b03c-1866b1952e30", "comment": "Malware payload (RedLineStealer)", "value": "c38abfc4ebb4d352ad01492a22ef38f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252388, "uuid": "a00bb224-6290-4d77-af92-4ebf471ab3e2", "comment": "Malware payload (RedLineStealer)", "value": "8f1b1325b5346efae5f71aed37e7dc865f9edaf2c4711afc0a748bd2e2f64597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252388, "uuid": "e9192d9d-c4ee-4e34-9bbb-446abb86189a", "comment": "Malware payload (RedLineStealer)", "value": "82199dd63d6a1b705f0929bf76476b22db763e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252388, "uuid": "823594d5-e400-4322-8844-712aadd8dc1d", "comment": "Malware payload (RedLineStealer)", "value": "c3db2d1b9c213f4c841c5defdb71c63b75c6ec824fc6074526ae9240193ad84a7ada2d00c180af3d3be7b476fcdb0058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252388, "uuid": "6b661c91-af12-4935-baf9-f93a38419bf0", "value": "T198245C2CA398A631DB7D4436CCE10050E3F2DDD69147E72EA8C071ED1E92BE8F6562D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252388, "uuid": "7386eed3-09b8-438a-a733-effb2e842b5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252388, "uuid": "57741d9d-fc9a-4eba-830f-1e1736f9476f", "value": "3072:puALueQmrqu7DrS9LQxwiEQa0stlEz2x3pfeijZ:pd4Nh8wiA06Is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252388, "uuid": "9850e0db-5470-45a3-b591-403bf56ee542", "value": 222952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252388, "uuid": "220ff977-3fe1-4680-a759-0368df344558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252388, "uuid": "e9bc04d3-e6e0-43f2-8107-c424da8a9e7d", "value": "SecuriteInfo.com.Variant.Razy.976213.13679.15977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcd7cb8-3666-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1635257252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257252, "uuid": "c1505c0f-6782-4a1b-b226-642dbc9cbd52", "comment": "Malware payload (Gozi)", "value": "b76097aaa0ca490e5eb6b5a2dd13c5bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257252, "uuid": "c518372a-e618-43f8-9fe5-b8209d0e63b0", "comment": "Malware payload (Gozi)", "value": "8f409a0d417462b342281b3f869a397ed4f5b8fd5841d140c8c57e7df39ff4b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257252, "uuid": "ea908fc8-bd30-4d6c-9a48-2f0ddb6b7583", "comment": "Malware payload (Gozi)", "value": "9920ece38424d7902ffb7c28ae1b5c0d33e19aa8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257252, "uuid": "70068522-1d85-4102-9a27-045afe1053fe", "comment": "Malware payload (Gozi)", "value": "ba916368135bd126abe24b82e813cb3da561722559e229a39b4ac1df9eb94f086c12987f39e7201feede9d7d679fb3ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257252, "uuid": "12f05c88-8808-448a-8887-e732d2af2630", "value": "T12DC4D02223FA4074F0B3037540B6A5505BFDBE52A2398DCF62D6364C0A779C2A779B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257252, "uuid": "c357a3ce-177a-40a1-8a9f-d136896b24ac", "value": "6698b4206ea3129e8eff8896fcb8665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257252, "uuid": "9b228613-831f-46fb-8834-4a08a606ca54", "value": "12288:ZTl4osygnSsJVyq9wSVmawQBBfRwfp187:ZTWTyWSsJV59k8lwz87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257252, "uuid": "fbfcedf3-207d-4506-8ab9-a2e3e3980077", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257252, "uuid": "f8360ecd-6565-4ceb-956e-6a09a5fa91ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257252, "uuid": "8d8fb7e1-b705-4b58-a82a-d294bf76c674", "value": "b76097aaa0ca490e5eb6b5a2dd13c5bc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bde3a9f-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635262882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262882, "uuid": "1524bbbd-3efd-496c-98db-dfdcd05df066", "comment": "Malware payload (RedLineStealer)", "value": "410ee478ee194996744d00ae7646f038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262882, "uuid": "416b9c80-e591-49d8-b10a-b8125aa39e9b", "comment": "Malware payload (RedLineStealer)", "value": "8fbe85756d1750d22eec1ba3197811466b5968e34bdd243aa4e11e758122e923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262882, "uuid": "4acdeeff-05bf-4a23-b332-e655c509aa57", "comment": "Malware payload (RedLineStealer)", "value": "81e78e5ba1e2907fcf4b74fcd768bc9cdd03accb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262882, "uuid": "2e5e3d63-49be-4de8-ba3a-c8f83417ba05", "comment": "Malware payload (RedLineStealer)", "value": "bd3d96c197db58a96eadf1176321140b148ffdfc7371af8d728d18a9aaa5cb01efcde6dfaa2c1f27ed3592f74b0cf1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262882, "uuid": "889b8c5f-4d9a-4cb0-b440-2906c3f3460b", "value": "T1E654E0103284C836D5B3457099A5CBE15A6EFCD3EA3C857B2783366E3EB1E818635376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262882, "uuid": "0311f751-2e7d-4092-bc86-a376a6751671", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262882, "uuid": "5c5d7652-821d-4d06-8606-7521625114c1", "value": "6144:xsz0SRQEcOXKTWqC2P5adc4ffKYCrCugU9JynVP:B8QEc2sC2Mc43Cuub9JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262882, "uuid": "dd2a57ff-8ab4-4ef4-9673-526f24c68446", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262882, "uuid": "ef9484cd-152c-4dff-b593-253befe8fd87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262882, "uuid": "ee295a6e-726c-4185-b0c6-4d5b20f0b118", "value": "410ee478ee194996744d00ae7646f038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb7822b-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635263179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263179, "uuid": "df8da8b7-4915-42a9-9248-856288963847", "comment": "Malware payload (Vjw0rm)", "value": "57fe2a982978c1e408718062dc779ba1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263179, "uuid": "8f2a632c-491b-48aa-85b1-9d372fdc6e7e", "comment": "Malware payload (Vjw0rm)", "value": "8ffde50491ef1cfc93f417b731186a08fb6c3e5aad21f131a60b87936bd3f850", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263179, "uuid": "9c628619-8a30-40a7-9d95-9e2246e82a7a", "comment": "Malware payload (Vjw0rm)", "value": "cacff8bc0a97889e5096b6944795ca6eeb916e8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263179, "uuid": "71cd64a0-c1bc-449a-b793-de215343cbfe", "comment": "Malware payload (Vjw0rm)", "value": "89938caef44c11bf6ad3f670a5bda58d1aba061ad0a6f3b3dcaf3924600201b86db588493823226cdfb5ca58fea69046", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263179, "uuid": "dc59dc02-f9f8-42b0-a55e-2dcdcf915f08", "value": "T1FF42AEC007809CF387D34251413E5E1271FABB7F04C671BFA28661E81212BD2BB7422B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263179, "uuid": "0f0e0c8c-777b-4598-a0e2-8dc661a75c0b", "value": "192:EoGqUHTZNSsaAlSKUCwrU0u7mWhP/8bG4RPHZgu+T9vvXBXv7cP9yfBD497SSgXO:EtHTZNCjnLG2GOPH/+pvpXv7EAfh4ZQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263179, "uuid": "a0a6b089-a91a-4801-b15d-88a2fd5910ac", "value": 12103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263179, "uuid": "45891dc7-0bf7-49ba-9ffe-866fd74e4ce6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263179, "uuid": "a4d8cec5-bed2-4e71-ad74-296688de37af", "value": "#1ZKS82JS90.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5586ad9-3625-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635229585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229585, "uuid": "3decbb7c-b896-409a-9719-39224fb661da", "comment": "Malware payload", "value": "4f92b8ab18145b4bd7009272b79d8c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229585, "uuid": "833dee25-4c36-4820-989f-3a5b371849d9", "comment": "Malware payload", "value": "911affc204ad6de0e376976f333eef50f598d5e8f2d771c5232027824a8b2483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229585, "uuid": "5944ff25-564a-4cf4-a877-fd80b0d84f3e", "comment": "Malware payload", "value": "a52155d462dfea649d5b2b83809e93f2f0f7f50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229585, "uuid": "cea4218e-2cac-4ca8-a03f-438625356330", "comment": "Malware payload", "value": "e244bd753a995dc083d51f1a2d170ea613d3bab5ec6ca3dd8442559ea0d148cb50368248dae3d71834ab57e9dc29c93d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229585, "uuid": "76e20eaf-c392-45fa-a7bc-4247fcdb612f", "value": "T16DB5123227995FA4E47987381A70408413F6B746E362D7BEBCBE50DC5A21F8253B7326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229585, "uuid": "37ba989a-f2d8-438c-a072-2e3515c405b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229585, "uuid": "f16fa909-964a-4154-8ff3-e882207fa14e", "value": "49152:Ykc6VfUVOyQ+qCw1+14H553G+UUUUUJUUUUUU:zfVIOT+S1hDG+UUUUUJUUUUUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229585, "uuid": "a82457f4-c145-4c05-867d-995232eeaf82", "value": 2394624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229585, "uuid": "ef9eecf4-c96d-46ac-b0c4-bbeb5fb0f09c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229585, "uuid": "475fd045-9a7f-4e35-b671-076939790502", "value": "PROFILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33272040-3638-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635237554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237554, "uuid": "b873494c-585d-48fd-b342-23bf3fea3d03", "comment": "Malware payload", "value": "73cbf76da5a9843a6bc2c2edd4a03b10", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237554, "uuid": "75991f8c-24ee-45cf-bef0-8d7aed73fc24", "comment": "Malware payload", "value": "917b072f2e66479aceb1d0112026b2eb8f2f0a150831bbe78f78b2429e80db08", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237554, "uuid": "c0e4cfcb-e505-4b96-80ef-823c5410cec7", "comment": "Malware payload", "value": "d20f41894b09785f9d6437fc05e0f5c4c195dfe6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237554, "uuid": "3e4b501b-bc01-4b75-837d-43a11f14f93e", "comment": "Malware payload", "value": "7eec4d711ea9664d12eefd578e3f1741bba9a8f53099f7d556a741c9066958eabc512a6f531a81470b5e6cc72c41026a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237554, "uuid": "d774b8f8-458a-406e-9ea5-f10aabaa957c", "value": "T174A5AEF876047DE6266F536BDE96ACDC13A627639ACBA4CC806477C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237554, "uuid": "0e10a07f-92c2-4090-945d-2dc8b4b1e90d", "value": "24576:A8//p/hH/Z0tmxFBLfnGS+QOIhX5ZhoSlOAqOMB+R+DsGVVAH71l9ji+8Ze8mqoi:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237554, "uuid": "2da4132e-566c-403f-84f0-aa9bb0c39071", "value": 2062679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237554, "uuid": "829ccbf1-9ad6-4367-ba48-cbe88cb5700e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237554, "uuid": "8fd2a57f-a347-4a9a-bcc6-2be808c82896", "value": "Geotechnical topograhical.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b98e25-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635251171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251171, "uuid": "b900a5ce-9154-42ab-9340-a8dfbe141761", "comment": "Malware payload (SnakeKeylogger)", "value": "03553a63063d52b0d8e85c7563a3fa0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251171, "uuid": "be0241f2-9ba0-468e-86de-fa4141e018c8", "comment": "Malware payload (SnakeKeylogger)", "value": "92c1c7dc0e755009ab68f7c284521e6d6f646c9d7a1ebe83807d74a9dae5f71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251171, "uuid": "5a9cb7ae-0d82-4b0f-84b0-5d31b59590c4", "comment": "Malware payload (SnakeKeylogger)", "value": "f280bb77caaefb969909de5e42ccf4940d4b5b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251171, "uuid": "a23700d2-df7d-4096-83f2-95b0086306c1", "comment": "Malware payload (SnakeKeylogger)", "value": "ca1c98e4535203498dff79f129f18b7b046712db9c6a314e1c46d970e8a1681eae3245253a7327ad9ffdc473fba274d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251171, "uuid": "c7494b3f-7ff5-4b5b-9083-13942ec8359e", "value": "T10F053FC2F5C3EA1FC5D825B09A81CE5074546FD8442FB9A1F96A7E9EE33F690A90C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251171, "uuid": "59b82251-00fb-4b8d-be53-934f7aae4bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251171, "uuid": "797fcefe-b37f-4cb3-8919-ec3e58ef594d", "value": "12288:fAgBGviaYeWD5gl6iEC/MHmg789IW1dXg:JBKZY5D53C/MHmg789IW1dXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251171, "uuid": "546ed6e3-9913-46a0-93df-cf2cc4633872", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251171, "uuid": "531d5a5e-6333-4c11-a8e2-1281b51a6a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251171, "uuid": "92c14e0c-0465-4edc-b9ec-8c23306b0a1f", "value": "Bi4P9gzPgEuPau5wQ3n3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27c2c0-366e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635260683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260683, "uuid": "a672b347-e83e-4f4c-a1eb-bfe70909e63b", "comment": "Malware payload", "value": "14a8f3fa43a0f181c0a8ce76f65252e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260683, "uuid": "03493b08-ca6f-4e3a-aa04-03c0ac0c00c3", "comment": "Malware payload", "value": "9304e7a630dfef693ff5e7e286b2ad1894dabf39852cb9d65fe521c6d768055a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260683, "uuid": "d05a47de-3f64-4d77-a8af-5bc31a2d0924", "comment": "Malware payload", "value": "73ce20d786bfad8705acf7903032436ac2dcb1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260683, "uuid": "e86006f6-85e8-4295-9039-ce5d1588d5f6", "comment": "Malware payload", "value": "8b0966b7e721bb2350d827dca0fa4cf7f4611fb3411bc2ddedd82df9e16a1d60263c5f7bccfe09a25cb1d155f8d0e93f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260683, "uuid": "36ea5cff-c238-471a-9be7-29518b84621c", "value": "T14DE229223B94D198E1C48A728DC7DE6016F0F9339C52E66F36D13B0E1E33B87E615695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260683, "uuid": "423b74fd-11f0-45fe-8223-a247e25db7b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260683, "uuid": "4dcb7330-3cb6-4bf1-a297-09d8e069aa87", "value": "768:jxIgUIekRd9TtOyBCqZbOqqPOGXn2sPmF90PGb:jxIgUIekRXoqSxX090+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260683, "uuid": "67b7e1b7-ae45-4aa9-bea1-283b25bc4421", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260683, "uuid": "2a8567bb-1f6b-40cc-b583-6d1927c11b20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260683, "uuid": "6d3ee2fd-da0e-449b-a739-bb8845b67c1b", "value": "14a8f3fa43a0f181c0a8ce76f65252e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac3e8c6-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635260652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260652, "uuid": "4b0c0111-313b-48ca-961d-26a081dede61", "comment": "Malware payload (Smoke Loader)", "value": "fbf05b8c17ae821b9d1df84962a186d0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260652, "uuid": "9d369c83-c3f2-4396-9bef-907ba212736f", "comment": "Malware payload (Smoke Loader)", "value": "93929f6eebae9f8d20b1807b0d49bd983d51ebd5b223bcefb8cfb1350906cba8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260652, "uuid": "cc1fd871-ab8f-40a7-89f6-8db698db21b6", "comment": "Malware payload (Smoke Loader)", "value": "4faa7bc1a96382acaf56b1b679cb17f623f587c6", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260652, "uuid": "5f457e62-eafa-474e-acf3-c5fd9b74ea38", "comment": "Malware payload (Smoke Loader)", "value": "c3fa14dbf8377b06e0087e37661216018ce5fbe8270cda7b173791e92b5bf4321c299c649b465544a2f89b7b4e93f856", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260652, "uuid": "07d27ae6-8a08-4ee3-aade-e5d6f7769e60", "value": "T1BE24AE10F2D0D475C5BE05718861CBE15A3AFCE3E93D916B679F3A2E2EB02805D2635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260652, "uuid": "164c2257-c0f9-4aa5-a325-af4530663633", "value": "a756627435b382dc3646987f64d479a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260652, "uuid": "4eb14a15-65c8-4183-a129-e549ec24604b", "value": "3072:GieVKSsTY4cnn41JyHwNzPODykBNRcjQz7hi/uVMO6P2+BwvHJ3/R9:kV6TYxn4DiWeD8E7OynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260652, "uuid": "dcee86af-dbeb-4597-8433-d2c83ac7589d", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260652, "uuid": "132895b9-f9b6-4fb5-9aba-baeb25f1dfbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260652, "uuid": "a62b62b1-43e9-4ebb-9f82-e4f8229512e5", "value": "fbf05b8c17ae821b9d1df84962a186d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c4f7f4-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1635257183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257183, "uuid": "1d710625-4b12-48e9-be83-d1419d21eaa2", "comment": "Malware payload (Gozi)", "value": "383f57d9665b8533771ea9d033d16080", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257183, "uuid": "3e62b33a-3fb1-4fa5-b7a0-ccd53af695fb", "comment": "Malware payload (Gozi)", "value": "9489b404fde84f919122108ec0b56fd7376dbbc706a5733aa5e2dc3aeb005034", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257183, "uuid": "0692e395-9948-4a32-b9c5-bd8832e17b2d", "comment": "Malware payload (Gozi)", "value": "a544d243cd894f6b320df866c8d1de2da7cbb57e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257183, "uuid": "28b376cb-5676-4c6e-ad60-8b05e79be35d", "comment": "Malware payload (Gozi)", "value": "2c9d9c716681f83c524a1c447300f5849afd6d47c571d594939d09928d36181387ccbeb5eac11850f81d3e3e2d1524c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257183, "uuid": "e8496626-d05c-436d-bb73-f74c5887bd27", "value": "T1E5A4CF1331F90074E1BB53794065A5819AEDBF52A73ACDDB62C8216C82BBDC1AB3D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257183, "uuid": "ef31c8a8-3a86-47ca-bdb8-25db6c166500", "value": "ac25f5a88b067ef166efd1cbfb31ef12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257183, "uuid": "bf8063ab-4dc8-4b02-b60c-d6eeabeea992", "value": "6144:V/L436NJ3cuwUO38PRLOWIs4fuHflXX8V1eJdf6h0GrjqI8E14:Z4368LF38ZqseSXSedCfoEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257183, "uuid": "e31a7b6d-6135-4004-90d0-e41752f35c21", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257183, "uuid": "b1eb5282-28f9-4154-a23b-44ee6f5992cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257183, "uuid": "d7e4b217-1951-4788-b0c2-6eba8613bf32", "value": "383f57d9665b8533771ea9d033d16080.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab12a9b1-362d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635233031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233031, "uuid": "161c0074-a2cb-4d73-99b0-1d453950bc79", "comment": "Malware payload", "value": "f20714420113afb1b16f1dfe4a701c42", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233031, "uuid": "1a57cd25-78cc-4b3b-9658-a377c5c62e41", "comment": "Malware payload", "value": "95898595f6352aeb430b9b0ea8ecc363a057f8224ed81f69611db0dcab0fb969", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233031, "uuid": "17d7a332-ef69-48d5-8001-57283a8903c5", "comment": "Malware payload", "value": "28a00bdba94f538331c30d181867e78b9b79ea19", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233031, "uuid": "90f3c054-848f-46e3-b620-f18c2fe3d079", "comment": "Malware payload", "value": "893b3f5a41f6fadf8a4da4718cc2d791d42b1673756da13f82967a7c823460c20e0447f95e247dbf8cb2204a0cbddab3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233031, "uuid": "03c24bd4-2303-4ba3-9198-65a8c518bdae", "value": "T1B37423BFED81A498C74D97B449A576BD98123EFEEEAE04F51232DC287D10ED448D3908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233031, "uuid": "0561e7aa-b088-490f-9276-b03c710c3731", "value": "6144:wVGd+qcian5E3qYB5pyEiWtLm2c12A8685jTEQemBdYvH33fItrNFyAijlBjq3MO:wc2ipyEiWtLm2zx6ijwQemBdYwdTgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233031, "uuid": "8abced9a-bfc5-4c7e-a46e-08091ef82030", "value": 367102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233031, "uuid": "445be0c0-c6d8-439a-8d58-d486c048a6e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233031, "uuid": "3b00df31-18ba-4756-b225-bd5259ab79d1", "value": "SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01665af-3673-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263185, "uuid": "5547a008-f286-47ce-8616-20ea41527a1d", "comment": "Malware payload", "value": "7ebabfe726fe8d15ba6ea675d1262ff5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263185, "uuid": "78d80991-9697-4a6b-8c85-d642f55d0645", "comment": "Malware payload", "value": "9602064fced542aa3a6d55326664045d58878abd9b3879bfbff0b63ad381c811", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263185, "uuid": "dabcaaa3-d9bc-493e-bbc1-70e060e3765b", "comment": "Malware payload", "value": "92000e0200e298dd2ae45b815df206f516cba303", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263185, "uuid": "4cc37b92-d116-4446-8615-e3941676b3bb", "comment": "Malware payload", "value": "11982f4d69f286fee6e1920cc882d920d6cfd646394cbdfa055c2b3d8f5744b9c3aa68c7fbc1d58901fdcf0e2393adfb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263185, "uuid": "644363b9-1e16-4bfe-8c36-0c789320d117", "value": "T1667423059F801D87B5B4D697D05C0028FE25E2F4CF6AA466DC9199CC1EEF207ABC7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263185, "uuid": "452b4160-d996-4d22-b44d-5b9101e214ab", "value": "384:w/XvYVwIzLRw5JmPDwO7673PQPGPGPgPPKPd3JPgCaWKgkwn:vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263185, "uuid": "1d501e7f-4fe1-410a-a706-b1a090046d92", "value": 362748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263185, "uuid": "c2d77c79-e393-4a4c-b938-c5ef9930d744", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263185, "uuid": "4adfbc96-9403-407d-b5c8-d1257331f740", "value": "k1m4_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a078b45c-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635253629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253629, "uuid": "8173ebec-0f22-4646-9f48-4d61f7085b5b", "comment": "Malware payload (AsyncRAT)", "value": "7714485973a54407bd021a4682ee7f1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253629, "uuid": "c95a5174-6c9b-4ae8-87ba-414adf2ffb86", "comment": "Malware payload (AsyncRAT)", "value": "96fa5508157c3e0b18ccaa02417198c62816e549791997efd29dbcb8801e0db0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253629, "uuid": "a670109e-a61c-4a87-8407-118d67104198", "comment": "Malware payload (AsyncRAT)", "value": "3fcccc878f029e37d17c7124b6b06d869ebc0a4b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253629, "uuid": "eb4a3359-5b01-4e61-9590-8dfae78d1131", "comment": "Malware payload (AsyncRAT)", "value": "ab0897a06a879232d708cc0ba5e6654660634d5d544ff5e3e4a08fd11e2805b8995164ce64b69f0bac6bc658777dcefb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253629, "uuid": "45f39c6e-0c2c-45b5-b148-6c00c0bf6d84", "value": "T12411E122DC57FFE30925E795A0C855EEC1F894C447D44CBC1089344A28FE4792A9D8B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253629, "uuid": "37717b47-4c5f-47d2-b18b-613ca5787f90", "value": "24:mV4UvXPc6BJjK0xAU5iexBFN0oFnfH+8C:s4eUsK0xARe4Yng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253629, "uuid": "813153c5-a26d-4dd3-a303-ca706a7f7531", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253629, "uuid": "edb619c6-078d-42c3-b931-dbe5a4e3d206", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253629, "uuid": "e637dc5d-5d77-4f79-86b9-968739b7eabe", "value": "vergi \u00f6demesi dekontu 26.10.2021,pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd9a3bf-3636-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635236958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635236958, "uuid": "1212e072-e79e-4862-a8df-c288a2f0da72", "comment": "Malware payload", "value": "fd357493bf4ce792f389cd1388766ab9", "object_relation": "md5", "Tag": [ { "name": "psagent.ex", "colour": "#82C16F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635236958, "uuid": "5abd642a-61a5-4636-bead-795d5778d425", "comment": "Malware payload", "value": "971f8acd5f7c619dc234db9aa1a304d24025887704567c4a60c394a0af9b91b5", "object_relation": "sha256", "Tag": [ { "name": "psagent.ex", "colour": "#82C16F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635236958, "uuid": "2148138e-1400-40f7-8f2e-52f7ca05eb40", "comment": "Malware payload", "value": "498066ead0c547dca2c267e2bb5cd25cc0eacd39", "object_relation": "sha1", "Tag": [ { "name": "psagent.ex", "colour": "#82C16F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635236958, "uuid": "29fc4c4f-8268-499f-98cd-33eb51780825", "comment": "Malware payload", "value": "d0ff3449d912a2a63264af5b02d80acd1cc985a0c08af746fd8a74d44f576f5ae3966a50415ca700e57fd0fa1fa5a1f0", "object_relation": "sha3-384", "Tag": [ { "name": "psagent.ex", "colour": "#82C16F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635236958, "uuid": "27cd69b2-de14-4905-b798-a8d09aab17ee", "value": "T186B4D072034457BAF2840BD4465B324F30F2D1563A281189EBF36EDBBC2ADDFA474666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635236958, "uuid": "b86edf93-c290-43f6-bff4-e2cb89dafc1e", "value": "1536:VLl1ZunvevJzR7y4YbJaeiUd2ySRsk+NMpLZXWVBgE+Ub5aTTu7YY3E3+jcYZduq:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635236958, "uuid": "de2b24af-d75c-42c7-82d5-015952565f6f", "value": 528565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635236958, "uuid": "a0004cbd-9ef5-471a-b719-e1879aeeeb00", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635236958, "uuid": "1a8c152d-4d6e-4f5c-a677-93401f1ed37a", "value": "1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9913203-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635257107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257107, "uuid": "634c373f-8eef-4b9d-b38f-41a805c87bc8", "comment": "Malware payload (Smoke Loader)", "value": "d4a89fb0fbd11689a4053bbaef1897f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257107, "uuid": "8d498508-dd47-4c73-a9fd-c70c76ae9b57", "comment": "Malware payload (Smoke Loader)", "value": "97247f56010511a82492c3febbc0a1f2cbb0dae097178b76331373ed908a3434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257107, "uuid": "312f3f9a-5c32-47f0-a423-4ceb403066dc", "comment": "Malware payload (Smoke Loader)", "value": "5fd6d9bdec48dfad0277b55287d67266456e79f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257107, "uuid": "802f096d-e479-4860-a262-308ba558eb64", "comment": "Malware payload (Smoke Loader)", "value": "ffbd485466a7eadc67fb7c81ad0f7e05f1beda15cde07f36458bbdc4ba55d5a07fc5220fe1115b7c960fa8f4b8ca483f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257107, "uuid": "36b8938b-e1a7-49fb-8c92-11443a0e9333", "value": "T18704BF0137D0C771D4B75A318865CAE15A3ABCE3DA3D894B3793376F2EB12809A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257107, "uuid": "7c4b0d07-9243-4605-82d8-dc82f7cc9a23", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257107, "uuid": "c3403145-76f4-4046-a79a-be07c513f644", "value": "3072:XH/ioYuuGEI/bn+hcfUm4iFm0fccjuzUuVMO6P2+BwvHJ3/R9:X/ikuGEs+ecOEkVynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257107, "uuid": "397ca403-6092-445e-ab9e-524876f7ce41", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257107, "uuid": "8c9c9d5b-05a1-432c-884d-e726086d06a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257107, "uuid": "06fab349-73de-4715-9767-bed304e24c5f", "value": "d4a89fb0fbd11689a4053bbaef1897f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db34d0d9-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635263176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263176, "uuid": "9ea10e77-0e83-460a-bcc2-ba968acdca14", "comment": "Malware payload (Vjw0rm)", "value": "eccadc7213315b50deda629c20791a5f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263176, "uuid": "6bca7041-1a78-42fa-98e0-94fbf97f88b3", "comment": "Malware payload (Vjw0rm)", "value": "973d5f2bb3e24ec52d0cfd5fe372488f71823a8341a9b02e1f9acac8880f7d1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263176, "uuid": "a2d441fa-df87-4f4a-b147-558a59ef79cd", "comment": "Malware payload (Vjw0rm)", "value": "312674d8a7d1c25a056f15255b7117cd86b842b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263176, "uuid": "71b6612f-2805-47dd-bc83-5eac6aa67236", "comment": "Malware payload (Vjw0rm)", "value": "2ef6a02dc50a5d58a2d9aa3589f5e9470892f1c237b00f853053f3fa57bc3078658230fe31569bd8fb5feec9140bfcee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263176, "uuid": "53007d1b-66a5-487d-bff4-8a460bf7700c", "value": "T1E18380119E401C66B7B6D692F3980124CF15A2F4CF2AA55AD34359CD3EFF207AB83E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263176, "uuid": "805d441c-ebf0-4f18-8f81-0db379133ecd", "value": "384:w6DrhWr+y1tvMWfHvYdfQ1nu4cLBQCcp2fjQ1BeTb9ADDcQnerRsfAf2fmfAffK7:Sgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263176, "uuid": "a7d8b050-628d-468b-bb44-ac3ed03e5e14", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263176, "uuid": "5869ec37-c229-4433-9b42-3d23784ae250", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263176, "uuid": "888915d8-8cbf-4b04-84f1-9f61574da1e1", "value": "g1m2_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc02d224-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635263178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263178, "uuid": "b7f8ba1c-e130-4391-8433-5ce9e6f1f71c", "comment": "Malware payload (Vjw0rm)", "value": "227c97971e3a533da777df3558817c33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263178, "uuid": "72894377-35d6-484c-a645-58fe63a126d5", "comment": "Malware payload (Vjw0rm)", "value": "986a95a00339276c26cb9a6ed50fba01e5c40e3cb0201c1c03aae14002a564a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263178, "uuid": "f5cc4703-9c66-4367-8b7d-e16f6b3286d6", "comment": "Malware payload (Vjw0rm)", "value": "20e0339535e0c0ca20830a7929dd85c0648c5c11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263178, "uuid": "0072b91c-d08e-4510-ac96-4606abe11b74", "comment": "Malware payload (Vjw0rm)", "value": "7379ceb5fbb3c47429aea1dbe67159517f65793559f233fae640a94d59b92d76faa240d2c03b4406c02527aff7a46811", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263178, "uuid": "a0def614-4544-4333-9efb-22aa18254f15", "value": "T19B838F12BE501C56B5B4CA9210580424DE17A2F4CFFAA45AD44D09CC0FEA27F6B9FEED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263178, "uuid": "f745d12b-ff47-4c99-baa1-2b1b36fbd6a7", "value": "384:wvnvI1AYT7hA55m/TAOrabX/g/W/W/w//a/N3p/wSqmaw0Af:/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263178, "uuid": "e819ddad-3748-4f69-870c-74b3da9d92b7", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263178, "uuid": "d23751bc-e26f-4ca4-a39d-fb2dec6a3859", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263178, "uuid": "f5c877b2-9827-4956-84f0-4d82572fcb7c", "value": "g1m3_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f08504-367b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635266572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266572, "uuid": "e6e60355-649e-48a8-ad24-ebebf9477551", "comment": "Malware payload", "value": "ec78bab4320c882ce49cbff22c21595b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266572, "uuid": "c55d936f-3b5e-4fdc-a46e-0c6e29eaf448", "comment": "Malware payload", "value": "98928bc4830b97b64d0b7980f8ad9fb76e490baff71aee506661f30878eda15a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266572, "uuid": "ab9d4e14-aeb5-4286-9d2a-e679fa6516fa", "comment": "Malware payload", "value": "5cc71b82fc8d12bc1c0bd2ceeb409dd8f696559d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266572, "uuid": "46d41434-709b-40bd-b407-ab9c5f8b640b", "comment": "Malware payload", "value": "7ce0ed6698a07bebd94c22b6f7f0297f020e58f7791bce622afaeced44047d87062f2497f6e2c349ec4aadb48fc95949", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266572, "uuid": "72c6fbeb-e9a1-4163-801d-61af0dd4dcee", "value": "T1C4F312CC9A836E39CE9BD4BC9417D0B8F6B78B4639D1701AEDDA164CEF8411F0640696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266572, "uuid": "0a3ac185-c5b1-458c-a8c9-a326992ad248", "value": "3072:YetSgyLjseWxEDkeB6/BO/LA44b/p1GuM0f5f/YsqKL0E0u16bkgmbOmRCn:YetqLjsesEDbkO7e7G+x4vuUwg3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635266572, "uuid": "4138a680-a65f-42f0-bafe-4f881478a1d9", "value": 171617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635266572, "uuid": "88e982c4-dedf-4368-adcb-4b7713d005e6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266572, "uuid": "bccc5343-7763-4f2a-babf-938d427673cb", "value": "3357.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62262ddc-365e-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635253954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253954, "uuid": "7c69f3d2-9299-4135-b102-b11507990a67", "comment": "Malware payload (Vjw0rm)", "value": "b67314fee2b2047546e929dca704731a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253954, "uuid": "811460c0-b33c-4a5c-913f-bfe4a777a87f", "comment": "Malware payload (Vjw0rm)", "value": "98b56a72c577994d1879508e98646f17b84047fd4480fb317de35df0a1b4ef79", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253954, "uuid": "47e1f410-ac41-4330-bff6-e8f66de2423d", "comment": "Malware payload (Vjw0rm)", "value": "98ee3ee3df063b97c210f714851bab4d74f3379e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253954, "uuid": "0d8ae100-a5e4-4a80-bc9e-8c678c0b456f", "comment": "Malware payload (Vjw0rm)", "value": "275036afeed4d56a2521a3ee2f7adc32de4110c557a80ba0e0d1041cc4b8b82d414bfda2e4755fb31cc11a94a67327eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253954, "uuid": "4ae01690-bb02-49d9-9be5-9612bf1faf83", "value": "T1C1838F019E431CC6F5B5C6A2609800E4DE17A6F4CF6AE4DADE4249CE0EEF24767C7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253954, "uuid": "4b759a0e-7dfe-4aef-aa88-73a0fcfe92d4", "value": "384:APnPI1gYzbBg55m/TguL67X/g/W/W/w//a/t3J/QSqm6wUgX:vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253954, "uuid": "5c786638-1bdd-4c1b-8c83-675dd698a70a", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253954, "uuid": "9aaba7d7-c5f2-48ef-b7ee-4121d2f60770", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253954, "uuid": "4a5740d7-b2d9-4d39-9ab4-7d45cc5e3925", "value": "kaj1n3_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e3981e-3658-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635251616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251616, "uuid": "3cd373a4-b1a4-430c-9d89-b4b77907fae2", "comment": "Malware payload (Loki)", "value": "f030687eeda9a3261ba84ecf24e2397a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251616, "uuid": "5f0dc11e-48e3-4227-8938-781e450eea49", "comment": "Malware payload (Loki)", "value": "993ddc3851bc4e648bec4f039b7d4acafcb2fe21440805ef6bbf1509d5666a21", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251616, "uuid": "36fe27d5-973f-44f2-b6ed-96ed68715d1d", "comment": "Malware payload (Loki)", "value": "2dd7d07bc561b5d3ebb61ccf7bb941d5f40502dc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251616, "uuid": "4fe19961-cf18-4b32-b3fe-512c86e8cde7", "comment": "Malware payload (Loki)", "value": "803aeada878bf9a5c1fa2dec2036575216e6d0baac720294324a378ee5ffac94f8b17e3283143d9a365354f572d84d1e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251616, "uuid": "c96550f6-246d-4e47-9c7c-ddf67d37727d", "value": "T16A84E1231DED7695D09F6EF2A48C4AD92624BC50D9B2672C11643741EA3FE3BC9C0E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251616, "uuid": "6819cbc6-e72f-4997-963a-46b599ec2840", "value": "6144:DZaIJ1N5K3Aer2LK+Ku3xCkRLCGsYJaBCWfti2CnSYGJCs:PfDMrqKupTpkCmtip0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251616, "uuid": "1a8002f8-aac5-4fae-abbc-066c482d8955", "value": 378360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251616, "uuid": "31c31e8f-8b51-4de9-b34c-e3761f0ec1df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251616, "uuid": "76b5f8f9-a27d-4751-834b-7ca1e9e29df7", "value": "Euro_payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df98cb1b-3650-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635248151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248151, "uuid": "782c7833-9084-4b57-8a29-46aba3930521", "comment": "Malware payload", "value": "a612d9e64a7b3d2836390adb8dd22866", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248151, "uuid": "8f782996-776e-4ffb-ba53-6b4b7e6b9cd7", "comment": "Malware payload", "value": "995b8ffae8a66e17203565b09cbc2dc46d3e9ae0e61c31de29a3653430f4eda5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248151, "uuid": "b65f4a64-8c5f-45a9-b25e-9a63d1468d07", "comment": "Malware payload", "value": "0c7626b07395abc315751908c136df4808589b3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635248151, "uuid": "523b4cbf-9219-4733-a09d-365f6270e749", "comment": "Malware payload", "value": "f249c07b94791709ad9174237914385bce73755b94eea70973748a0b7c1eb1178a7af9d0e2895c42176b0664d4190180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248151, "uuid": "aed1885c-ca00-44d1-aa75-ff16adcfb457", "value": "T1FA8175ABBA29DD3AC14315763A63422637B683A32581469BFE9854F8DF02D56A40F34C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248151, "uuid": "17829d12-657a-4108-99b9-961402537a0b", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248151, "uuid": "8e207f51-b683-4d9e-a119-79b3c312fa8b", "value": "48:6Dt+Z0Wk7Jbm7YVS+f3PALUI0U9cnpZv8B13aLlzUR:/Z0R7xm7QS+vo+xkv3aLlYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635248151, "uuid": "33392e84-039f-4b97-b1ca-1ff245c6bfc0", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635248151, "uuid": "c70b8e2a-b873-414e-9400-55a135761361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635248151, "uuid": "0275c918-414a-4406-9c9f-71f7abbd6702", "value": "a612d9e64a7b3d2836390adb8dd22866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42161560-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635262919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262919, "uuid": "4585870d-365f-4ad7-9b96-193222b7935a", "comment": "Malware payload (SnakeKeylogger)", "value": "99c8a852dcea1839c5a38e0a88d76b01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262919, "uuid": "ce0be622-15e0-4e0e-9625-d48021501672", "comment": "Malware payload (SnakeKeylogger)", "value": "9ab3f44d577d3a594ba992ff61fa7dc5209846bf41a4be4905b2c7d4eaa40050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262919, "uuid": "10f14462-51dc-4c4c-ad9a-1de9bfebfdee", "comment": "Malware payload (SnakeKeylogger)", "value": "e65c2f9efc3d5af445ff28ef094fe4299b3bc44d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262919, "uuid": "e1aa161c-42b1-4799-a51a-11e38edf767d", "comment": "Malware payload (SnakeKeylogger)", "value": "26373b92de6f0c5322b17e1af0da46a7d5633dfa9bd7533627f6b7ac09555e5dea14157470e633d3215d63e696c359d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262919, "uuid": "78dc9d98-49e0-412b-9d5e-c8abb77a7298", "value": "T13104182123E85A29F0FB6B3655B141005FF2B5C29B27C23EA46450ED0E627C25F7B76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262919, "uuid": "4d2e0651-97d4-4b22-a4d6-678b621fe894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262919, "uuid": "95ea7446-3178-494a-9cb6-080d2002ba5e", "value": "3072:jaPgjrjEVd2ZEsc8V1MzTjSMzTjoIe1Uhtn:jaPgnjcGcIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262919, "uuid": "0685a66c-ddc3-4faf-9c4c-082ac91b19c1", "value": 177592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262919, "uuid": "12660077-0cca-4c3f-89bf-3633768c1811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262919, "uuid": "9d948dee-220f-49e0-be62-5a7a81a94e6b", "value": "Hesap hareketleriniz.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e753ffe8-366b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635259761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259761, "uuid": "a05b2cf7-48fc-46ff-bc5c-0bca77516cab", "comment": "Malware payload (RaccoonStealer)", "value": "c49079a991ee6716a9c8fc229d27200d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259761, "uuid": "9f2564ea-417e-42ad-9513-01c96d85e25f", "comment": "Malware payload (RaccoonStealer)", "value": "9af89cd14f7f4c98aed99335dd7118ccbf54ab1dd9c11a170be936378338f913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259761, "uuid": "01e5a0d5-555f-4a34-bcd9-30970942f15f", "comment": "Malware payload (RaccoonStealer)", "value": "e44c63bf469bd5a83c140508f162f754918a7035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259761, "uuid": "1dd38174-e0e2-4c36-8d8c-1f34611cd26f", "comment": "Malware payload (RaccoonStealer)", "value": "36985ad895b8017f5d43fc848bed5f414557dd743708074e3f14d9a99d52575120cac026752031e66d12ed1d08ca2c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259761, "uuid": "f3b40a23-a7c7-413c-9b8e-c7fcd7c0cc9e", "value": "T103B4F1117291C439C1BA46314C26C6E6167AF8D3F82DC94B379BFA3E3E606D04A26797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259761, "uuid": "bdb3cb70-5f71-47f7-b2d4-24ba6478b368", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259761, "uuid": "b72ccd67-e8af-44d4-9eba-7a7069a7c42c", "value": "12288:Albd+TawpiZzF3lZlPudmm+hMMaO10Ba4nMU/zkS:Aj+T+zdPl2MmTpNAU/zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259761, "uuid": "9dabb0e9-3d26-405d-9091-004b3f03b122", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259761, "uuid": "df3cd749-bc28-44a2-b734-0b99a11a1120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259761, "uuid": "18fec8cc-eee3-4436-b401-3fa98ac7ecb8", "value": "c49079a991ee6716a9c8fc229d27200d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68804e47-362b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635232060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232060, "uuid": "fe602c7b-897b-49c5-9126-9588dd558b68", "comment": "Malware payload (RedLineStealer)", "value": "59cb8c2e4df7535a36fdd12a85ecf564", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232060, "uuid": "8ecb53bb-53af-4d95-b8d2-b542a12b26a2", "comment": "Malware payload (RedLineStealer)", "value": "9afbe2849d34f99fe831b97ca436fb950ea1d33ce347f009d9facb5a1606dfa7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232060, "uuid": "c2124b63-0306-45b0-ac95-e561af7daa19", "comment": "Malware payload (RedLineStealer)", "value": "0225e17dcafd4bbe411f1d82f950577a92bac71f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232060, "uuid": "6d84aa70-c193-43ab-8136-f54bdc8f8b2b", "comment": "Malware payload (RedLineStealer)", "value": "da8dcadc6ae42f2be73179f19a428ccbdb1d7c32296297decef00cea18a0893898bc6b8f5aac3905762e1dbf99147080", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232060, "uuid": "afaa079e-b01e-4b2b-b632-949e6f75cee7", "value": "T1AE05F986E073608ED7A2F07B0B0D1D8D4A461C766B3196F46F35A95AD1F3E938993323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232060, "uuid": "9c3beacf-1781-478b-90b3-2df2f814d9d3", "value": "682b88463c7583e0323d7851be5034d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232060, "uuid": "ffc8be00-d560-4b2c-8d94-f4b01a072395", "value": "24576:zStrSeFbPoL3Lp3QrTLmLcRjJxaMzFcKtU:R8PK5QrTLmLkjJxNze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232060, "uuid": "8aaaa6f7-3dd2-4607-97f5-ed46a6421b34", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232060, "uuid": "e689f1cd-9019-441f-b632-087bd14d8c9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232060, "uuid": "9e7f6fbe-2d8c-4390-b6c8-c140a81006a0", "value": "Ghost_hack_v4.6.8_winx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abc1065-3693-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635276678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276678, "uuid": "b139ff7a-bfa3-4309-a066-09800a105fc2", "comment": "Malware payload", "value": "1d8ef9a3fb0b7410a56333c0cd8b630c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276678, "uuid": "ec66577f-76ee-482c-a7b6-2c80ce7e5d41", "comment": "Malware payload", "value": "9bdb4a9aa943a120c26c09ec063e31b3c702a70fdc42f8410d2f84873805a59a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276678, "uuid": "39a01365-6c54-480f-8cd2-d6c9869d759f", "comment": "Malware payload", "value": "034180deae7c45bf8f49ab9dcc5430fb6b37acc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635276678, "uuid": "4a2dcbe1-ec2e-4e85-9e2f-cc9fd3d04770", "comment": "Malware payload", "value": "43bd9435e8ba1374ae5a782573d9670ca1685a21b772ae8c35b3e2a1d35e18a6ada0ca23832767f4765416ec93c769b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276678, "uuid": "f610bb0d-6d8f-43c2-97a1-58e9cd24d648", "value": "T18BA2CFEC4B0745DAE8C4887403F90B425F720F246953ACCA527DDA839B6A918B9C3FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276678, "uuid": "7da1ac7f-7d71-4087-97dc-47527e4cf6e6", "value": "384:x3+e2JPLxC6v++6aIUINAAFaejIVBhqh1jCTHcJgGlzDpH7uNj1Jxx:x3D2NLA6nrOAiaejIda4bcJgGlzDpbud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635276678, "uuid": "f17a6615-05d7-42dd-afb7-19fd2c38e98f", "value": 22104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635276678, "uuid": "82b05b79-804f-48ff-93c9-a37d07375478", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635276678, "uuid": "c4a13bee-4ed2-4216-907f-fc17e5697703", "value": "1d8ef9a3fb0b7410a56333c0cd8b630c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba98282-363a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635238427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238427, "uuid": "f372f1f2-827c-449b-86be-338310020582", "comment": "Malware payload (Loki)", "value": "6066ec3d6d93b8af21e3f2f934b60df9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238427, "uuid": "7c56c060-881b-4211-9d50-ab0db04c2258", "comment": "Malware payload (Loki)", "value": "9beeb1374ead1af7e04b06797eddbcbdde201f515b2593e50cd56c6513dd6a32", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238427, "uuid": "62900167-680f-4b73-9094-a4ef100d371d", "comment": "Malware payload (Loki)", "value": "3ab507702f54dc0821168693afd7bc441ff3f14b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238427, "uuid": "b2da313b-6987-4af0-b7d8-c229af5e17de", "comment": "Malware payload (Loki)", "value": "105d9e78df34032fd84775d92d0fd492bd254a8563e39fc47e2619f913bcc9fe4e7407af5c98968cf7c655c58d0c6fb7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238427, "uuid": "b7c11e5b-020d-4bb4-b92c-b3fbaf730a2f", "value": "T1F0A4D02F71E8E706CCA18AFE5459209E50EE6F11434156F317E2BE289B737C025B6E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238427, "uuid": "0c75c430-cdf1-405c-8fd2-cc964a879141", "value": "12288:DQXOy0GqBIDReIccccccccc4oyVNc+cccccccUcccccccTucccccccK8a/Sccccx:DaOjHezccccccccc4PNc+cccccccUccS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238427, "uuid": "a7f4df2a-8502-49bd-9414-3f674aa4864c", "value": 451352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238427, "uuid": "c28e7625-70dc-4919-8e64-492e67d75ff5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238427, "uuid": "8ba4523d-823d-458c-9128-56129d6982c9", "value": "MT103USD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc62a3e-3646-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1635243535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243535, "uuid": "8374bb0d-8688-4c82-91c0-fe38bab14f5a", "comment": "Malware payload (Gozi)", "value": "a8ca4b1a0ab594b286145586e6b4921c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243535, "uuid": "ef281e1f-13d2-4849-afbe-d5fc98128866", "comment": "Malware payload (Gozi)", "value": "9cb3b49716b637ee57db8cc7bd17189ac2fa2489d8ba32a94a7c99f20fa82a5e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243535, "uuid": "7be117f9-3b3e-4af3-9a37-133820bd8df1", "comment": "Malware payload (Gozi)", "value": "2e8c2f19a0a58755d03bcf12a38e9383d49a8465", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243535, "uuid": "2e20fe3c-3a40-44a7-9d23-5eac5009fdbc", "comment": "Malware payload (Gozi)", "value": "cd0dde5246abfc6940ca718151b7c12cf102fb5c77a0d7ca56089cff213edcf42287e388bcdbcb0ada6e720bfdefb16a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243535, "uuid": "4861cac5-f0dc-403a-82be-47c674ba2cdb", "value": "T1434308657A53D94AEA5213364CE2CADA7337FC516F5B470B3244B32E1E7A680C90371B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243535, "uuid": "991326dd-8d69-4bee-a423-bda783a232f3", "value": "1536:FsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0205bQK/6wP6mMCWtmKl:FhlYkEIuPm3fNRZmbaoFhZhR0cixIHmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635243535, "uuid": "3fa9ca5a-b03d-4f34-85fd-2c580967241b", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635243535, "uuid": "03359a2e-66a8-4fe0-9411-d473090f3616", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243535, "uuid": "b2fb1af0-5315-4244-b966-2b4a8bcd5e54", "value": "aaaaaaaaaaa.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0d5e27-362c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635232608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232608, "uuid": "a5582408-0a17-4dfc-b73c-a897979d36fb", "comment": "Malware payload (AgentTesla)", "value": "b51fd06a0d9ec5f21ab11f07a71d76c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232608, "uuid": "1edba389-d76b-4e73-ac92-8d109c0b46bf", "comment": "Malware payload (AgentTesla)", "value": "9ceecc65ee52445f06dec9ae80d4d914ffbfd856c36483aa7e224a1b4672de78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232608, "uuid": "a843fa9c-b595-4531-a1cc-5873de370307", "comment": "Malware payload (AgentTesla)", "value": "7a84c35b953e86e6d5a1561810e67e395d7676b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232608, "uuid": "3f509aea-62e5-4332-957f-0ccd010468ea", "comment": "Malware payload (AgentTesla)", "value": "0d523af7523a90430657cebadbcc58b9649fb2d37a227b1fa882ec72a9ac82a5fe7acf200d6fd6fcc9249dd1be2e49ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232608, "uuid": "272a02ab-3c18-4b14-87ef-c0a2f2345b96", "value": "T181841223124CB720DCFE1B37DAA983C141BEBD465725F71629B4B3A775B73620A8058B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232608, "uuid": "144b1e39-e1e2-4e1a-9025-234f134990be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232608, "uuid": "4bef43a1-ee7e-4f71-9756-f95c55393790", "value": "12288:891KZpEn7IT8HYTWDf+ccelVtR9Vwvxxhzu:ogwQ8HY22sve5xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232608, "uuid": "59a1cc26-927c-41bf-bba9-405252d82ce0", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232608, "uuid": "70652acf-7fcc-44f0-9e44-c6f443640811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232608, "uuid": "859a4dcc-bafe-4a6f-8dd5-14c26705bd64", "value": "Cr5wINinSFXJqM7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729e8f3a-363f-11ec-843c-42010a9c0014", "comment": "Malware payload (WSHRAT)", "timestamp": 1635240667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240667, "uuid": "8576af7c-4e15-41fa-bbd4-f80e9507a920", "comment": "Malware payload (WSHRAT)", "value": "c5c9afb0a28b09453c8460d20db26159", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240667, "uuid": "bba683a6-d774-4648-a8f3-9ecc07321e1d", "comment": "Malware payload (WSHRAT)", "value": "9d90d70b8ff4f7620d8f1618718db8561dfa5d375a3c5fbb00dadbeb51f1456e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240667, "uuid": "007cf426-a3c1-48e7-b617-aab4c5f36ffb", "comment": "Malware payload (WSHRAT)", "value": "c8ca7d5879158942102b42d57d597189a0485a27", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240667, "uuid": "d13a381c-a7a8-436b-82fb-da67891cb7d1", "comment": "Malware payload (WSHRAT)", "value": "b7e1484a7a6306a47801b4c991a8794f3a4baf60795efd4e5cf7177ebaebf21269903bd48626a9598503c66498dbb5d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240667, "uuid": "bf4abb7d-deea-44b7-818c-e7e153cbaf6a", "value": "T1F9C5A54B0C296A11B262F420462CB5135CB4ED633DB702E7E9953D8EEBB7C604A7DF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240667, "uuid": "4f5d822d-da68-46f6-b7cd-f65080aecd9d", "value": "6144:F9rGtHDjK1OpY+DwDFaCAOfPDKIk7agpLPBEo9db6Hl+t5oOMSBT0t+AwWc+CmzA:gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635240667, "uuid": "98d48222-8235-45d8-b611-4e93d473c64b", "value": 2527040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635240667, "uuid": "5b3b133d-73f2-46b4-8888-27a684a8761a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240667, "uuid": "0d81533a-db64-47ae-9b02-39fb8938ce30", "value": "Scan007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6538d128-36b3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635290466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290466, "uuid": "54ba1443-ccea-4feb-8287-fea22fe567d9", "comment": "Malware payload (RedLineStealer)", "value": "7ad92fa4d4268b66a6610cce2a3af152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290466, "uuid": "8bd0a57f-f2a4-48eb-8534-3e835ebe4199", "comment": "Malware payload (RedLineStealer)", "value": "9daae176aab300e6fe248df60c1e0a5f9d444bc390fb61a7ef8841c839d2234b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290466, "uuid": "06707c7b-5274-4668-90fc-2315cf2d1126", "comment": "Malware payload (RedLineStealer)", "value": "4175c887cba89a651ae28c9204f05ab0627aec0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290466, "uuid": "c0dcd5c7-0c07-4b47-864a-51a99971ea56", "comment": "Malware payload (RedLineStealer)", "value": "9b8be5037de561d1ef52f25b62a24e109952dfaf920972927aa7ce1cdc0da2e21f4c75317e93a15a87c4f0a2d2f1ddb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290466, "uuid": "612675e9-ae80-4a84-bb85-c3221f829f24", "value": "T12D84252864BFC01945E3EEA52DDCA8FBD99A55E3640C703701B4A33B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290466, "uuid": "cc650b52-8cef-4cf8-a569-b8764a22792e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290466, "uuid": "fc45a2e9-c03c-47ad-a594-6cf7cf37b4d5", "value": "12288:BQoTVgJpnBG5P5x4sMq8ZMeFrXy9rpdDEzBYDC+:mTJHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635290466, "uuid": "21bd235c-c860-4ccf-abaf-cfda0ce7ff2b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635290466, "uuid": "5f52d3fb-bdce-48be-a988-ae2683a5c976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290466, "uuid": "096a60e1-0f5d-407d-bf20-2b814fdf9098", "value": "7ad92fa4d4268b66a6610cce2a3af152.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969f2df9-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635260484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260484, "uuid": "2cf81c87-bc36-4359-9c0e-e34b26532327", "comment": "Malware payload (RedLineStealer)", "value": "cf0b9e22bb46f92f60f0d81a6004aaac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260484, "uuid": "a69592be-a73a-4c52-a564-8be6af8434ee", "comment": "Malware payload (RedLineStealer)", "value": "9dc092fdfab11892e7e732bc89f84af4afa7d72ad1e0032d00ca2e42d6f51298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260484, "uuid": "17bfdf53-d76c-401c-9b98-68ada8f0accb", "comment": "Malware payload (RedLineStealer)", "value": "f28f278e0dd0a35b83c279548b48790104dafde8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260484, "uuid": "6007d02d-9599-44d9-a5f4-3508c622f712", "comment": "Malware payload (RedLineStealer)", "value": "642eb9fd0e4c8f9cf7a8a3de0ab855e3ef77ed5dcc9eaa22381862a2e42e9ff94170c46eb1ee1c8f2c4613c270e3fa03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260484, "uuid": "c6337926-9ac0-4644-a7aa-962c2ae7c06c", "value": "T16F84BF00B7A0C035F5F716F85AB6A368B82E79E26B2894CF12D126ED57346E1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260484, "uuid": "447909cc-b3fd-4b1f-bbfd-d002b0801363", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260484, "uuid": "baa9ceaf-d1bb-488c-84cd-5d93f6a9e25c", "value": "6144:STHGW6bGmhPo6eMBXPe5DqWSvs0BlAExZOlX1cw1AC/dDW:akhto6egQGhvs0BlFxyX1V1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260484, "uuid": "81a757eb-db2e-47d7-b27a-938bde081675", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260484, "uuid": "5d7f0e1f-cf53-4174-b5d8-2f4ce300bcbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260484, "uuid": "7144dfd5-f105-4405-87e6-b8c222fe2b56", "value": "cf0b9e22bb46f92f60f0d81a6004aaac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ee2391-3673-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263134, "uuid": "85703ddb-dd37-438b-a866-618c8e2b4a18", "comment": "Malware payload", "value": "4875f6e100898f04da8d407c03134cea", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263134, "uuid": "b39599cb-2de4-43b4-be53-693d1eb21b70", "comment": "Malware payload", "value": "9dc7308546a98d93568983ad19ecf7eea47bc9f1b97c77f2f9f99228a7cb2b7b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263134, "uuid": "f0c501a0-1c01-479e-83e7-80543efd2e90", "comment": "Malware payload", "value": "d464b6233a3c9596abffedfd9077ca8769713606", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263134, "uuid": "aed4d098-c330-41fb-996b-0c3b172effb0", "comment": "Malware payload", "value": "3c43cf56a410172f62598383cfc3ecdf0365e8f08299bf2ad9d5269481baa20957fa9ba06a4fba6902146a64df70a41d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263134, "uuid": "81cd74be-894b-4ee5-bba7-d509b2c114a6", "value": "T1D7A4AE9C7660B2DFC85BC9768EA81C64EA60787B530FD303A05326ED9A4D697CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263134, "uuid": "13954b72-ab5d-463f-8933-7ac2911e66ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263134, "uuid": "2874235d-ce94-465a-89ef-c68a95dd49a7", "value": "12288:fmbDPYBQAEq6B+C5N091VR8yca8m98vcpmiQJ2NKOP9:fGnAjRC5inFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263134, "uuid": "6ef4d164-0960-44a1-891e-abe45e95fa35", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263134, "uuid": "a7593c2f-e8c5-4049-9b10-b834b995098b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263134, "uuid": "0002cd3c-d4b3-448e-8b06-1639e41f01a3", "value": "Dhl_HVX23445678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633c4185-3658-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635251379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251379, "uuid": "e7bdf107-42d2-430f-84ac-a643af24222b", "comment": "Malware payload (NanoCore)", "value": "725c046a9a1bd2456115102985d98dd4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251379, "uuid": "ada7e883-1035-4e79-80ac-09226df62567", "comment": "Malware payload (NanoCore)", "value": "9f33c3635ba0c704775ea7c0388955e5649ab913987d990e05f121b6c1681b7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251379, "uuid": "92293b19-acea-438a-95a1-729ac577e8de", "comment": "Malware payload (NanoCore)", "value": "dce11d03bb6838c7761865f5149251d01df65946", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251379, "uuid": "e3c5801c-8238-4350-9157-7d0310f1eaa9", "comment": "Malware payload (NanoCore)", "value": "9ea797355dc313d4549e169cd34bf295d93b539c93cf7d4cd337d876acd77b7f354ad1e8df69648321276c7e8029a11e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251379, "uuid": "7ae4e360-2453-452e-95e5-0f835a228602", "value": "T135949ED8DCA1C9E4CBCEC5DA49193EA510637A7DCAC36C5A4438B2F50FD363F5A1A860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251379, "uuid": "bfbb7db6-eab2-4173-9027-a52fc7311404", "value": "12288:VJfmPBkpevzNkw/AI/OJns8us28f+ngR1CFmBuL:XfmmQHAfJns8uKKW1CFmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251379, "uuid": "ed4e0546-39de-41f5-8a55-8ad51dbe9f3e", "value": 444924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251379, "uuid": "92d3177c-d726-4615-90cc-6297ba8bd9fb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251379, "uuid": "915c3b58-4d7a-4381-8f7d-682c785a553d", "value": "Purchase order_122.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3356e27-3614-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635222414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635222414, "uuid": "a072a941-0bb0-4fbd-b1f9-73ee3abc6b5e", "comment": "Malware payload (AgentTesla)", "value": "24e677dbfb1bb82a006bbdf04c499d8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635222414, "uuid": "f9547948-c87c-4ef3-9d2f-8b11f7880c34", "comment": "Malware payload (AgentTesla)", "value": "9f5267ca82e582370eca876960153a242346739c61f7042438e8a4213d1e0666", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635222414, "uuid": "dbf97085-6bdb-41a6-bd70-48bdc108c318", "comment": "Malware payload (AgentTesla)", "value": "09a1ae987b86916026ed6e1e0e596a096910a1ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635222414, "uuid": "f7936524-3728-4b4a-9fbb-e8d78394c6b1", "comment": "Malware payload (AgentTesla)", "value": "7bee47d36cca4d88bf6547fba353baccc232e824e41954667d70aae1007f78fae42ca706331c0f4446ab429826c86222", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635222414, "uuid": "0588dc1c-135b-4d97-9b3f-6217a6ca9c79", "value": "T173741368DEF8E330E9FA077D609019044B7970552814EFA60D97B4EB7D7AF05842E3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635222414, "uuid": "e22a5afe-0e6e-4f29-814d-8f3bfd00d37e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635222414, "uuid": "13dbdb62-f36e-4aff-9938-2c382afca69a", "value": "6144:hJAT/Tm45GoYV/6bdxVaajO+clMeZ+h7VTiMltzGH6kVtunktTyvi:wrcdE30aqVLSRTVZkVtuk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635222414, "uuid": "27a8716b-6dfa-45af-91ed-fd55b8ea5701", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635222414, "uuid": "6b7fbbe6-99f5-4819-a9d6-a2d26ae19263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635222414, "uuid": "b7b826c7-2ac7-4b0e-ae60-e0ba36d4b8f1", "value": "Lebanon Khayat Trading Company.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58d8a57-3688-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635272240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272240, "uuid": "7874be56-aa4e-4d27-b42e-83b306c06715", "comment": "Malware payload", "value": "ac489d4f4313cf5d009a4c3582eca2ee", "object_relation": "md5", "Tag": [ { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272240, "uuid": "80214af7-9502-4e0d-9c36-87db4bbc0e49", "comment": "Malware payload", "value": "9f9c7002f4ce0dec2f3c8d485d84c03b501b0ebda89a6f14f0727eeda3e0aac3", "object_relation": "sha256", "Tag": [ { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272240, "uuid": "39e7b94b-9325-4ee6-99a2-df48ecd243b4", "comment": "Malware payload", "value": "be95ac579781cfe90481c10d79e7aa1aab63a078", "object_relation": "sha1", "Tag": [ { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635272240, "uuid": "a16ff976-eaee-4070-a05c-245c80ae05d2", "comment": "Malware payload", "value": "76849b7e0c444855c0cd4ef27c69af6bac405140413cab37ff4f473e22e5771281a5e5e3c7b3e16f200c083f84cca912", "object_relation": "sha3-384", "Tag": [ { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272240, "uuid": "e946666c-f2d5-445d-8474-e2c6ca13f5c6", "value": "T14B720E85DD0293EC5CB745BD609AA9B0D8C87693B9A0066FF3DC97E02F315909398C9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272240, "uuid": "12234979-d3fe-472a-b207-27aebf43cd3c", "value": "384:JaDHtTrQIK6gB6VJ8lf0SoN7W7djr18Pja9AxWbxYl:0IRVh9/bal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635272240, "uuid": "2bdade53-d0bc-40e6-a04d-94edf1e342b1", "value": 16286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635272240, "uuid": "26d00878-3062-4a3b-9836-911255009443", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635272240, "uuid": "abebed10-057e-462e-bbdc-e7f09b204e13", "value": "4ig2mZya.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc2a4f0-3644-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635242724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242724, "uuid": "6719e3b3-796b-4691-9183-2168e047ea2b", "comment": "Malware payload (Loki)", "value": "24c4b3e55ca7f7cbd70f48c1f3ea3448", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242724, "uuid": "fdf5ea82-533d-430c-ad4f-9d8f01d3a8af", "comment": "Malware payload (Loki)", "value": "a000b23522b61426cc40661c7a0d46b2e897d95c010f9496bbcd848576d64dc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242724, "uuid": "4067ddf2-b485-4153-a5de-ba7ea1de5e46", "comment": "Malware payload (Loki)", "value": "226ae906d9a0986a6db57b9e8c42a47303c491b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242724, "uuid": "b9d93dce-c792-4794-a86c-20224e8b1f60", "comment": "Malware payload (Loki)", "value": "9c88cf3fc8c8989c808473e8549a6d44cebe269b3ac972aa6024cbc3f29025d80a54cdd79e8ac7e4d8a19710f25c9e87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242724, "uuid": "703fa993-e534-4ca8-adca-53c1059fbcb8", "value": "T12434BE117390C47AC4B606318CBDE6F55A7ABCE3D62C819B37973F2F2E702805A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242724, "uuid": "25e0de71-e431-4105-9c55-010cf8c3c5c6", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242724, "uuid": "f5b12c1a-2216-450c-9a33-1cd022811f03", "value": "3072:OCqElZKrjWIqMY6NHB7kHq/ZWzL/2vIu31kPcjPzzuVMO6P2+BwvHJ3/R1:zqsKrjWjM7BkSgzL/MF1bzynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242724, "uuid": "ad355056-c039-4fab-a87f-9905c24046c9", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242724, "uuid": "ed7a2135-893c-4971-8b83-86d471845f54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242724, "uuid": "7c42f05f-e5a8-4bf6-bc89-6d56bdbec765", "value": "24c4b3e55ca7f7cbd70f48c1f3ea3448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e233a2-366a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635259200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259200, "uuid": "2cdf895f-a4fa-45bf-9341-ca447627230f", "comment": "Malware payload (Formbook)", "value": "1b409f19f166463379e0211aced1af99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259200, "uuid": "d06fe4ac-9ebd-4dc5-8bbf-6e5a110fc587", "comment": "Malware payload (Formbook)", "value": "a2dd12adec362ce7457da7795a1b0505dc2c88ab322a1c59637e8196528739f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259200, "uuid": "ce36e886-3ebd-41ed-bd76-6b0277d6a116", "comment": "Malware payload (Formbook)", "value": "d15127da7d1de660a66e9062c81131d9c3fd9d4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259200, "uuid": "2a057faf-515a-4435-b927-26facd154d76", "comment": "Malware payload (Formbook)", "value": "05b2c410086c153158b52737122cfaa9d6ee748cc248c0621f4ed17d31423544e27a8ccb66f6d3c7b4ba562b08efacc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259200, "uuid": "1f4d67ff-6ec0-4666-a5a5-7103e19bd96f", "value": "T1347412A85BDCE235EEB7177C5101492C62FC506A6021F38F1B9AB4D16F6B30682077AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259200, "uuid": "d0dad8b8-1e8c-4ac7-a8a5-ce04ec21ef0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259200, "uuid": "1780498e-3a6d-4708-b529-8225e9368232", "value": "6144:Zb6oz1U4bqekD72rnllTIEH3OV8ipEBTRE3X4R5ANndrlYW2cC+Hk/vdXH1McD:71U4bkDs0UBo2MdpvC+6xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259200, "uuid": "0f76d59f-0004-4436-a26f-d547aa4b7426", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259200, "uuid": "e3431d06-157c-467f-85aa-3691d5eb1bb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259200, "uuid": "f39389e0-b1ee-40c2-b3ab-d6cc436886de", "value": "1b409f19f166463379e0211aced1af99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08ea3fa-365b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635252797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252797, "uuid": "d5597ac4-d2bc-4aa3-95e2-e3125f1e5c6c", "comment": "Malware payload", "value": "ed72f2a8346818ec6f2d799363169bc2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252797, "uuid": "6c2765fa-db0f-429b-9e1f-08e7e6e5b20b", "comment": "Malware payload", "value": "a35b42d3fa543d26e5d807c3e4148d90ed52b2e76153b06a93740f04bc58dd9a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252797, "uuid": "e139639a-42f3-483a-a4f6-c2d9111b3da4", "comment": "Malware payload", "value": "0cff3f5885da52e4004aba2ad5d4a849684690d4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252797, "uuid": "4955bd5e-d9ff-4dfd-bd7b-1f24b675b686", "comment": "Malware payload", "value": "a236660e393841c9bdcdc5a0509d7c3a673909bf3147daf5c000444afbcde1ce287d7025c4e2f36fdc134ad4f0d6de04", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252797, "uuid": "5d7e29e9-b14d-41b5-98d4-e6f12900d9f2", "value": "T1EF4308657A53D94AEA4113764CE2CADA7337FC519F6B830B3244B31E1E7A690CA0371B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252797, "uuid": "dd2f9743-eac9-43de-93eb-a87cc92fa84b", "value": "1536:OsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0Zd05bQK6NghDmsihtWKl:OhlYkEIuPm3fNRZmbaoFhZhR0cixIHm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252797, "uuid": "7d73ce8b-8ae6-4d39-b8d4-5a0c7723e730", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252797, "uuid": "16d1d624-f88d-4b58-bde0-798b47e97637", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252797, "uuid": "cde6471c-9d72-46ef-b32f-f1cbcc08f3ca", "value": "DHL_Fattura-859796-6536.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a960137-3629-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635231044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231044, "uuid": "88c467c6-e696-4512-9a66-0d20f0d770e0", "comment": "Malware payload (RedLineStealer)", "value": "9b97b0c8cb302d6d070695579f6162b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231044, "uuid": "5fa0e04d-a1f1-4f5a-926a-4bec36480951", "comment": "Malware payload (RedLineStealer)", "value": "a504b71c1c3089290fe2b820ec7c718889656ba5957fb38de309fdec04e8382b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231044, "uuid": "dfa4fb53-9f68-46fc-90f9-2f59793113b6", "comment": "Malware payload (RedLineStealer)", "value": "73e5df0f3c710a7e8ac4bfc3a4791a3228e6121c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231044, "uuid": "00036544-0e22-4270-94f5-2d8da7cc4b2c", "comment": "Malware payload (RedLineStealer)", "value": "8a56ab09c421a0648eaa549afa11d0b4c85e27282766a19f795421acd8f6a103e3e68cc5c0be684702899650689a1659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231044, "uuid": "0700bf00-5a90-45cd-a62c-82d57b3fd50e", "value": "T1323419161BD89B29F57F47359078020453F0BA12A723E7BEADD060FE1D62B828B5771B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231044, "uuid": "c28d9a11-309c-44d0-aa12-e7d3316a9185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231044, "uuid": "2764d24e-b360-4c3c-8118-50d52084c621", "value": "3072:OYjDGX7xN5+tlq/yW5/GMiP9L/GWJOr6navm8dIOSSMMWYAgCyoHSIoxdIVpa:LGX7qWyDMQadphSKkHaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635231044, "uuid": "9aa5d022-7f56-44ef-8769-dc5fec31b9dd", "value": 234936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635231044, "uuid": "788ba272-c187-45d7-9fcb-d1b03cd9e5fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231044, "uuid": "88de582e-dbc3-4b72-935f-8c8b294b94ea", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c155677a-362d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635233068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233068, "uuid": "8f402c73-bb7e-46a7-82c1-59a7729bdca0", "comment": "Malware payload", "value": "520b9fe031b979ac19f5e624754bd5a0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233068, "uuid": "526dcfa4-0c45-4ea5-8af6-64617a5201f0", "comment": "Malware payload", "value": "a5073840fbd28637bc8537e99e533728d1274c402c2aa22b4550e5a647e97b07", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233068, "uuid": "cbf2b42f-dc10-4093-8c9f-03bb2e11d7c7", "comment": "Malware payload", "value": "fa1a603b91c12aaf1a95afcf195494255602c3ae", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233068, "uuid": "4c20ecd1-72bf-4003-a57b-5db7386743e7", "comment": "Malware payload", "value": "5200ef28775a733cf776b93b958782e9fe51726ddf12d4181596994a84f872c25396a1d7307c157ea5a0f525241f5995", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233068, "uuid": "7db4abdc-01ce-4538-80d8-8385ff40732e", "value": "T1EB8423D1B5FA222C43FEF866D41DCC84009BCB242963AF6E8D7636A966130FB506B075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233068, "uuid": "5a0843b7-221f-46be-b3c2-15488e2cb9d5", "value": "6144:c9TzlnXAXCmA4q2VT2E36gAXwrzD2/onrILf7IdBBprDbUMQf2aHq69wdWuNIwWa:cBlnX9mA4lEwrf2gsIdbFi2adu0uwa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233068, "uuid": "bc0c82cc-13b1-4e72-b5fa-6e2e29df2f9c", "value": 390707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233068, "uuid": "d9883db2-bd42-472d-b9de-8a6de35c533f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233068, "uuid": "d63cdbbf-e824-43de-8f4c-09d159f85b29", "value": "RFQ # 097602839 NEW ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4978e0cb-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635233297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233297, "uuid": "a2b02a19-8d26-4ffd-9674-54c360a420fc", "comment": "Malware payload (Formbook)", "value": "acb348cd2918c27a29a7ef1ac799e864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233297, "uuid": "857eddc5-8329-41ce-8a07-8b63fd9ba8ff", "comment": "Malware payload (Formbook)", "value": "a692d13e420e07520021e37a196bfa2cbc961d3f4471bd612a425fcd42fdfc2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233297, "uuid": "ac4d6c85-3cbf-4bed-bc79-d3e822c34772", "comment": "Malware payload (Formbook)", "value": "9a95064843162582dd1cec4b854dc9a88a9e4738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233297, "uuid": "7c5fdeff-349a-4cf3-bb20-6142edda9e70", "comment": "Malware payload (Formbook)", "value": "e7a6f07b063c3c09cc117512630efa00ab2236ef449eb440211f734c109dd41cdbab01e3001d0704244714e6779d5924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233297, "uuid": "dcfe83c9-0963-4dde-9585-a70bdf6779b4", "value": "T1886412190BFCE333DDBE27B851564909577C2A5E7801FF9D2E60E2B539BB7818046A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233297, "uuid": "9afb69cd-2936-4d55-953b-e9e8d092e52b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233297, "uuid": "5c4f6824-f280-4d49-95ce-a7fc964a6610", "value": "6144:UJMrh9eJ5kK1fs982UnXnd0wbSrJrPRLwFL1O1nlCs7p4Qj:EOMfsylXnFSDauno+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233297, "uuid": "00062b0a-5d45-4680-9457-aebcf7cd856e", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233297, "uuid": "00ed2bab-4dea-4116-8cfd-a0691be9685b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233297, "uuid": "e25eaa7b-d3bd-4f7c-8397-4e5f42c504d6", "value": "OS-QTN-0320-21-Rev1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86def5b1-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1635251009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251009, "uuid": "c17b078b-385d-470c-aa2d-55aa460f234a", "comment": "Malware payload (Squirrelwaffle)", "value": "d59f026dcad1221e477378af85dc625a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251009, "uuid": "4a9dbcdc-408d-42eb-be41-6649437003dc", "comment": "Malware payload (Squirrelwaffle)", "value": "a6f5ef4aca1db5477e051899e3992e3298b4bacd2877aa9f71dc2168f322b22f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251009, "uuid": "e492ce51-413f-4044-91b1-f134227695d9", "comment": "Malware payload (Squirrelwaffle)", "value": "2885bff21d432290b96ec81de0589275bf3756b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251009, "uuid": "ffad4dd3-8d35-4ff4-9ca6-63613cd7d8c7", "comment": "Malware payload (Squirrelwaffle)", "value": "4eb834e7b8884c8c570660ab9acb51134cce90ec3e845e1ae65070d8ac07ac98e1939f67ad2460671938970c9ffe835e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251009, "uuid": "7bcc56f5-c3f7-4755-9473-568598e4bd87", "value": "T13074AE1235F64130F0BB427958B46A8295BDBD625B3F4EDB13CC198E4B368C1A63AF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251009, "uuid": "0e123532-416e-446b-a7d7-53c9ffbe1a7b", "value": "3eedf23f8b208860c154cc0073d0f2cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251009, "uuid": "6440ff7d-788e-4bc8-ad7a-12350628697d", "value": "6144:00xmjpgEs2cc2RzaylQW85dlyaVdpe+1X7ptQRTe4E/8L:Nc932RzQW8NyabYqAhe4EEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251009, "uuid": "c67f0524-f488-4cd9-a1c6-a38c4e2ba5c6", "value": 366740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251009, "uuid": "c23b295a-49b5-41fa-a20a-d5e707746f74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251009, "uuid": "40c43f46-38c7-480a-8798-77d14d82e2cd", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68be8661-35f5-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635208868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208868, "uuid": "185e59d5-f17a-4100-be54-228ee962b836", "comment": "Malware payload (TrickBot)", "value": "6562e6da9fbb441334cd8e89f9224889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208868, "uuid": "3ba91127-a6e3-43b2-9cc7-ec42d76c99af", "comment": "Malware payload (TrickBot)", "value": "a844f4b4cd3aa66b10306bfa01209bcb519d19d7e87b219669a9be984935528b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208868, "uuid": "ec0535e2-5c52-4fe5-bd0c-20b7c5ad746d", "comment": "Malware payload (TrickBot)", "value": "f8b5a559f4a1aff5d427f21b2138941decc3b8cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208868, "uuid": "67c4b35e-2982-4107-bc0d-21133b1cbcc7", "comment": "Malware payload (TrickBot)", "value": "de7a08c9980e1d0ba7d0a5b274aaffd097508c991b60f3de2bd19aeec82613e1bb8b0a70dcd54c4b8aed49fd82d7c880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208868, "uuid": "24431f75-4307-47f4-8000-cf9db6608ed5", "value": "T12DE4CF26B79490FAD5F116360FEB673BB2F6EF60493683471792BB1D0C30A114B26B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208868, "uuid": "aea538c1-f1ca-476e-b393-ddd69225378a", "value": "542db7e97024de0354d3af3fe3180ab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208868, "uuid": "3d953069-e04b-4d52-9c66-0bc6919fbf21", "value": "12288:E3OvNPnZ2TGqZbv0r+EFmd5/gCoXcoHQBQVxvzAiZb:PvN/0T75r1d5YCoXcoH5rpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635208868, "uuid": "c69ae665-93bc-4b52-b427-fb640fc5bd27", "value": 675883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635208868, "uuid": "7de57c4d-59c4-4445-a67b-72cd56bb4c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208868, "uuid": "4924b81d-1ed9-4c06-aa89-5f4677923d49", "value": "eflyairplane.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4ef4cf-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1635253728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253728, "uuid": "5c83fe02-d785-4e58-a632-63ebe5fc74de", "comment": "Malware payload (njrat)", "value": "147841ac2ca60229a754403fddad59ec", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253728, "uuid": "61ce4001-cfca-4f7b-ba41-b4431282d54e", "comment": "Malware payload (njrat)", "value": "a88a9fc866e2da0a88fbbf44e23b39b3bb980135b0d1c1aafbbef87490c2f34c", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253728, "uuid": "1c5a4fa7-3dd0-473c-a50c-864fde86e4ef", "comment": "Malware payload (njrat)", "value": "9de7705976aec4bedd6f8805065ac17be1282d75", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253728, "uuid": "7aa6a11d-9501-4bce-b1b4-6a83b6ab3b72", "comment": "Malware payload (njrat)", "value": "82f88a63ce5f61667b59ec83f6e5b2bce02001ac194e7f6348948ea9f75ce20b927eb03778f82e763363db199b77af5a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253728, "uuid": "06da1c55-759b-446e-9336-08076f4cd226", "value": "T13E72567A19D2175A3E78A19F7736F8BBAFA739043E3A57D908B541A074B0804076CF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253728, "uuid": "d262863f-721f-4ccb-ada3-6ed0e09ea097", "value": "96:SXXXXXXXXXXXXXXXXXDpsE9HNlqfRr5STqcaNbqABXXXXXXXXXXXXXXXXX3:+pV9Hn+rSqcadd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253728, "uuid": "24d226b3-918f-4b3d-98d9-e5c11d03cd8c", "value": 16039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253728, "uuid": "b622455c-4eb4-4008-ac26-d95a1d997a7a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253728, "uuid": "5663aa98-1ccf-4a05-91fd-d206c2fe260f", "value": "RFQ-474552121.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba1e6f8-362a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635231555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231555, "uuid": "af203b39-7578-44b1-a16f-2ceeee3a1c18", "comment": "Malware payload", "value": "3102a073969a2a950867b25e75d084bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231555, "uuid": "7ab00cb6-5aca-4a86-9dc3-62e2b887c4da", "comment": "Malware payload", "value": "a8951788932f263c43bb618a3ff1e52c95e82627b9f4f4396fdf3b680c2def87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231555, "uuid": "35612c28-8706-4dc3-9b35-4816c45627ce", "comment": "Malware payload", "value": "19e8fd671a2a0a4a5f443000d46620c6e8db7af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231555, "uuid": "23744c10-ff13-49c9-8ecf-fccfd6a18436", "comment": "Malware payload", "value": "dc7623c9c88ec1f458572b383b9f1efe5612a28b25f2eb56f50ca6f396e804399feb435c1a4890a46bb84d3f2ec801da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231555, "uuid": "e5a64128-95c1-41a1-be42-8d5ff754f955", "value": "T157841226369DD931C13A123A9C8E012103FDFB567682DF7F3DAD226995133E689192CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231555, "uuid": "5cb75b77-2d11-4ec4-ae1b-d6e164d90896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231555, "uuid": "6af979f0-f9b5-4487-8cf5-faff67aab068", "value": "6144:xpyQ4rXWsEbAq2OluO93wfQkqO20xzpgjCbEeF9naRqDloCWlbTPPDF4k:xoQYWskAHO4OZwYkzpCeDnaRqeCoXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635231555, "uuid": "00a77dec-de8e-455f-abcd-7ae5bb97bb84", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635231555, "uuid": "2e57af07-d8e8-494b-a311-effa87490ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231555, "uuid": "4a65bb5f-d9ab-4be7-ab49-44046a298d21", "value": "P0_11234.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfd75d6-3694-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635277059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635277059, "uuid": "39b469b2-fa93-4c8f-aaa2-712ddc5a3f91", "comment": "Malware payload (Formbook)", "value": "6217d4b7055a199bd8eab01f4a7a88e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635277059, "uuid": "61320549-d25a-44b0-8f7c-b563ae78538e", "comment": "Malware payload (Formbook)", "value": "aa5310ecfd79c638402449531b210e4dab873f9cba11af2ac17b3b442cbe94b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635277059, "uuid": "e55e1a01-5f95-4655-8379-ed8ca5f4d132", "comment": "Malware payload (Formbook)", "value": "6c4c29fc07662fe0020ba09e401ccb02572a88ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635277059, "uuid": "db9f519c-80bd-447c-bda3-97ff01b46191", "comment": "Malware payload (Formbook)", "value": "9803df939bb23c25e3d127c3cf9fdcbacdc2a463bbf3107e594998a49f07839d1baaecb42b4813e2fa97fd4435c8d7ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635277059, "uuid": "4e5f0d1f-b2fc-4816-81c0-1a4558712b15", "value": "T14B44122A22D044B3C45797B8E9F9963ACBF6C91002217E6F93305D7F2999DC3D71A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635277059, "uuid": "11104caf-55e5-4ad6-a480-cb196a434ed2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635277059, "uuid": "4a0ff8f7-a8b6-4996-9d1d-d4f736ad5371", "value": "6144:wBlL/cRwthLqheeQYoBWthZR4ZWlBNQeL:Cee/jYo06ZWlvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635277059, "uuid": "4d02da2d-5d98-4617-ae77-cc74a39b95a5", "value": 262654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635277059, "uuid": "2ba7f348-729f-4b87-8975-1e9402eea691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635277059, "uuid": "319e8c0d-a73b-402a-a64b-6770aef5ce28", "value": "PAGOS PENDIENTES XT3503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242175a0-3626-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635229798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229798, "uuid": "3fb23098-1ecc-453d-b39a-859e59100617", "comment": "Malware payload (Loki)", "value": "ce9243796ed9bb455d7bc29aee7566e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229798, "uuid": "4147a3d8-e326-4838-a4f1-e510c3a7b072", "comment": "Malware payload (Loki)", "value": "aad8c3e8a386500fd5c0080ed040775c5210d1ec54deddc1073d5643df4a083a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229798, "uuid": "60c3ed88-4fe3-4789-9494-199ebfd181f7", "comment": "Malware payload (Loki)", "value": "ee4734a153490f8df53b3f5e8032f60f7812f04c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229798, "uuid": "b2bc5765-2761-459a-b24f-e5204fc0b9ec", "comment": "Malware payload (Loki)", "value": "6c0bf560757ae2a2b7caa6cfa893baea76cb99d72ea6540a1008d2843089f9f0034cdb46b1ab9f9971180185f2f1b6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229798, "uuid": "a8be956e-f9ae-4ef2-bb24-68f9cb5c85b7", "value": "T11B34121507BCD33AEAFF43BD60600A0587F985753F11FB5F2E4060E91ABFB5202A15AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229798, "uuid": "eff35fbe-05f3-4609-9174-a8dd9606c86a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229798, "uuid": "c7a9ea24-518d-47b2-b31c-788673d9b382", "value": "3072:auAUCB1DZOtebLDFjVCs5viMWx0GtoI/nORvJg86yA6ypr+zpXAc1pSlPeAaKMe0:89BlPROGFI/nOtJJAvKicPUPeAaKVsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229798, "uuid": "231b6769-0c96-477b-9f06-f398da34cecd", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229798, "uuid": "182a5927-fdc8-4e4d-8059-9ba9da2cd950", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229798, "uuid": "ef62bd7d-43ce-490f-b651-7111bb0076b3", "value": "RFQQuote-REF MOITB102125083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a3307d-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1635260483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260483, "uuid": "1c7156cf-873a-4a8e-983f-91fa98d9f6e1", "comment": "Malware payload (njrat)", "value": "a911ec39ff21e50649b6317f55243799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260483, "uuid": "307b0d55-5762-43a2-8216-7b3e023ae7b7", "comment": "Malware payload (njrat)", "value": "abb90463c8ceed4773216ac8f49c35de06e6f25faa1575a38e410af97ef3aa64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260483, "uuid": "8449f770-962f-4c7d-833c-0498f099ac57", "comment": "Malware payload (njrat)", "value": "28fed905673ae72831256d68e03f51704668197c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260483, "uuid": "07a141b7-6def-423a-9305-8ebd836f9038", "comment": "Malware payload (njrat)", "value": "f93b663e50c9ddb72cf8050107dd2c5935ac0ee8fdb5ea2611ddeb4fd061cb52dee2a9d0054e4bbb8656721aca517a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260483, "uuid": "3ef6451e-31b1-49e3-8649-a957de09b7dc", "value": "T1FAE22C6DF7E64466D1BC0AB50571950013B4E103E523F77E4ECA24AA2B7B7D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260483, "uuid": "b1429323-e4d8-42e2-9cff-3b1ab46f0eb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260483, "uuid": "18e8191b-9fdd-4da8-beec-f0ac6675bbe5", "value": "768:hRfFjStrFZczxX6aEOJGnnxf1vIVQmIDUu0tij2j:Byq9wxpoQVkLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260483, "uuid": "f1e2f807-88b3-4feb-abdc-8465a41a57ea", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260483, "uuid": "1ddff503-a1b5-407f-94d3-24214e5a7db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260483, "uuid": "9c076836-8351-47ec-b47d-bab62515440f", "value": "a911ec39ff21e50649b6317f55243799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6f1e5a-365a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635252124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252124, "uuid": "25a514e5-984b-4cfd-a382-24115c9ee81e", "comment": "Malware payload", "value": "18f79559fb9321b3e0315707ac9789f9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252124, "uuid": "87ed2bd1-caa3-4340-b921-6e0adefcce08", "comment": "Malware payload", "value": "abeb9ed173946d7a7e6662eacb5341b62b14fd32a4ad0604ab8614f1810a8788", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252124, "uuid": "aab876bb-7216-40ee-8d5e-5c3ec2c17290", "comment": "Malware payload", "value": "65120f86bc3acd222fa1239e58c2187ff9166399", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252124, "uuid": "c8718dc2-2d67-41ee-b1cb-a9c3807bc024", "comment": "Malware payload", "value": "35ab403e43196443085a16245f27eb17de8cfdbff4249d94d1705d0107be79f86d08aa2c835b9c5ebed3dabaa3a6ab75", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252124, "uuid": "8f82a651-12a0-4693-bc01-9cd94835bb03", "value": "T1EF5423A9E2D3F572CA034A7AB605F5E1762017328CA477256ECDD01BFF9188C11A4BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252124, "uuid": "8ab8522e-040c-4fc8-85bb-028d16771c28", "value": "6144:Pq8Shm8FY6qpwQrEaRJxAy5FRxy9GsArSTRYG4V4IaW3+AVt1PE:smEYdpwFaFVXfxSax1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252124, "uuid": "911d1cc5-7267-4e58-b5a3-66c294d9b66d", "value": 303817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252124, "uuid": "5aaab2e4-9a6d-4c31-9a37-5b7e921f8cce", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252124, "uuid": "beed308b-b2e7-4a2b-aab8-e1a9a8df9c10", "value": "2444.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2aa587-362f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635233918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233918, "uuid": "3a829712-946c-44b7-99e5-2554c30520ef", "comment": "Malware payload (RedLineStealer)", "value": "627d57553229e283e29572f4aad6d064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233918, "uuid": "1f16d5cd-fce7-437b-a6c9-4e508d3d8e19", "comment": "Malware payload (RedLineStealer)", "value": "ac65f6ccc6c4856f8f7597abb9c7c3b1a201b0c0f83007ec2fb3a09402ba7cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233918, "uuid": "3d56249b-fc3c-4ad5-9eb4-082f9fb04cf6", "comment": "Malware payload (RedLineStealer)", "value": "6dc4565702217cf220f6cf7f3121c9fe22c76a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233918, "uuid": "21ec9a0d-c5f3-46b9-bf1b-4a946a0ad664", "comment": "Malware payload (RedLineStealer)", "value": "b5abe2a10cf6f5c7747c4196a929849f2903b212bb8f32049b166e968022c0da3918edd775232ff117db119bdf572640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233918, "uuid": "fd2a5ab7-9845-47ab-b055-63642c1c34ba", "value": "T1196498FD25D38F31D99B32728BA3BA948F6610D693239BD8E744C6E45E0E3211F046B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233918, "uuid": "d4a65a2e-23f1-4a89-b7d4-b4013fed9df2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233918, "uuid": "5df1abc5-229c-4a15-bb91-a63b8b8dcf13", "value": "3072:wGezZ7D2JiDSZqZ8KsLtgJ3F5OWgvg6h1olz2Ewm/IfFRQeNvurI/Fti1W:oz9zyXnJg75jGoN5IfF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233918, "uuid": "bbe715ad-33eb-4f62-9466-5a538ac27bff", "value": 314784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233918, "uuid": "a49cfbeb-362a-4e27-ac51-340ccda3bb26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233918, "uuid": "d3a39e89-2ea8-49c1-82f3-a6a1c345daed", "value": "Gl_hackV2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcf4215-364a-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1635245571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245571, "uuid": "6d58d79d-2c3c-43b6-8978-fbc2a95b8952", "comment": "Malware payload (CryptBot)", "value": "7284f5e08c4a6251232bd6020ed4654a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245571, "uuid": "f1b89a29-6c66-4bc8-8872-5451b95712f8", "comment": "Malware payload (CryptBot)", "value": "ad57b2094e9d2cbc75ba695c4400d23a8c24046e08eac6906d6f973a4ffaefb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245571, "uuid": "cffc1661-451e-4d47-9887-fe432e071628", "comment": "Malware payload (CryptBot)", "value": "1a00d4808ce9e080b992900c23251b5b7374608b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635245571, "uuid": "ddc980de-32ae-4b42-b8dc-5c49f4c2ec99", "comment": "Malware payload (CryptBot)", "value": "da4aef5e44f408ccdf1039d57cd5edbf4ea6eb0d838d82c8a8d54428e4337120d98a7a0a12b7dfc645bbb5b9ad0fea0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245571, "uuid": "6bfcc482-f1fc-4589-82b2-1495b2fdb905", "value": "T1B464E100B7A0C872C5761D794421CAE15A3ABDD3E93C448B2BB7FA2FAE713D09967345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245571, "uuid": "5c5f79b1-0c4a-4b53-bcf1-84fa17d8b789", "value": "a756627435b382dc3646987f64d479a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245571, "uuid": "dbbff653-196c-43b6-accf-c2a399bf75f9", "value": "6144:XTjvH1pQTYXC5aYCGzD+SGiC4QTOHgVurU9FLVrKlWAYzGIXnMynVP:XnLUYy5aYCGzqSGiJ6hDVrKlvmXnMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635245571, "uuid": "48a8a849-df2c-4422-9ab9-35d6e32e350d", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635245571, "uuid": "8933e816-96c3-4414-9872-ad1fdca2848b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635245571, "uuid": "190572ff-f04a-4d22-bb99-d060a3728024", "value": "7284f5e08c4a6251232bd6020ed4654a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2b75d4-361a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635224790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635224790, "uuid": "4b9618df-f945-4e1d-aeb2-7d13c16d9ed9", "comment": "Malware payload", "value": "afb91ac1a0e9057bcb501cb91306b40c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635224790, "uuid": "2a83ce53-2915-46db-b5b7-4ba958b6daea", "comment": "Malware payload", "value": "ae9951a76e4840f886bf15c9fce66bb4eecc42802c03ce43529b0cc81ddba9c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635224790, "uuid": "b6dd8842-57ac-484c-b46b-2bbc57d0760d", "comment": "Malware payload", "value": "1a3688766243f0b268a7e1c8adce79c4d7227e2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635224790, "uuid": "676833b5-8b1d-4564-8bd8-dd7a3733a26c", "comment": "Malware payload", "value": "3bf95786d6c21f8766fdcc4ce1c4a6738dffa3cd46cf6a1ef431468e5f477b1eb20aac2f07f943f3799519473e509673", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635224790, "uuid": "97ceaa3f-9051-45ec-a42d-56daf4373480", "value": "T183249D993698C874D0A115338835CBE5E73DB8A1F8245177F29B26AFEEF82C05D61393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635224790, "uuid": "13e9fb88-76b2-48fe-b1d6-dd69a75ab2c3", "value": "324eb7eba0d6f4cd042276a6e19d7718", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635224790, "uuid": "24e36bfc-4221-4047-a904-01f67621f55d", "value": "3072:pWR1UMszHE09GcxmsEGr+MlCooSbNtgSsA+CNfd/AWaS1ZJu98vd:XMszHE09pmsbQ0NyHKBADm8el", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635224790, "uuid": "e531f3d4-ae51-4818-bced-6f9a4968884e", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635224790, "uuid": "22d31d92-01eb-499f-8b70-356802a28777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635224790, "uuid": "cd358373-5765-4534-94b0-e3e932860e42", "value": "afb91ac1a0e9057bcb501cb91306b40c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dee589-3664-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635256383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256383, "uuid": "786cc813-7aa4-42ba-837c-78a31dabf481", "comment": "Malware payload", "value": "537043f30bea0b379382248f04a1bce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256383, "uuid": "43b2b27d-6aa9-43c1-a2d8-a5079d5ef95a", "comment": "Malware payload", "value": "aefd8e32f432f63bebfa4012bb7452cb536fae30c8e0b8bb7c756080efbf4808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256383, "uuid": "79a51079-656a-4204-8316-21d5dbef0575", "comment": "Malware payload", "value": "20e019721acaa01d1d6aaf80ac7aa6bdc505b46d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256383, "uuid": "a0d0ea8e-6e45-4554-88f1-65ae52aa67ef", "comment": "Malware payload", "value": "5e6dbfb08c4475af00734ce3c816f55754695eaddde7c9bf867fcd9e4e24f84d392608e7c0d3289429bf1997d2fb2521", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256383, "uuid": "dfdd3845-38e9-4b2d-9c4c-956c800153b7", "value": "T16824BF215DC4A021CBA0E436B6C7D27B45772C738350D993FB4DFE9736A0A268B2EB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256383, "uuid": "8d797e22-4345-4874-8a81-76e544db97c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256383, "uuid": "1edfc32d-0808-4f9f-8781-3ea669b539ea", "value": "3072:tATmtHnnHP0XQVLULnqgXOR8FZwIq6MTRyn9A7JSKx9CbnR/Jx1:GTmpnHP5+GgY/Iq6MtuoJSgCbnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635256383, "uuid": "dc3c1b9b-d4ea-48c9-b5cc-ac341eeca681", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635256383, "uuid": "e092d57b-6d6f-4650-8404-1e7c554e3730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256383, "uuid": "0ad6df99-bdc2-4b56-be52-88dd4b9c6164", "value": "537043f30bea0b379382248f04a1bce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d1b138-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635257149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257149, "uuid": "2a97b5e8-d7f4-4304-9ac2-c4ec495795dc", "comment": "Malware payload (Quakbot)", "value": "bf12394a7423c4c472b4713a080f7b13", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257149, "uuid": "445d18d1-fda3-42da-a52a-f78e2f1b7f56", "comment": "Malware payload (Quakbot)", "value": "afaff452861908fb84af280830c2e8e7fe48d487c7bc347c3cb705d348476129", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257149, "uuid": "068b354e-e795-430c-9a8a-f0377025ded6", "comment": "Malware payload (Quakbot)", "value": "c7436869b3abf27fd3528f652b4458a9293515e9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257149, "uuid": "fb33d27e-7dff-45ee-9b82-e7287a6c71f9", "comment": "Malware payload (Quakbot)", "value": "ea9b2d0aed442a1af70ab835068516e161886cca91d5709f5ac6b306143a76fd739b3baa2432d82a148a3bf8f49eb3a0", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257149, "uuid": "6e8715f5-421c-42dd-84a1-8e0b19366f22", "value": "T10C34D146B91CD89EF617873148C7ABAA5323DC304FCB1F876695B62C6FB8DA47903046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257149, "uuid": "64588ac0-846f-46b8-935d-5d7318ab7c81", "value": "6144:DKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOcfZw6lBVb7oWSuKMA6PujbmvV8Dzz:2ZrlBVbszXjS9t8Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257149, "uuid": "4bf26b87-9cd8-4ddb-9842-d699f790248f", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257149, "uuid": "c39c1574-aadd-4c4a-a545-01d16785908c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257149, "uuid": "ecf71249-a40f-4ce2-96ba-c3d59827f3e3", "value": "bf12394a7423c4c472b4713a080f7b13.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe40d9b7-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635252927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252927, "uuid": "6cd9e041-76b2-4b13-a664-b9cb10bb6d5e", "comment": "Malware payload (Quakbot)", "value": "afd155975b70ef18a1c4128eefc2f881", "object_relation": "md5", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252927, "uuid": "ef7214bc-c8bf-4ddd-9db6-6b7d704dfb8a", "comment": "Malware payload (Quakbot)", "value": "aff67b2d5bd2634a6d1800e9c2b2232ad6d09b59e1971afb6b04ea3be477d8cd", "object_relation": "sha256", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252927, "uuid": "08d55bac-c9fc-42e3-9a88-c98c6a54df75", "comment": "Malware payload (Quakbot)", "value": "07c7b75bcd63c9c250e0ce5a9b89c098f2ed3ee9", "object_relation": "sha1", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252927, "uuid": "153ef5dc-eecf-4871-b925-9d6860baef7e", "comment": "Malware payload (Quakbot)", "value": "fe3ca3f00b66b57d06c03524796e30f89216625ed19e93325bf5c05b417c5fa28f65e1ae196efe1a14cd3362da469bb3", "object_relation": "sha3-384", "Tag": [ { "name": "1635233864", "colour": "#CF9B9D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama119", "colour": "#FA5EF0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252927, "uuid": "2b4ca605-5745-4a18-a055-9bbd5d68b337", "value": "T1A605C01337EA8078E17302B600B6759149EDBDA2647A8EDF63C4364D4B7B8D2B26D707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252927, "uuid": "cab865f0-0e8c-4538-8418-afc3712f01ed", "value": "b4a4a7049cd9bd07ffb9ca09c0699e6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252927, "uuid": "a31bac60-be16-4b53-957f-a899aeaf5c8e", "value": "24576:a00/QdHQJFecX6kYODlcRzzRueQNQiCArRNa9dz:Y41QJFp6keZRqNQu8dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252927, "uuid": "17b6f53c-cf35-4dfa-add0-075095018e0d", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252927, "uuid": "a8220240-4e9d-4044-b128-c01ca8bd4bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252927, "uuid": "e4955866-4d08-4501-83f0-800331e438f9", "value": "44495.651716088.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b52afa9-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635258586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258586, "uuid": "52253069-aba8-4956-b5f9-28e733127d84", "comment": "Malware payload (Formbook)", "value": "7e8630da613a768182b311ceb99036e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258586, "uuid": "8c23eac1-5910-434c-a2f1-5110ef1cba61", "comment": "Malware payload (Formbook)", "value": "b16670d7ab7fc43029ef6033d5bf6b8a3ad78f09fefed66ec6351c7eac0a53f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258586, "uuid": "43564eec-fc7f-434e-9308-0a09f70a56e9", "comment": "Malware payload (Formbook)", "value": "3f37240248a1b317f5da9ebc170bc2f420be3aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258586, "uuid": "827e4eec-bd0b-4425-a753-35afa6847408", "comment": "Malware payload (Formbook)", "value": "c092747c7eb2cfcdf1c33d3d1021ee07e10588697bc3b9c5aa86c4324d987a802b21d4d58a929ac8ca62b18d7b6392a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258586, "uuid": "2c20833f-81c1-4fc6-8fdd-1d6715b4c9cf", "value": "T135A4BE3DAD081773E276C635E4E60007F2B4458B3731AE8B06C76748755FB427A9A39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258586, "uuid": "88204c25-0034-4779-a8a9-3e7f72fe365e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258586, "uuid": "f4fd4252-929d-4884-b1f7-0fe265c69051", "value": "12288:ow3bUFHCeZUfRPu8Qij3qI+cL4uIH/TpQa5kWfa/:pHM8QijpLA7W+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258586, "uuid": "a8ae379d-65e1-41de-bea4-b9dc012137f9", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258586, "uuid": "dace5226-a86f-4423-9e8c-9fe3835cd665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258586, "uuid": "2e4dcd13-6f7a-432a-bbd0-4d758190b674", "value": "7e8630da613a768182b311ceb99036e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bd394e-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635256884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256884, "uuid": "7a90d874-5aa8-4480-ab3b-87ed3ade1d41", "comment": "Malware payload (RaccoonStealer)", "value": "babb84c5a8edf78b4110fbb5c21c1838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256884, "uuid": "f6c13c35-1a30-4c47-8429-12975498a039", "comment": "Malware payload (RaccoonStealer)", "value": "b236e4c5839aa2bdbef8a9065e76c47809fc1fdfbd3058f2559f112c4b577cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256884, "uuid": "fa11e189-cb28-4335-bf7f-bca1ee11754a", "comment": "Malware payload (RaccoonStealer)", "value": "927199e8e17c260491a203ee4a2ea6a3d5d716b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256884, "uuid": "c02927a2-ccfa-422b-8cbf-df0bc050e084", "comment": "Malware payload (RaccoonStealer)", "value": "4aae1f7424f563f25f01ca991ec947330b66de3a5d1f4e90cbfd273d2576f9deffb95279d91263eddb328335ab24ff0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256884, "uuid": "96053327-b6aa-438e-afb2-c6c1c0a3b4d7", "value": "T13804BE0132C0C471D876163A4875CBAD5A2ABCF3D93D894B3397376FEE712839A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256884, "uuid": "0f9cd18a-c45d-4d5d-a9b3-50435119e8fd", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256884, "uuid": "de9d5c93-b407-4f4d-b376-9876748d28dc", "value": "3072:kfvvIY+VmuIPwKPWAvD4PHATUmrVu0fEjv7j1juVMO6P2+BwvHJ3/R9:wvvUVmusrPWA74PHDYyv7JjynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635256884, "uuid": "a6681b6f-0de8-4a6c-82af-c74b5b7b4a86", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635256884, "uuid": "1b18cecd-f5a6-4940-b9cc-8b4a696eb866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256884, "uuid": "5b68bc95-135b-4d8e-b4c7-609383126a01", "value": "babb84c5a8edf78b4110fbb5c21c1838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425efda0-364e-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635247029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247029, "uuid": "83259edd-14ab-446a-b324-c1401924b50b", "comment": "Malware payload (RemcosRAT)", "value": "4d86b32638ea71902e364138094c7a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247029, "uuid": "9cf8d918-404f-476a-8a1b-5016efdad5e4", "comment": "Malware payload (RemcosRAT)", "value": "b3bb5068e9b2b78e445c0c560322c6bf244c7f008fd964394a0ee46ff8e17fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247029, "uuid": "24075817-65ce-42f2-af77-ae6f9a654d8e", "comment": "Malware payload (RemcosRAT)", "value": "b6fe64828ce095e506264a3918433d5e795b9c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635247029, "uuid": "37f546d0-2607-4d8a-a50c-6a09610f3407", "comment": "Malware payload (RemcosRAT)", "value": "4e3727dcddb1414703ccee297f193c1cf37441df6f022526265e147f770c1883fcf16debee2eac771a1cfd23ba599b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247029, "uuid": "769eaa8f-8c87-474e-82af-795418b388f9", "value": "T1B2259E16E5C14876C9733E78BC7F79F8A939BE203F7C9C041AE1A8481B75282742D59B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247029, "uuid": "26ad8977-f2d5-4dfd-9f69-f90bcab3f74a", "value": "c408e5d23334aeef4d12e2007ba01029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247029, "uuid": "bf822c76-b70a-4c69-b408-882fef808f53", "value": "24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCco2:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635247029, "uuid": "da1b051e-a5f4-476d-80d5-33531c67f6d7", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635247029, "uuid": "e363e6ad-38b8-4189-9494-987e5fa06a0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635247029, "uuid": "14103629-0b6e-4e37-8017-0596fb7b5c96", "value": "delivery@dhl.com,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea09854b-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635263201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263201, "uuid": "3cf09c69-90e3-4b84-ba9b-525bc0f7a28f", "comment": "Malware payload (Formbook)", "value": "1023715ab1412b3ab39be25ad6054e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263201, "uuid": "bf80fa73-8ebb-4b89-8a3f-4a3a29d0ea2b", "comment": "Malware payload (Formbook)", "value": "b4585da149dee9da71100f73ac5088f6dcd2f0bad3a155a78615ab321fce3f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263201, "uuid": "bbbd4415-eef0-490b-9dfb-c671780a7418", "comment": "Malware payload (Formbook)", "value": "b93d9283fffc26259a3675195ed878b3089ca8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263201, "uuid": "c1ceab98-cf1d-4af1-bac5-48d41005b992", "comment": "Malware payload (Formbook)", "value": "4f6336eadb5a4f690e7cf2edd0d46c06f0f2fbdb50222aa7b9b35e850683e140fe4f40ec9ba2f664540e9bafc391a01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263201, "uuid": "72379e19-b91b-4228-8b8a-8da4bd6e7932", "value": "T15E94CF483650B5EFC857CE76DA941C24FA20A97A530BD343B41326AC9E4EA9BCF055F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263201, "uuid": "7acb03ff-645f-484a-bbeb-96df33666812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263201, "uuid": "d9155054-5984-4d12-9ee4-ddf9e3008458", "value": "6144:ETkaubn+D8Zl06rUeAXoEoDxAzP+UGjHVULAio+7JIfRqOosDHuT1QLWYTb:cV8n+dCSXgA3GDSpo+7J1OoouJqWYTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263201, "uuid": "b4495f8e-f916-435c-a759-cdd3f75a8753", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263201, "uuid": "79cf5de9-5090-46db-83f7-f862f097775e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263201, "uuid": "67c41d14-14ce-4d52-aba8-3b44d655d428", "value": "Factura de proforma.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3991af-3629-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635231239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231239, "uuid": "18d3f023-cc78-4262-8eef-6565e7346364", "comment": "Malware payload", "value": "e814f48455988959d5345f7ce3fbe78c", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231239, "uuid": "d441152e-4614-4b67-9877-e19df61d0fad", "comment": "Malware payload", "value": "b4bd228ebad545f0f152f8c37baa338aa76eac7749f55d5c496954834a782d07", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231239, "uuid": "b43998d3-bcd8-4303-859b-5f6c504a89e1", "comment": "Malware payload", "value": "969438500d03cecb35628a6a2b9165916cb0c474", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231239, "uuid": "933a2e50-8591-42d3-aeb2-5398161ec45c", "comment": "Malware payload", "value": "14a3b7b5c05308c79e158cebebfd08f47d93cad269da2c0d1dc3ea8fd43f309213d0a4208739bb94afdd164fc3ce18fb", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231239, "uuid": "8d969d70-bb8e-4923-878b-b9651ad3d6b9", "value": "T1A084230A21703743F3BB77B6460377B12F49AC8CE9E72560AA47AC6574674F3A0D48E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231239, "uuid": "7a6569f4-2200-4af0-94d0-c752c73d869f", "value": "6144:yZaYlRn2bltbtCNlMoFC93KQlqI8hdnManOd+IVQqjKdbiUt0O4NSXMI5MQj0B8X:Uj23pNfqN3nManOozqjKdWUf4NSl5v06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635231239, "uuid": "f394227b-1f5f-4121-b40a-3d4401d5605b", "value": 377817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635231239, "uuid": "bd163648-050b-4a1e-b5d9-04eef78b8f52", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231239, "uuid": "20adee16-d7ab-4f1b-b1d7-e773834f2b0e", "value": "Swift copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4977d16b-365e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635253912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253912, "uuid": "64c22ec5-4ba6-4e18-9c42-f679e9aa54b9", "comment": "Malware payload (Formbook)", "value": "a1b4d8c4d876a9dc57c0a75bdef1f13b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253912, "uuid": "21b3e05f-2eb1-46ee-9847-653480c54f0b", "comment": "Malware payload (Formbook)", "value": "b5b4d9ff557a75779e7d90ce17ab8ccb549e10c41be3a67211dae10fe6daec4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253912, "uuid": "cd57eba4-8766-4a49-98fd-cac5c073909f", "comment": "Malware payload (Formbook)", "value": "5056cfc5f8fe6fa340b275ecb0350d4b2c3fb8e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253912, "uuid": "3f83f20d-6645-41f6-ae8c-69868daaa978", "comment": "Malware payload (Formbook)", "value": "bc06feb8f80a24297ff22c302a275c728c5edc6edca4b887121650f121166773dc4fd0c02d5a78ab835807134a40f90a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253912, "uuid": "ac88a701-3c47-4eb6-977e-3957ad1cc375", "value": "T17A258E6261C104B2DD6329383CAFBA75D9297E912BB49C036BE47D1A8F392837C3D157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253912, "uuid": "42ca7595-1a1c-49ff-afa0-8d6ee8ed48c7", "value": "c408e5d23334aeef4d12e2007ba01029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253912, "uuid": "a6d310ff-9893-4044-b79a-2b2576bf5dc9", "value": "24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCcoe:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253912, "uuid": "c02f6c34-1385-4b42-a666-ed76340f9206", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253912, "uuid": "0ec086a5-3c32-4ee5-b79f-d25aa8c0b690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253912, "uuid": "e7ac28fd-8435-4d2d-bb2c-4950aba3723e", "value": "a1b4d8c4d876a9dc57c0a75bdef1f13b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f4d58a-36b0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635289266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289266, "uuid": "5687894c-c063-45cf-be5a-12f51785a3d6", "comment": "Malware payload (RaccoonStealer)", "value": "6e8bd77ef9a471ba28938b259e9cb609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289266, "uuid": "75188d96-5832-4139-8163-c28e7d2b4745", "comment": "Malware payload (RaccoonStealer)", "value": "b64ab676ffe01925adc506eebcc62f6edc901e017c339af5d90f6d64292e9822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289266, "uuid": "9f581d00-1ef0-4269-9f55-abc88752dbf4", "comment": "Malware payload (RaccoonStealer)", "value": "acb6ca11d1953dec53477922433d62c036d33404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289266, "uuid": "f7aeca38-28f6-42ef-96d0-e4569d543673", "comment": "Malware payload (RaccoonStealer)", "value": "ee5cca002ad6799ee9e085f3fa1ec29329447eaf8b2acec3d1a7b9ea0380d6e66d6e07796cba3cdd98ca8df1a905be0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289266, "uuid": "7f73ad31-5c82-4d95-8e83-b749098caf02", "value": "T175C533523FE2C0FADB465235D8487FB9B0FCC7C80A6144AB3B94F6595F3849A803A957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289266, "uuid": "2ec6cb8f-d621-4886-ad64-9c6f10434d7d", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289266, "uuid": "df95662a-7c83-41a3-90e1-022ab84fe350", "value": "49152:xcBCPkZVi7iKiF8cUvFyPBEGKJkAOHwvS5Z2weqwXWTEwJ84vLRaBtIl9mTWzCxY:xwri7ixZUvFyPaJdOHwvodetCvLUBsKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635289266, "uuid": "8e7a2d2d-afc5-4d89-8319-9167858571b4", "value": 2679216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635289266, "uuid": "3bbf8bdc-b03e-4958-ab2b-17173142c5e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289266, "uuid": "637d61ab-4c6a-4f4d-b014-495842dda090", "value": "B64AB676FFE01925ADC506EEBCC62F6EDC901E017C339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b68349e-3672-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635262452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262452, "uuid": "bfe164f6-0bb7-47a9-b7ff-21ccf24eba9a", "comment": "Malware payload (RaccoonStealer)", "value": "0084fcf83e2875ea3da9af69855c5ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262452, "uuid": "4f4293b4-cd11-46c3-ae29-e87045141dc6", "comment": "Malware payload (RaccoonStealer)", "value": "b669f641d898cd6f15a264e73ba63d638915815b418913237ddfde314abb1898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262452, "uuid": "f54fe2e8-6569-41fe-bffe-b8bb1d9f7b4b", "comment": "Malware payload (RaccoonStealer)", "value": "81c16e4f61537804a3d12c291f9c040a0cca2b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262452, "uuid": "8d10a2ff-471d-4c8d-be69-3cb43c5537d0", "comment": "Malware payload (RaccoonStealer)", "value": "1d975c975a6c68d3ec49521885e95d11ae750dff8d3f1e9883a172ef2741d38df17801cfb887b49dadad68c310f4cbad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262452, "uuid": "d1d6dc5e-4f75-4032-a521-ff381ef31d6c", "value": "T1A3B4F1003A92C075C4B547718C27DAF56ABABCD3EDAC854B77973F2E7D302A08A61356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262452, "uuid": "9be8e6e6-c1b1-4233-8b45-a58cc448afa8", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262452, "uuid": "8d8200cf-3c09-4dd2-a115-acf8fe11eccb", "value": "12288:/lbdYptZjy4YxYadjLpSgc8Cw5dR0uWxsoTS:/jsDjqYkjLpLcNqR0hxsoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262452, "uuid": "c92cb82d-238d-4fe9-956f-694f78d0b2fa", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262452, "uuid": "9e93e870-0ba4-48a1-b1cf-906002f7a6bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262452, "uuid": "c21f63bb-3d22-484f-8a47-08b946f916bc", "value": "0084fcf83e2875ea3da9af69855c5ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571ee881-366b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635259519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259519, "uuid": "2da3069f-848d-47ad-9b53-930ed27a986a", "comment": "Malware payload (Smoke Loader)", "value": "c1440ec09eab1f20bc3a19bf9896ce15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259519, "uuid": "b9c3209a-40b0-43b7-9525-0a4cd691d327", "comment": "Malware payload (Smoke Loader)", "value": "b6998a7d616d36dc5700957d025b9abeca6d3d6eb74f770a88f448dffbd16ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259519, "uuid": "5be6ca97-d1b4-47b9-8715-54ae3307864e", "comment": "Malware payload (Smoke Loader)", "value": "470644d33ef232e789507a01df81a5bf3352871b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259519, "uuid": "59c94728-2cc7-4d77-b44a-87f2a509a915", "comment": "Malware payload (Smoke Loader)", "value": "ea2a553a4adb87d041d0747238ebaebffcd2441a587a3c31e9a7dcf8a2e1095a8a73493944d6d83bc31a389eb438f874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259519, "uuid": "499bb608-23d2-466f-989f-a1a1c6bb251f", "value": "T1A824AE3136D0D871C5BA06318865C6E5167AF8E3DA2C5B8B33DB3B2F3E707805A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259519, "uuid": "8f557c0b-5226-4af7-84e1-a77589f0a665", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259519, "uuid": "f5d1abdc-7bed-424f-9196-42b76652c11a", "value": "3072:AelDj6a/6BO0fF3RRRRzWCXU2lwUJacDdc/maVBHomNMuVMO6P2+BwvHJ3/RA:9DH/6BOSFC8UgVcnbHosMynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259519, "uuid": "740da148-f248-40c6-939b-2ea163cca1ce", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259519, "uuid": "9ba277dc-023d-41cf-bba8-e873e83e6a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259519, "uuid": "7412967e-f625-4bcb-96a5-c909766f192e", "value": "c1440ec09eab1f20bc3a19bf9896ce15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b583967-36b0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635289269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289269, "uuid": "da51da9f-b694-4c96-8f94-6f1c5009a1e8", "comment": "Malware payload (RedLineStealer)", "value": "661a32c0d713d6ee0d478904c088b2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289269, "uuid": "3bd55da7-0b0c-44ca-8018-3d08fefafc1a", "comment": "Malware payload (RedLineStealer)", "value": "b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289269, "uuid": "be1ae61b-eb96-45bb-95c6-e9728729e3b8", "comment": "Malware payload (RedLineStealer)", "value": "24875cfbea7f8b45af94e3bb1ba8fb4541b9fa11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635289269, "uuid": "c6ec9aae-6a82-4dbb-ba63-b645b593bbdb", "comment": "Malware payload (RedLineStealer)", "value": "ccc24a401415a5682b6369f9236c811b118c4aa15a23c17215f79c5c55961178ded05eacf538b166d890bbce7d1378c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289269, "uuid": "d75d9b93-1ef7-47a9-abdf-99b5be9f4f73", "value": "T1FC746C10B690D039F5F722F44AB99368A93EBEA15B1450CF53D52AEE4735AE0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289269, "uuid": "398c4eef-0ea4-4327-80dc-99b3f1f68b22", "value": "0c6b1d4d54028c748ea55e055102c87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289269, "uuid": "e882124f-c339-4b42-89b1-3071f639d00f", "value": "6144:K64XfHe+gnI4168I3hTiUCh1xGxB4N9KPiJokrdVxDVqic0ys4xSVSCWE:K6Yf6I4165TiFhKg7YeokrdVxJKnsOSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635289269, "uuid": "bdcde99d-aa4d-4d6a-b21c-40e3c8965e0c", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635289269, "uuid": "de515e66-d493-486a-a4cd-5d68fba33222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635289269, "uuid": "81f0a904-6dad-4b96-902f-f709a731fd47", "value": "661a32c0d713d6ee0d478904c088b2d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7a0fbf-3671-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635262343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262343, "uuid": "4a6ab86e-a169-4bc9-8c08-9c39ce166c50", "comment": "Malware payload", "value": "1f28e218449dae522c4df84c7e7fbb81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262343, "uuid": "c4e9d306-5ead-4a3a-8183-eff3c59d6561", "comment": "Malware payload", "value": "b6f9105743fb0d4fcaa51590b4b84861a8b54423724016a3dd73a9b1ec9c07c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262343, "uuid": "56de6a91-3630-4984-9140-b74475d13af5", "comment": "Malware payload", "value": "fe697b32a34b17ed69f82518e63a2dba13c9dd90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262343, "uuid": "07f8f77c-0480-4fa3-8360-b8b4390644ad", "comment": "Malware payload", "value": "214957d4e98ab5473e1b79155fbe0d963f67fd77ae8985a23b554c6144a148faf075b515871c35b51b01f9a37c1dc726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262343, "uuid": "3111ea18-c074-4614-88af-b2bf5bbf4039", "value": "T1E1E23A327794C1A8E5D4CE768CC7DEB009F4F9338841A69A36D03B2E5E33BA5CA15256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262343, "uuid": "7b299ecb-283a-4b3a-9318-9d542775647c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262343, "uuid": "8fa605bb-5ded-4c0a-848d-1f664787ae29", "value": "768:nVrncS5E5zm2dabg4uPeWRJn2seM90PGi:VrcS52oJK7Xr90+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262343, "uuid": "b695290f-aff2-4249-ae28-171974c7bd53", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262343, "uuid": "6e4d29a0-70e6-4413-92bd-bb0dc87d0abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262343, "uuid": "21f87699-da24-47a9-8308-f32839200adc", "value": "1f28e218449dae522c4df84c7e7fbb81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c01436b-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635253621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253621, "uuid": "3f2d679f-b905-47b8-b560-c373b2ea3b37", "comment": "Malware payload (AsyncRAT)", "value": "d3fe102de73dc81077874f40b53dae40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253621, "uuid": "7a7ce320-6eab-4d8d-a1d3-029526b01881", "comment": "Malware payload (AsyncRAT)", "value": "b7954218aed66fffee6f679a5e39b7733e5ec0ae8eca6a5077ad8be8a28e2465", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253621, "uuid": "eec78bf5-da2a-4a92-be48-ee7b617d014c", "comment": "Malware payload (AsyncRAT)", "value": "bc2a1d912f39e83c8363bb84b2180792c92a03f1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253621, "uuid": "c5b14b52-6d59-4fa3-a6ef-ce7bf3e4c338", "comment": "Malware payload (AsyncRAT)", "value": "22e3097653572ef12c9d1613bc076bbc37fb396301a352569a1eb52a2911fcfd65b950295e17fc299bb1615800ad0059", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253621, "uuid": "f13ab944-1b20-4705-bb05-91acd5cf5ccc", "value": "T109110025EC67FFF30821E391A0C845EEC1F858C547E44CBC1099344A28BE0792A9D4B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253621, "uuid": "0956334f-fd05-4ed2-a229-c63f71670ecb", "value": "12:TaVLMUVb9wCxMgmxwuq4+1I90xAUcXi5xii/XxBFN8U+3oFnzbH+IrTC:mV4UvXPFuSK0xAU5iexBFN0oFnfH+8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253621, "uuid": "e36af652-3e06-4395-b129-bac2f097ab6e", "value": 1013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253621, "uuid": "02cc114e-5448-468d-b2ad-489927607583", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253621, "uuid": "26b04530-0316-460f-a841-d2a6bbcc9a5d", "value": "DC91267840012PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093add6c-3610-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635220304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220304, "uuid": "d2bc43c1-00c1-4b60-98e9-bd1041a1cbef", "comment": "Malware payload (Formbook)", "value": "2d4ccd0f3638d5a8d580e7ec8c468e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220304, "uuid": "c2367608-591b-4d1d-a800-4d2b6899031d", "comment": "Malware payload (Formbook)", "value": "b81c70e594b3fd2a8cc4499f70eccfa38f610e95a1ca50e1a86d6d63f71f1a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220304, "uuid": "3718490b-b50c-46f6-bea2-8fe648408e47", "comment": "Malware payload (Formbook)", "value": "0734d59cd41a2fad7ea629a979d94c9fa339c246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220304, "uuid": "ae9d819b-da14-4888-8135-db102919b13e", "comment": "Malware payload (Formbook)", "value": "e8595cbc5663785ec329ef0618f9d1cff6c1507aed11a0db2877c28215182a612326afafe7c784280f8621e7db21c2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220304, "uuid": "88480be6-5fb3-41b1-8b1d-d09bf3fde1c5", "value": "T1D644127B31E5D8FBD21393326AF5C3A9C17A814000361BEF97A52FBA65651CAE2072C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220304, "uuid": "e758fcc5-64f3-4358-93b4-377cc764f134", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220304, "uuid": "9e3a94f8-8fb9-4a89-be17-7fa57c810732", "value": "6144:wBlL/c89eQrBeUGQkop9FWZyfyXJw1Gh01jjtafsnh6QFr7Ptkoi:CeUB/EZyfy5JhsjtaHQZPtZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635220304, "uuid": "27e10805-e737-4878-b881-20cbf0f583ee", "value": 263416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635220304, "uuid": "4747408e-f886-4704-9325-11de04f555ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220304, "uuid": "6bdd8f6f-771a-43d5-ba44-8f6531d9685e", "value": "DRAFT CONTRACT 0000499000-1100928777-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b214be6-3659-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635251714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251714, "uuid": "09c514e9-50a0-48e5-b510-495c8f9310e4", "comment": "Malware payload (Formbook)", "value": "d2ae6b73790fbea52fb38ca9efbfff00", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251714, "uuid": "84532cac-b2ba-4292-b52a-2259b553f73f", "comment": "Malware payload (Formbook)", "value": "b8677b241250c8d529fe496afdc597980e502533c8bb71a602451a2336c9e2bc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251714, "uuid": "8e7fb912-a917-4d0d-ab70-dcf985b4da2e", "comment": "Malware payload (Formbook)", "value": "43a3960fbaeccd56106634a306989bbbb37d9fe7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251714, "uuid": "d83dac25-0e5f-49af-814b-3f789aa984e2", "comment": "Malware payload (Formbook)", "value": "61ca312e44ce1d83f581b8afde5b367f1f4a60525adae35c43dd56a14fdafde11ed528b4c3ecb5fbb01a1db9189fb414", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251714, "uuid": "781af46c-bec3-40bf-9ca6-e55a434ad397", "value": "T198A4D0367B90B53AF99AD87136C50D794D694FF25A06CEF1721E73DA0AF0390BA86013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251714, "uuid": "12725db5-26b0-483c-b1f4-8fca22899946", "value": "12288:PPuY7GxkrV93VdOZJAoZIDNdvg9+O5fzM6HXkh5Hm:3uY7c+37OohkoOxzM6HXqHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251714, "uuid": "bb6b3d32-ff59-4edf-bf89-d2764d365227", "value": 451384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251714, "uuid": "6bc0d286-558e-47ed-ba71-6eb27182a854", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251714, "uuid": "0f93d71e-1973-4d19-8fc8-90cea96bd399", "value": "SHIPPING DOCUMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bb06cb-3658-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635251255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251255, "uuid": "38b0dbf3-e702-4ced-99c7-741d3ee014d1", "comment": "Malware payload (SnakeKeylogger)", "value": "f6c8fb8914d4e941cf07e6ab04587f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251255, "uuid": "33174350-a36c-4e3e-a308-c0d38b454c59", "comment": "Malware payload (SnakeKeylogger)", "value": "b9014744c9d9c02a9551eb0e135d379bd8d983fc8aab9a9e9cc5e4ddb6256193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251255, "uuid": "ca604fe7-be09-4a8b-9912-482bec96678b", "comment": "Malware payload (SnakeKeylogger)", "value": "e4574a5e471273aa153f189543c0c6e89f7f7e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251255, "uuid": "3d34f5c2-47a5-45e8-b567-59dfe48b8b34", "comment": "Malware payload (SnakeKeylogger)", "value": "c5f8ab6db954e32fba7140a17b533c273c280cbfe7e8c58813858071e8fec64195bdadc5224dcee118b026d6ad5d077b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251255, "uuid": "603c5b1d-58fb-4139-b0ce-111bd8c62e36", "value": "T1385412098BFDF2B4DCBA577D9072204C63B551913573E3ED4E80A48E59BB342A7829CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251255, "uuid": "35f03182-1c7f-4287-b61a-339e41b97f1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251255, "uuid": "daef3e8c-385d-4954-9b77-617949df6cdf", "value": "6144:AksM7sqTwQQvgI/63lD3G9iso8x9615Dq+qHY/nRvr:tdYgI/+l7G/L61f2Y/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251255, "uuid": "ceb37dd7-b088-4571-84fa-ff1208e405c8", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251255, "uuid": "341172db-45a2-4436-a9d5-60f31bd481f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251255, "uuid": "c90e7df6-e64a-4320-9b00-d9bc7a7b2205", "value": "PO_SBK4128332S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ca8f8b-3672-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635262491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262491, "uuid": "23f80951-862b-4533-afa8-2b942770ef5e", "comment": "Malware payload (RedLineStealer)", "value": "181a7e5f17b92ad5c72d8ce9bb87574e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262491, "uuid": "add74821-31bb-48bd-8f91-c190e80b1d10", "comment": "Malware payload (RedLineStealer)", "value": "b91edfec3840c487692f6897720af908370c2f080575190a413a8f0f7b17f895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262491, "uuid": "8bc5e7d6-e1ef-4ae2-9a78-6f738652744f", "comment": "Malware payload (RedLineStealer)", "value": "a0996a57e98b0e711b3417502cd1bf628bc36298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262491, "uuid": "f9727bff-1b2c-470d-903b-df8c45e612b3", "comment": "Malware payload (RedLineStealer)", "value": "26b19b7d7dab2b6c3717241f212ddb891857564330f8884d1d601ca77e971003b1e16a0f95217e7d5304ad26b0774a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262491, "uuid": "f024b8ad-e8ee-43f6-ae1e-d8150e7cf86a", "value": "T1BA84CF00F7A0C035F1B756FC4AB693A9A82E39E1A72855CB62D516EE4734AE1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262491, "uuid": "577e8461-e8de-4acf-885f-76cf0b05ccd8", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262491, "uuid": "12dd378a-98d4-440b-bc75-063b5867cd77", "value": "6144:XT6HHHcB0aC+hzYAMwU1cSYiWyHs0aHExMbC3UcOyCQE8rj:j6HHHU0shzfuGSJBHs0aHExb3UHyRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262491, "uuid": "45e39d16-41be-45eb-b564-bb9d56b5137a", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262491, "uuid": "b4f28a76-eba4-41f9-a078-8439f047b57a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262491, "uuid": "dbed0a85-5bcb-47ee-b978-f2276450c27f", "value": "181a7e5f17b92ad5c72d8ce9bb87574e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f821bf-3644-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635242719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242719, "uuid": "fe8ba6b2-c480-4ce6-aa9e-3b4cb8a70b72", "comment": "Malware payload (DanaBot)", "value": "fb0fd1471d888d74a6e0478ef4ceaf31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242719, "uuid": "4bfed164-86c4-452f-8602-0a78e3044770", "comment": "Malware payload (DanaBot)", "value": "ba58e003883e6ef7e4e1b5289fc201a8e5eaeec85fe2f3809e68aad8439066ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242719, "uuid": "e8601c71-a01a-46a1-906a-9f97f53a9ee2", "comment": "Malware payload (DanaBot)", "value": "ae65d5be3e5122512c536d2b6b80c3640b91c11e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242719, "uuid": "a2194d1e-543c-4278-8c6d-51a6b619d85c", "comment": "Malware payload (DanaBot)", "value": "4e162d421968d8a4b20950530e8df7d660f742711d571ba3dd62fb071a8ebdcaa76c6f97ff2cc040949fbd2395ce9f5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242719, "uuid": "d72970d2-c5ca-4975-b586-cb5ba380d11b", "value": "T166452320B2A0D4F2F6798B308554CBD11A6F3DC3D6AC46679B8B372E5D302D15A2637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242719, "uuid": "1fb0d9a4-97c9-4722-b190-ad5d2ddcfaf2", "value": "a756627435b382dc3646987f64d479a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242719, "uuid": "17f18b47-f5fd-497c-9026-bd09daf801d4", "value": "24576:XsOLZYf4xG7dOKr3DWOQvdOtU0lG4QI6Bf0lV95QKP7Azvyxa:X6gxoJrdeVc80lOcAzqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242719, "uuid": "451e1e63-eb5f-4fa4-bc9f-061d2441967b", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242719, "uuid": "a020ec82-d6d3-4f5a-b433-b7c2ea5f6a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242719, "uuid": "e5e56334-4341-48cb-b480-43ffa7dc6233", "value": "fb0fd1471d888d74a6e0478ef4ceaf31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5507f0a-3602-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635214606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635214606, "uuid": "d3a73a90-ffcc-4c22-aa8b-1e6b73a7714a", "comment": "Malware payload (Loki)", "value": "e870968e1ff3e06461cc6436a2724e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635214606, "uuid": "6b91abc5-57c4-4d88-b46f-7dbad2b478d0", "comment": "Malware payload (Loki)", "value": "ba8b17ae01e04839943f10d43a76bd6fa7a6804878557b4f3cd935927f034cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635214606, "uuid": "2ae73803-dfb4-4fd6-864a-1c54d51a31b6", "comment": "Malware payload (Loki)", "value": "6274958365492c02e998689fed1b55f94a245305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635214606, "uuid": "6f488160-b35e-4055-b8af-5017bc4f019e", "comment": "Malware payload (Loki)", "value": "21d427dc213c18218d2b10c75289b3eafae2dbd39838b74f41bbfb95625cde7d6cabab2a4161980127351e3bd4b6ca95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635214606, "uuid": "0ed479a2-39de-4ceb-9f2e-bd7133149212", "value": "T1CBB44150BACA7ED4E99F04B58E73F324122CFD2C66A55D917D0B21221AB50D33A3D4AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635214606, "uuid": "08ec6511-66a0-4a72-8283-213140b13dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635214606, "uuid": "3efd48d1-be12-48f0-8099-63fcb7633c88", "value": "6144:pjLQmhTECuWZm4G+7PJQ4Hwqxy0O/zZhXn/qXv07YmuQ4pfjoJnnsjxC0:9OrZhXnCwYvQ4pfjoVnOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635214606, "uuid": "66aeaeaf-80e1-4a76-8f6b-9c749102fd22", "value": 497928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635214606, "uuid": "d465c763-a6c7-4cfa-b25a-aba044f43eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635214606, "uuid": "8fb1c163-9f44-4cd9-8fd2-8bcc9ebbafa9", "value": "CBN billing statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328dd84f-3657-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635250867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250867, "uuid": "2e9ccc93-5847-4e51-8147-4497c800d45c", "comment": "Malware payload", "value": "432b7471baf54346bf013964ad6459a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250867, "uuid": "c8f1f792-5838-4c47-b270-124193cf9738", "comment": "Malware payload", "value": "bb36d070f3db18b78326234fc315eab7301c05dc0cd12967ffa0f0c17edeb6cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250867, "uuid": "c4c85ada-ae24-4b71-b047-f7500f35ee7e", "comment": "Malware payload", "value": "9272cc9e1ab933a6fbc2d4b9c65ceea043af2c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250867, "uuid": "093f438f-b6af-4a44-ab18-a52cdf694de6", "comment": "Malware payload", "value": "1b934840632a5809116a8c0dd22e978d7b7e266bc1c880eaf41a228a9bb405e0019a823da3b4d4c0638805c19eee1164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250867, "uuid": "4344846c-96fe-41d8-b39a-117cf300840a", "value": "T13324BF224CC4E462C720D576B2CBD67B817B1C739390D993FB88FDA73690A118B1EB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250867, "uuid": "cba167f1-ef06-4a03-9944-62f4e991400f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250867, "uuid": "d50ee7b3-cd1c-4994-971f-0f8a50a016cd", "value": "3072:p1Jy4NZdvP/Z29yrmHylhW5EPVSEC12WnD1EjdcDzVTbCKx9CbnBEJx1:3fZR/GGmSu5MrC12WD1ERiVTbCgCbne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250867, "uuid": "b8f30dfb-ed85-453b-b21c-2858bbfde043", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250867, "uuid": "9fcb1ea6-6e49-4553-a2cc-e89f36bd4621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250867, "uuid": "c41df2fc-ad72-4a29-b84d-674fbb6e54d1", "value": "432b7471baf54346bf013964ad6459a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b47176-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251457, "uuid": "a1ee90ac-7b0c-4371-a871-3c76fa40fd3b", "comment": "Malware payload", "value": "c2df5799c15e852f1621febedde1f4b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251457, "uuid": "07cf617d-36d5-4199-92d5-6fa1b838b2e5", "comment": "Malware payload", "value": "bcdfcc3260519a2f288779501b3d26ba357b3eec8663d4a165daa77259b0c755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251457, "uuid": "90f02846-2bdc-40bb-bcc5-1c653163a1b4", "comment": "Malware payload", "value": "9d19c3e01aa2e14e792011e9459ca38594f53c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251457, "uuid": "650231b7-7b3a-45e4-b762-501a762b9e04", "comment": "Malware payload", "value": "538d00b940ae2f144233f87b39fed137edb0362addf1f6568c37f49b33929059d9ae251f564369239d1164394ecaa968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251457, "uuid": "f1ddf1f0-abca-4770-aafa-582c56e7ce48", "value": "T1D6854A10ADA0894DEE8FC23E70E25539783E1F64975EC02566D64BF8780BF878F52B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251457, "uuid": "dd5275fb-7f6b-475a-8305-86612fb79528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251457, "uuid": "05082864-81c1-4ca6-b6de-badfa5145858", "value": "12288:d/JvlLCmGMSOSWv8DnMebN3r5uuq7277sBekl7sT9nPR7yH/RJRavFqkiaTqmXW+:9/kYebxh7ZRFM/RKvMkiaTqmX3XeM7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251457, "uuid": "75b92fb5-4684-41e6-b191-64f4789dc8c0", "value": 1776568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251457, "uuid": "1688b94c-d72d-43a1-a3c2-e143fda18daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251457, "uuid": "6d10f9e0-9fe4-41da-b220-86745f22f5e9", "value": "SKMC__2021221000100490100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358486cd-362d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635232834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232834, "uuid": "5c117ded-8166-4825-8de6-298a9086813e", "comment": "Malware payload (Formbook)", "value": "a01039933b9c934a6829fe80275824b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232834, "uuid": "4b6a6d6f-cd93-4e93-b192-3494bf9bffec", "comment": "Malware payload (Formbook)", "value": "bcef9530c323d83df19a2c750308046195916583b4444971384f0a28fbddbc79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232834, "uuid": "b8fcb46f-9eeb-4ea1-b520-2868d6b55aef", "comment": "Malware payload (Formbook)", "value": "99d995e8908ac659b89e611417531b247968ef95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232834, "uuid": "8bed96af-4d49-4d02-a2b9-efa34bb1dcb1", "comment": "Malware payload (Formbook)", "value": "2435d5bf7ef252cef8fee10dc1cdc88a8a7c8fe4e89ac4e72c212492c4b8ea4eeec6fe208f459e4b67dc0374a613829c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232834, "uuid": "37610f21-dee2-44c7-9201-de355e099b4f", "value": "T18425B603BEC63861D18228B0175AE97974219829105D9F5FB7EAEE211973BC3D8F83DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232834, "uuid": "8cef07bc-9ec8-4fa6-834a-aa5f3b44ef87", "value": "4688138aa56f51df0a1bf9af39c02fc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232834, "uuid": "7711ba72-aada-4104-9dd9-8094e3f2c7ae", "value": "6144:0tt3bW34bTZ1Wf+THmp9EYdKYQIZWEgCsrSlanaW9qSQ4prtdpiZ2uxIZO1urXwk:07py+THmoYdKYQIZW+sOj8wkuxAwUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232834, "uuid": "4b5d4fe4-e810-4cd2-ad84-3d37bb7f49a6", "value": 963914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232834, "uuid": "17b1fec6-f0ae-4c1a-b8ca-0f078770b91a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232834, "uuid": "28da3b04-0b96-4e94-9088-5c79d4903251", "value": "Swit_copy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134e3619-361c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635225475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225475, "uuid": "f949e0a1-7c35-4d34-947d-85ea921c4d2b", "comment": "Malware payload (AgentTesla)", "value": "2b935d7a67e4438f1f424743498091ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225475, "uuid": "948df388-f7e5-41a1-ac2c-fd1e5b5b0c8a", "comment": "Malware payload (AgentTesla)", "value": "bd048a966ad75307501114a3bb679222a083029863dc16f72d54771f9d9d2ca2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225475, "uuid": "e0fd450f-5de5-41b3-88fb-11bed8bb7926", "comment": "Malware payload (AgentTesla)", "value": "e440c2d6d763cbeed29021edc6b3325d326c0343", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635225475, "uuid": "9da538d2-7795-43af-b848-17720b91d68d", "comment": "Malware payload (AgentTesla)", "value": "be69ea8304366f35e6f78bb91a009721d744728f112434d404037c8aa9f2ce7b906fc066a32e8cf7ebf5e5ae0808deb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225475, "uuid": "5418121a-d38f-49b7-876a-65a3f867d955", "value": "T1FBB4CF86E810A274EE696B346A36C93503227D7D6D78E52D24E97C8B3FBFBC35015423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225475, "uuid": "a85b76de-fa6d-437f-ae8e-72d40458bb4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225475, "uuid": "efacf038-659a-4b03-9266-21de495150eb", "value": "12288:iernnqvzmsqUFRDHg1lgrdm4Vz0Rpppppppppppppppppppppppppppppd:ierumsqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635225475, "uuid": "13f8ae39-97e1-4159-872a-3330f306117e", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635225475, "uuid": "586bb9fb-4f76-4fa4-900b-271729226f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635225475, "uuid": "7802d267-074d-467c-a492-ee4dfae07705", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.4240.3863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc60401-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635250992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250992, "uuid": "0dfaeed1-064b-41f0-965f-242c95514d8a", "comment": "Malware payload (CoinMiner)", "value": "97359fe7438222626147144293ba4db0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250992, "uuid": "bb5744f6-7a3a-4ff0-b2ec-a820ab1d0f68", "comment": "Malware payload (CoinMiner)", "value": "bd6863c35c1692f75fb5de5c772aa069df1f78e2dc1b55dea0ea4631f0644883", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250992, "uuid": "b34edee9-0000-4aed-b234-8e1cad86da33", "comment": "Malware payload (CoinMiner)", "value": "d7150f5d6ee1d528d9dd43d3fd456ad4ed21ce7a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250992, "uuid": "8989c803-522a-4f7e-a9b1-128f9e844fc8", "comment": "Malware payload (CoinMiner)", "value": "09524e4120bcbfcc6f7ea33994f15ac8da089da9a7f767a1f4532e4bd42109ef250dd4fb38fdaaa166ee600ada418c0f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250992, "uuid": "28b16d6b-df76-4d95-9935-6bc1ef4a3ab5", "value": "T134A53354BBAA0B74FF3D8F3735324045B9897A5B3D8E45B82E27119E573130AC1A22BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250992, "uuid": "0834ab57-0e4b-487e-af3d-a71d5937b796", "value": "49152:Lt2TeB16p3Wz5YUmTG65w3F459mJVGtnyW1ZmSfGpY3h9p5nD:Lt2i23A5TmC65w3DKn0SOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250992, "uuid": "2ad3d6be-5c62-450b-90e3-2cdf6be6c565", "value": 2212352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250992, "uuid": "4f07e067-2f09-4b2b-96c5-52bf88201f25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250992, "uuid": "2dc40cea-bbf9-43e0-b8ec-d7e112a23ee8", "value": "97359fe7438222626147144293ba4db0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadd755e-3656-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635250640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250640, "uuid": "ea467acf-be4f-4673-b40d-3cae4fe30af5", "comment": "Malware payload (AveMariaRAT)", "value": "eaf5d09e3090077fb8230cd6c2c9f817", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250640, "uuid": "edef6cf1-1847-4829-a65e-1bfaac36a4de", "comment": "Malware payload (AveMariaRAT)", "value": "bd861bdde336df92b72b9be2a047f21c9f8565484855fcb18a818463670dfb6d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250640, "uuid": "e4baeddd-ba72-4d3c-af48-4cb754e02629", "comment": "Malware payload (AveMariaRAT)", "value": "0dba029f0ddb4d1c22573b5e0c361eaa29c2292d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635250640, "uuid": "e7a2e861-e4df-4512-8e10-daad763161d6", "comment": "Malware payload (AveMariaRAT)", "value": "af162ba2949afd22cfa89d7915b67913ff4507d81bd1cb9530f0fd3e91b1892f33bfbbdd0e063c5afed9c1fce7a0a74c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250640, "uuid": "c7e146e2-5cf3-4f04-8cec-c2bdcd2909ee", "value": "T1C6642341F66F877CEE660F75BF5282980365BF41CB11867B0CCEA84A9B596C10C61FA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250640, "uuid": "dd3f144b-b15f-4c60-abfc-e7d1529d32e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250640, "uuid": "b9f0567f-e9f5-49b4-ae30-fe7844c19db9", "value": "6144:Wzhoad49EmYrPzm0y0/dGv0PzOmoL43EVxkKa49IvQl8vQzV989Bp:YhoVRgP1VPzb043EVWz54l8vEb+Bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635250640, "uuid": "07b17372-7614-409b-afc2-306584f2ed44", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635250640, "uuid": "05468160-3b3b-4a66-9d3b-dbe96dd9a1f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635250640, "uuid": "6e90ab46-2c4c-4e66-88c3-f0f84abcfaff", "value": "Purchase List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4146cf13-3626-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635229847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229847, "uuid": "b37deb90-2185-4b92-a846-0c9e872366d2", "comment": "Malware payload", "value": "964c031b3cca7673f0af28adf461f2b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229847, "uuid": "74caadbf-13f4-4438-934a-0bb49b640e4d", "comment": "Malware payload", "value": "be02ba931ff61e5fb9ea332d41cf347d12fc84b4557ad28d82d2b2551406e4da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229847, "uuid": "41198d36-e274-4ba8-b358-516952a48f05", "comment": "Malware payload", "value": "8029649f6b727acfaafd6afc364ea2a4d04a71e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229847, "uuid": "0b499991-9d7b-4e3b-acf2-b076d4873318", "comment": "Malware payload", "value": "505dc62b352a2b580f0bf73d816c2d2453c1b1914f1a61eb02864326ba3659ae0aab1488a1198bbc9c26535835ffc99e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229847, "uuid": "ac23717c-2feb-4616-a39f-bba47415a9a0", "value": "T133256471B7BE45006C2524BEFAB65DB71C91A19CE58FEFAA012C1A3CA4C7C572E48CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229847, "uuid": "082c7792-f80b-4d4b-99e7-61e9638888a4", "value": "1536:OEYNVeVRblzOP2KIH5II54JnsXsf/8rg2HMZSVtBlb0XEXtXX8XZXnIGcYcZtDRZ:OvNVORZOP2BO7gMDW09rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229847, "uuid": "5a6322ae-2e8f-44f8-b015-025017636aff", "value": 1018090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229847, "uuid": "a77e9673-b644-4339-9407-fbb734f7cbd2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229847, "uuid": "3200e119-265d-4a07-86c8-836e3c564d47", "value": "PE.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd04805c-3642-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1635242188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242188, "uuid": "6f814624-7659-4a60-a379-98f1609b658d", "comment": "Malware payload (CryptBot)", "value": "fbff99c95b56e091c01a8876cccde0f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242188, "uuid": "081291bb-91a6-47f9-8e0f-505406e4cf97", "comment": "Malware payload (CryptBot)", "value": "be5587251351d5cbfaae2509c9fb924d5aea72148d6378fe633fd9a158e6a782", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242188, "uuid": "769a503e-468a-43ea-8d55-1dd92024d592", "comment": "Malware payload (CryptBot)", "value": "0418131e869f4f2e213030dfcf25218eb59297fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242188, "uuid": "39964745-825e-45e3-a58b-3d7de1853a2b", "comment": "Malware payload (CryptBot)", "value": "ea95e67b97bbd0f0ac4432b3fec42097cb4f770b4674d16240af97bb5b9f70a73559e03fe30dda00d998ef5e892a90a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242188, "uuid": "a68e33e5-2872-4344-bac7-c0dee7931363", "value": "T1F664D0003A90C831D7B655B18461C6E516FABCD2E93D954F73A73F3EAE72380552738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242188, "uuid": "cfa8dd19-e6ee-4425-a62e-1496ee7f3ffb", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242188, "uuid": "2d495bc8-3178-448c-b3ac-874caa6c8a04", "value": "6144:H8hFgK4CKQizImGjQqBgS1zhpZmWMSifPBBcnej1xcynVP:HQjKQAyZGuVlMgJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242188, "uuid": "cb5f6ddd-8f18-4534-9f7a-c74cade5f16e", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242188, "uuid": "1de26cf1-d47b-42d3-8957-c65663f42bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242188, "uuid": "75643ed3-b1f6-4cef-a376-ab0e29b3708c", "value": "fbff99c95b56e091c01a8876cccde0f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14240d69-3664-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635256400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256400, "uuid": "c25a2d41-7e91-4467-954d-34a3bca1e863", "comment": "Malware payload (Formbook)", "value": "a899be6f029cfd854ec4a7ba4ed3cb18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256400, "uuid": "2f593180-b56e-4f67-b874-84b216ff0962", "comment": "Malware payload (Formbook)", "value": "beb458006bbe9796bf068d0c752a43d5142898dbbd3fa68fca6abc3684471e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256400, "uuid": "67a7a95a-5d3a-4292-9a8f-c4cb05a34069", "comment": "Malware payload (Formbook)", "value": "27d5d4f94ef4ecf3b31037c13e7aba6c2ec91b1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635256400, "uuid": "4a176a76-ff40-4d72-9b70-4e2b00cb4048", "comment": "Malware payload (Formbook)", "value": "87ab5bf118dfcce5b224b4f604de93b33a3fd59f1127a91aa338d62818366adc4ff07fe7a996fc7b0707d5e8ecdb1512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256400, "uuid": "ce3b3b38-0869-4b66-a02c-6a2157bcd151", "value": "T16544121672E0D073D3C621B2CBBB53B9E5399B56053561EB3B688F3F94487C6990B283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256400, "uuid": "dfbe8a96-3431-4890-b6a4-524be863f20e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256400, "uuid": "27936fc1-ac76-4ea4-8c58-00c08cdd6908", "value": "6144:wBlL/cwGhxsWgmWAETiwsnCc4ptvNyVocXoNDIwrQ5npif/qv3m:CeKLAETJzBPvMoc4Iw09YCfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635256400, "uuid": "553c8d78-7a44-4917-9cb4-e7958cd2c22a", "value": 257678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635256400, "uuid": "05406a31-058e-44af-9fe5-b1ac9eea7280", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635256400, "uuid": "9ef32886-5705-4434-bab1-83b9faadab5d", "value": "rrte40912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca179d08-3658-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635251551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251551, "uuid": "25ad2a06-9037-4896-bc5f-28a7d7be45cc", "comment": "Malware payload (Formbook)", "value": "0d8650481c79ff3971d8f9339a12187a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251551, "uuid": "f6b1e0ba-25fa-4aba-8826-427b3614f3a7", "comment": "Malware payload (Formbook)", "value": "bfc8e2f56307790d9b01ce0d5377e2f9e3f3d215d3ffe035d7dcb4a23b9202e0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251551, "uuid": "b35b7500-d15f-4544-b4c2-43cde692ef28", "comment": "Malware payload (Formbook)", "value": "ec1bbb852e12398a7b73c5b20053228fcf707443", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251551, "uuid": "da6adc44-d792-4c1b-8f48-09eb02e764ea", "comment": "Malware payload (Formbook)", "value": "5ec68c2d16d07448f1510a19495067ff3b29a94024e52e22241f4e3f3a773f6d0d6b8ea1b4c61235f7a323e420024a4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251551, "uuid": "a126dfd6-96cf-4b87-b463-6359cfef9ada", "value": "T1D5A4E003EF5C0F2BC1717877FA66A61A286E4E14B736551A3890FEF6A8BDBD31306450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251551, "uuid": "c3f269be-ef0a-4e32-a8ce-dbea37645b7e", "value": "12288:bglRCLBx7gPPPPPPfPPPPPPPP55RPPPPPPfPPPPPPPPPPNJOt6CgmUr/8U7qIdmU:bv7gPPPPPPfPPPPPPPP55RPPPPPPfPPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251551, "uuid": "d1cf32bc-b778-4d5a-acf7-575e506ad53e", "value": 451432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251551, "uuid": "003637aa-7a43-49b5-9a4d-92e1d2270c24", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251551, "uuid": "5807b3c8-0850-438a-9819-e74192bc1eed", "value": "BANK DETAILS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f329b9-3661-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635255458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255458, "uuid": "373241e7-467a-4d26-9c31-c82eeb19fa98", "comment": "Malware payload", "value": "21feb78d14fcd833916779ec7f0abbd1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255458, "uuid": "13f7e59e-4bed-4908-9665-cd176c7e5bc8", "comment": "Malware payload", "value": "bfe360fc395f89367e677cbe3ae0497f4b357142d93e072159662dbc81f5edda", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255458, "uuid": "8c2927b2-b837-462f-a7ab-ec5801a5998a", "comment": "Malware payload", "value": "8a80ef6f095855c557bdff4a046e0a0e988bf1a2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635255458, "uuid": "cc439873-f067-473d-a42c-e1840a2e9a1c", "comment": "Malware payload", "value": "61feafc6de6e928a591e7ba34bf31b0e1ca3eb649ffd527e8999803397ed6da0fdf6ac55023a28577cf31b9643c5f5e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255458, "uuid": "0218eb3a-9a00-4bcd-973f-73f0da128189", "value": "T192D5E08AF328A52FC97794338AB6072616470C469587DB475A68B31C5DBBDC00F9BFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255458, "uuid": "1d8c31d2-2b14-461c-a794-8adc56489a0f", "value": "49152:hg2A1RrBQfrMMSWLu36BG667nncAnnnnKWngiaN271nyqPHaEcskz2bUHU1WRHc3:+RrBdecQJ67nncAnnnnKWngfI1nyAHaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635255458, "uuid": "2f0734bb-d5ea-4201-a79d-8a98430851b8", "value": 2815077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635255458, "uuid": "e9f00957-2298-49d4-83f5-365c08f4f5e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635255458, "uuid": "f0ef3f5d-0370-4221-85cb-c5a0296529d0", "value": "\uad50\ud1b5\ubbfc\uc6d024(\uc774\ud30c\uc778).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9171b68f-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635257040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257040, "uuid": "b2829940-006c-498b-b70f-69071869b05f", "comment": "Malware payload (AgentTesla)", "value": "8c7fae181de7b6daac8d6cbaf328d6d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257040, "uuid": "2107b0bb-9561-418d-8bd2-6df06380cd05", "comment": "Malware payload (AgentTesla)", "value": "c166a7f931452e486cfe99f960ad3585d0afb98140402044931d92af0c89a4a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257040, "uuid": "7ef5024b-a4ab-4ee8-bff2-309259a11627", "comment": "Malware payload (AgentTesla)", "value": "c4ef978cb35b40a2e8a9f54f8e8e5d1199918950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257040, "uuid": "019e2b91-892d-4a7d-aa22-bf866f1b34e0", "comment": "Malware payload (AgentTesla)", "value": "b174a2a596f1af22a7106e79948841f050ae81671aa321b6a68c4a0487c50f8a5b25f7e4cc2d0056749a2884e26b5b39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257040, "uuid": "897028d6-4843-45ab-96a2-5821de8221ba", "value": "T152A4FA50912E3D6FF62FE81C1693E0C8386EA57AA4F1056C939EF014DE259EAED4C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257040, "uuid": "13e7aa51-0044-4422-9636-2ac306bf9af6", "value": "3072:iFwJk3iYC8+DDDDDDDLkldzFtr5RDAw5wff:xkymQkldzFt1RDAUwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257040, "uuid": "f928619f-819a-4d13-aac4-7108af1f982e", "value": 481823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257040, "uuid": "f548a677-4db2-4826-b588-c812ad39b671", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257040, "uuid": "7be99cc0-8741-48d0-af8d-9ebbca6259f5", "value": "REVISED PURCHASE ORDER 26 PRECIOUSE STONE 65441QQMD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46db625-364c-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1635246415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246415, "uuid": "3601ed83-0edd-4fea-a226-c3367afd7600", "comment": "Malware payload (BazaLoader)", "value": "fb88f4d22f14ca09ddeeca5d312f4d9f", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246415, "uuid": "3e231f76-b39b-4d3e-8892-cff929aa18f4", "comment": "Malware payload (BazaLoader)", "value": "c17e71c7ae15fdb02a4e22df4f50fb44215211755effd6e3fc56e7f3e586b299", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246415, "uuid": "b05b3eb9-f00a-4224-9d4e-109d28b74377", "comment": "Malware payload (BazaLoader)", "value": "734205a694689db504418101b91c9981e3a12deb", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246415, "uuid": "40416381-449f-48b4-bf10-799977e4a476", "comment": "Malware payload (BazaLoader)", "value": "3d6f6b85881311bbd275341abc58bf5a77cb3a574b47db37353c0d26aa49da984c0832e0fb8903d649d21c2a8dcdf5b2", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246415, "uuid": "84b23ab7-f2a6-4b0a-83dd-0ee6d9da5caf", "value": "T11ED48D0AFBA48876D022D135C973CB8AE779BC9D4B60934B1268575E3F33B715D2A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246415, "uuid": "216ebbe7-2057-4ea6-a434-50fe2b8b8326", "value": "c270086ea8ef591ab09b6ccf85dc6072", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246415, "uuid": "0ab51a29-0d1a-41f6-8019-9871b55fffac", "value": "12288:J2OXWJQZKFgQJIdevPV6N/+aYcfbEJVgmn+hPl2:vbGhPvPV6N/+Bcfb4uc+hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635246415, "uuid": "bc5f26d3-3f2c-4dc7-a696-4ee6e0129a60", "value": 615456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635246415, "uuid": "6ee9c838-bb22-4ab7-b4f6-7f2c9e6b44d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246415, "uuid": "e930b17a-26af-4dc4-ae64-eb4968c52907", "value": "SharedFiles.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b2c76a-362c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635232649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232649, "uuid": "8de813e0-bc3f-45b3-bc0d-7f776dd6552e", "comment": "Malware payload", "value": "296de0b80deae6dfbce4bdb4a453b0bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232649, "uuid": "92cde41b-704f-4652-8cdb-aa565c44a532", "comment": "Malware payload", "value": "c20eb0028c20c1f9f55b7c6279f49c3a36c41582885ea645c9678cc6c4a6b05c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232649, "uuid": "91258d61-1b37-4252-98f1-8da8ebffede1", "comment": "Malware payload", "value": "1753415c5aae0006c56dc5d8c53d1a6a1c546efa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232649, "uuid": "4030fe40-c744-4223-9a18-0571df46a703", "comment": "Malware payload", "value": "d1d10396731be6616079ca286d5c024d801dfc48a58fde47c28a5bd82489810d5a2d31f30b93122b7f734211aedd089a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232649, "uuid": "79513495-0c62-449a-916d-43c9e40df50d", "value": "T1B2628F11B3A6C6A7E0690E364DE1E6DB3735BC52AE55C30B3284B72F2CB9690CD02356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232649, "uuid": "892bd770-f19b-49c7-a398-9b036f3e21c8", "value": "192:qSjbYPVIU3yGagaf6H6V7HvYy4wG3as5NBiNkv:fjbwIU3Hagaf6aVjUwG3as5NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232649, "uuid": "d2baafe1-2d7f-43a8-bf2e-23eb752e7412", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232649, "uuid": "96688cb6-b458-405a-8e62-cfd7ee214a13", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232649, "uuid": "1464e254-1b89-4666-a373-a90acebbc824", "value": "SecuriteInfo.com.Heur.30418.26987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d600d164-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635257155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257155, "uuid": "e4008a73-e441-4e4e-9ccf-45baaeaa7e17", "comment": "Malware payload (Smoke Loader)", "value": "b06d530fd5a718161ee1468925b4f297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257155, "uuid": "32328603-eab5-4fd3-a6bb-6bfa992cc16b", "comment": "Malware payload (Smoke Loader)", "value": "c2627a1344d6b428c0f47f4695c0fd7df2d8040015595ff5d149b81bebeae5a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257155, "uuid": "32f5d989-f6f4-43c2-b3d3-32ba8f9d7ca0", "comment": "Malware payload (Smoke Loader)", "value": "774b2338c555d64079a9f261fe126fdf304037c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257155, "uuid": "f7482c2e-8e17-40ef-ac36-97414cf56263", "comment": "Malware payload (Smoke Loader)", "value": "e34854395b77a5a2379c67592793ef016d23e26fa1ba3fe9d1cb34a05240b35847bbe54351608fd3080b42fc7997c8aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257155, "uuid": "4ea6eb47-2c18-4cd5-a9f9-77d2044026b5", "value": "T1AA049D0132C0C477D7766A718C6DCAA1572ABCE3DA3DA9473783367E1E711809A2E376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257155, "uuid": "b75db42f-ece2-4ee4-87ac-72480f20be95", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257155, "uuid": "d9a16fef-52aa-433d-9cae-a22a826c97b0", "value": "3072:XHv/IY+VmuIZunPmSkxzqwBPNl1hu0f9t4ptHxrszuVMO6P2+BwvHJ3/R9:3v/UVmu1GxzHBPNv1m75UynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257155, "uuid": "b18296d1-0834-4841-9516-bcfdec05deeb", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257155, "uuid": "3f4191be-32d2-4124-8310-aa6088bf48d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257155, "uuid": "c0182fae-494e-4945-b316-a0b6e7c55815", "value": "b06d530fd5a718161ee1468925b4f297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11fa5ab-3657-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251160, "uuid": "a68caff9-d4f1-40cc-a54b-11c648227137", "comment": "Malware payload", "value": "8cb9b77318c92e9289633e9dd2421ed3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251160, "uuid": "ae348e21-a452-4bd0-8252-4d2cfc758fed", "comment": "Malware payload", "value": "c303e77553b75f0b85e040d03aad3a7c706fb64162be66f2c23c16f0edae5e7f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251160, "uuid": "a2cf0e44-bdc0-46ee-83af-adf35826e4dd", "comment": "Malware payload", "value": "27d426bb5de603731e8ab55fc8d738a58989554c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251160, "uuid": "7510d077-c61c-47ee-8c4b-68774917b8ab", "comment": "Malware payload", "value": "5a81b108c000d86319781435d5c5cdf870e9d1351651f9555cfbaa170cb065a3878466dce1db535843e7b94d04d64fa9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251160, "uuid": "b01343d4-93ce-4dc8-ad29-d448c0c25482", "value": "T117B5B931B5367683D2660070166FBE4A530C7D47B3DA1F98854ECBFD2CAA8F49309E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251160, "uuid": "86db6a7d-b4be-4a34-bea4-fffba8be8a59", "value": "1536:KxxxuavIR/f34HknmJVJdJ2JOJEJPJdJmJEJGJyJCJEJWJeJlJ7JoJJJmJEJGJyS:Kxxx0xxxzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251160, "uuid": "0cf77188-3f0f-4fc9-a596-6278965eafe7", "value": 2345174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251160, "uuid": "c630ac4d-47e8-4478-ac66-d0b032fbcb8d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251160, "uuid": "084983df-2196-40c9-aac6-00e645a49d57", "value": "PI 210907-06.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd3cdbc-364c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635246214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246214, "uuid": "5f9de141-2bc6-45bf-b8a0-e59343b6f9cb", "comment": "Malware payload (Formbook)", "value": "f6e6a34452b88b937514f23fa1c56eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246214, "uuid": "9f2af6ca-9fcc-4f7d-af18-71ea13ea007f", "comment": "Malware payload (Formbook)", "value": "c51d71a9a012a15d2c68395435c84694ad58dd37987e6286ef31d2625cf14721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246214, "uuid": "2a836840-d668-4bfc-aeff-97e56f288b9a", "comment": "Malware payload (Formbook)", "value": "99b501b88528f008ab3e7754d6a016b3f9db56be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635246214, "uuid": "3f04e337-5cf2-4a69-b4c1-2a4af3916b9e", "comment": "Malware payload (Formbook)", "value": "aafee7146fd472a3509950add4fe6a3a1d1595bcf694dc2a50350600b65361c8ba1328d854b0eee7e6e701e9dbf21e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246214, "uuid": "56bab97f-b859-44ba-92bd-ba8e98dc2267", "value": "T15C44129A11E0D8EFC38B067281B6DB4AD2F9C50C2305A55F17B48FB569353CAE21E2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246214, "uuid": "e8ce5c09-3c7f-45bb-9e55-f094766fa14b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246214, "uuid": "59fbff0c-e2d4-4a0e-b3fe-f8175b217199", "value": "6144:wBlL/cxMuFeubtgJXjvhZf9KUxrdNKWzZLN8710dS:Cem6e3F7nfBNKSGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635246214, "uuid": "f9e17faa-58ac-48c3-90af-fa78e1d5f63e", "value": 264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635246214, "uuid": "8618f99c-d59a-4c43-aa70-ee69d7dbabaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635246214, "uuid": "02213a9e-d3f7-4923-adae-cda226cb80c9", "value": "REVISE INVOICE_09812300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935a674e-3648-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1635244587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244587, "uuid": "8a8783c1-43a1-48ee-af18-b05a98b9a6c7", "comment": "Malware payload (AZORult)", "value": "04ed4edf0b9cea31cf2b71e1c62ce6a4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244587, "uuid": "14975ba8-4d80-4dee-a489-12305af6823f", "comment": "Malware payload (AZORult)", "value": "c553f64d683535877671acafb34597f4d27fb02afa7725620c72143a7bb42097", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244587, "uuid": "4554eec4-29ac-4404-9fb1-e21f79b69e3f", "comment": "Malware payload (AZORult)", "value": "48febe2f168a429107072335db3a30a82a0d6e46", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244587, "uuid": "65790d1b-1fff-4dd4-9f53-e8d36d6a245e", "comment": "Malware payload (AZORult)", "value": "47502953ef89e80560995747aa5ac100fb865ceddf83ed0b6eae0a9f7d7fa9f420f82bac81c8864936d890cd521640d8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244587, "uuid": "8e183467-8554-4a10-ab9b-5f775fc09b02", "value": "T13074CF9C7694B1DFC81BCA76D9942C64EA60B477130BE347601322ECAE4E69BCF055F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244587, "uuid": "73f6d8ec-881b-4ea6-b79a-1ff984abfd5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244587, "uuid": "c8926041-8c43-4158-b22d-4dcb004de164", "value": "6144:nP4DT7y0ralVoz/Z4ZLxj0tSL+Q0TggLNsFGPOqDKsgHQJhGhd5vwG:nkuPozCLxgtS3L8NdWqDKsgwJhGhd5vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635244587, "uuid": "cd9ad179-3a72-4ff6-9b9e-5ec334f16ec0", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635244587, "uuid": "498d101b-964c-4816-9166-16afe1b75160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244587, "uuid": "859a7e93-1806-4c52-b196-53aaa09015d4", "value": "u8SynaHDVqPx5fv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15002ae8-363b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635238792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238792, "uuid": "8cd7dd50-97e5-4d6c-b3d1-113947c8ee60", "comment": "Malware payload", "value": "96ce2f30af3ff57d0c62447803f85714", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238792, "uuid": "95f78845-7fb2-45ed-9e1d-64111c4270ce", "comment": "Malware payload", "value": "c6fc05bbe61f97f50454e220d71b6be69c34ce6acb490a478e017f2ece796d93", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238792, "uuid": "bf9db311-c5cf-4b54-ac0a-7cfd2c28ea50", "comment": "Malware payload", "value": "b0648a45602bca304da5fb0c9536c4c9b4726b38", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238792, "uuid": "5a047703-0d37-4b71-8eb5-36738c88011d", "comment": "Malware payload", "value": "677e2e8e2232be1b91080a16bb47949bc2a9fc11ed6ac2266905c0c07e21e90c177a232833b1f05f2a688930e8714516", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238792, "uuid": "97096623-d3d4-400d-87b7-d6a48bf8bbec", "value": "T1E674E228D8B8BE61F4AB40F71DACE0D21CD27F995047A589403270FD6FBB1125A6ED93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238792, "uuid": "e4e2c0a7-32e3-4455-841f-e3db09100c88", "value": "6144:66JLKwyNwFBZnAkd+KA2F/yC2Mb5mRaok8W/OkBUf0gL:9xdyozAkdE2FKCrb5iao3MfBU8gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238792, "uuid": "f86f11ea-ffa1-473c-a28f-397d410e52d3", "value": 360328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238792, "uuid": "5d64fc8d-2b7c-438c-b2d6-6946b09fe633", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238792, "uuid": "e161c025-64ef-4f75-90ff-3c42def20287", "value": "GS 2819022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ceb4a5-3665-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635257042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257042, "uuid": "cc839e6b-1431-4a12-aee5-0c6d3f42fc11", "comment": "Malware payload (SnakeKeylogger)", "value": "9a5a1a96ece8355f2058a27b2ba2770e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257042, "uuid": "d0771f0c-a7ac-4e07-bcb1-f251467b2f3e", "comment": "Malware payload (SnakeKeylogger)", "value": "c7f619995bc97f5c8b8b24e9d55cf36d2eb0af87ba5eb389cb36ec7b0c669b76", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257042, "uuid": "cb2bba04-3669-468f-a760-2813a61eb342", "comment": "Malware payload (SnakeKeylogger)", "value": "e12d878494854545cb39c316cc98db3c9577bf25", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635257042, "uuid": "af3d8202-7a43-4c82-b222-91b130017658", "comment": "Malware payload (SnakeKeylogger)", "value": "210121e9ef49801463e441cb3add3bf98ec7e14f0c9db2cb1b3531004aca428876ba4004cb9c292373173d74c5c3d619", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257042, "uuid": "1b499c8c-38d4-4f47-a5bb-3b97f9c94843", "value": "T179C3BF9276A3D50ADD4F43392CE682CB2752BC114E7F52B7B765FB0ECB70A84490261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257042, "uuid": "9a0b7dc3-01c9-4a7e-9c6f-aadf6050b410", "value": "3072:bk3hOdsylKlgryzc4bNhZFGzE+cL2knAVioo1gaSNAPZhsWFPO7YiR6PJEcjjaPD:bk3hOdsylKlgryzc4bNhZF+E+W2knAV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635257042, "uuid": "9ec297d2-214f-4ffb-8fec-f53384332718", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635257042, "uuid": "68dd004f-52d8-4d30-846a-34e160cfa7c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635257042, "uuid": "8c78511e-c9a2-48e5-a4f4-79ee2afef503", "value": "Proforma invoice35117img.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49ba893-366b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635259702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259702, "uuid": "118fd347-d5b5-475f-b8ee-bd034012472c", "comment": "Malware payload (Loki)", "value": "75e80cefc7df5575c82e0702d26d286a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259702, "uuid": "715af153-80fc-4151-ac5f-2f2e511dc69f", "comment": "Malware payload (Loki)", "value": "c8099f1b69f028319580ee8753f206d02ba3aa9a82beef145e0da69e3dad83c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259702, "uuid": "be4f5212-8b1c-46ba-a158-fa677f298eb7", "comment": "Malware payload (Loki)", "value": "33171a46692bb89e23e2902e08c8076aae6fe551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259702, "uuid": "bd238b4b-0f3c-4bc8-94b4-358d959ec8a6", "comment": "Malware payload (Loki)", "value": "0cec7c156e3a562c01bb4759ac65f62b403c9255ad0acba1aebe46fece6f4eae9a0917e14150bc049b187e328be41895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259702, "uuid": "5008bd2b-4932-4a40-8ec3-da4ba386a6fa", "value": "T1E144136B5FD084BFDAD69BF239A6B573E97103340130E14BA310EEBE25139C24967693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259702, "uuid": "cf925e71-c832-49b0-bc1b-c8348110f12c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259702, "uuid": "3d730dd6-e307-44a4-ab23-cc4e69d80a5b", "value": "6144:wBlL/cX9O3Na//mZB46VZ08yp0gLwhLIerZF9IPe7WYmky5z:CetOI3+Btkf5grbfIpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259702, "uuid": "de28ac43-d433-46ee-8767-bee8724ebc51", "value": 255383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259702, "uuid": "1294e03e-f03f-4b21-b2b4-c29089bf844f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259702, "uuid": "cc03ec9a-c1f9-45a0-a8ac-068e61d3eee0", "value": "75e80cefc7df5575c82e0702d26d286a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854f18f8-3641-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1635241557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241557, "uuid": "50e56e67-5f21-40c6-9dd3-3df60048a06f", "comment": "Malware payload (Gozi)", "value": "db1debd01a99ae5b44a4ea5f8d8643d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241557, "uuid": "fe006ad9-429d-410f-a126-6b71e4c28ad9", "comment": "Malware payload (Gozi)", "value": "c838678b643d9d61156280adf5ebee54112496778820a4e93bfcfd72a93ea8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241557, "uuid": "65fecc34-6b4b-4809-b1b3-cdef980586cf", "comment": "Malware payload (Gozi)", "value": "d8dae1e45d0e73d650193304763ecf41390940d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241557, "uuid": "5fe3b04f-b9f7-4186-a288-14db3fb5a62d", "comment": "Malware payload (Gozi)", "value": "06b4a17ee92103c91a993f6a0c58577812f81193b891cca8cecb4ca1c4a70f3de765ce5dd5bccef81a34b345b34c05f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241557, "uuid": "3977b56a-f1cb-4816-bdfa-70688402208d", "value": "T1BB347E6AE2E50A95EDBBD5B9CDC3C217D7F274490A64D34F13B0CA9A6F43321B218385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241557, "uuid": "e3d67c96-f604-4c74-b88b-d9ea448c3014", "value": "6144:2W/TYr/Pbqk2ZFOY/ybb00h2ETEzIwt7WtBk4S2Ui:2W/TYLPbqRul5dQzPt7WtBC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635241557, "uuid": "a4115dc9-acd4-4bcd-af29-4fccbd6d6b6a", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635241557, "uuid": "431df015-3d5e-44cd-ab42-c203af02307f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241557, "uuid": "7aa784fb-94ab-42a7-9f9b-dd61e41bf45a", "value": "1ca07290000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed65d80e-361d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635226270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635226270, "uuid": "0ee94160-8b58-4120-ac46-34b6291e4696", "comment": "Malware payload (AgentTesla)", "value": "46ec049e8eb3b4cbdcef2517f4d423bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635226270, "uuid": "ff7a0399-0e62-4c7a-8ef6-bd22cb1cd254", "comment": "Malware payload (AgentTesla)", "value": "c86eba646c3fa849804b19df499e180d6ae21e92d9935d7e7886f6e8a1d051a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635226270, "uuid": "1d6a75de-8c74-49b6-ba83-1183577d3d3b", "comment": "Malware payload (AgentTesla)", "value": "1761154ad2d8107192d33867180d5197b7066ca6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635226270, "uuid": "866a1e66-d022-40c3-91b1-3745c08027af", "comment": "Malware payload (AgentTesla)", "value": "28422f6a60af914d08d2ff5733593b080a90f765b28eb85fdbefcb26115ca13a525f182c7a6d58c268fb7569cda71920", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635226270, "uuid": "9466e344-5772-4c47-a3ad-1f6b46d4337b", "value": "T12274131D4B69E364DFAE8B78A018220183BA927A7521F36F5F1A725E3D273434117DCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635226270, "uuid": "e7ae19a0-2513-4c04-8d51-cbb20f9af776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635226270, "uuid": "af6d6eb9-2618-45e1-86e8-85837d38551c", "value": "6144:2vbNm+3aaNgyZ1AqYAQ1ubnP8oAy/hP+MNApLvjV0sNwBaUagr/ITjQ9/I:EhhJZ1rtQkbEoA8P+MNELvjmspUJP9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635226270, "uuid": "f597b6c9-902e-4bee-991f-4e8199049bc9", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635226270, "uuid": "66684b2c-5176-4348-9001-d1316a7db4a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635226270, "uuid": "a72e90c4-b97b-4cb3-9c1e-db05e7274466", "value": "PAYMENT FOR OVERDUE INVOICE13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160aabeb-365d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1635253397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253397, "uuid": "5220da61-46dc-441c-90b1-5f4a63d720f1", "comment": "Malware payload (Gozi)", "value": "a04500c9a6a2b7b68297b5de2f340804", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253397, "uuid": "e7df4a1c-37a7-4697-aad9-144cae0e8f81", "comment": "Malware payload (Gozi)", "value": "c8cbf6b7c7dd4a902c31d1f14f508f6267f50d55bb84c306d6c16b6bf43b4107", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253397, "uuid": "69b68134-b510-4c06-b4c9-2dcd46a0189d", "comment": "Malware payload (Gozi)", "value": "37830ec36c04565da1d3378ed78c64c65e26699b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253397, "uuid": "dd90696b-f872-495a-b9e8-784c59076c8e", "comment": "Malware payload (Gozi)", "value": "28e3a644925cac433f598663adf852e9033b26c1cdd0b8395a05480959a657e68f6a3150fb9ddf8ecb78ef6f8f3bc3c9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253397, "uuid": "10fc0557-b46e-4cd0-a722-242c4f4025a1", "value": "T117A4CF1331F90074E1BB53794065A5819AEDBF52A73ACDDB62C8216C82BBDC1AB3D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253397, "uuid": "3bf65d50-3425-4eb8-98a2-794ba6f88910", "value": "ac25f5a88b067ef166efd1cbfb31ef12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253397, "uuid": "88113649-cf7d-443e-93e5-4dd023b0ee9d", "value": "6144:K/L436NJ3cuwUO38PRLOWIs4fuFflXX8V1eJdpQh0GrjqI8E74:u4368LF38ZqsekXSedafoE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253397, "uuid": "7408ac7f-1447-41f3-b380-9f5cdfcb7965", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253397, "uuid": "ffba843c-1787-41a1-a7e3-937a3483ab0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253397, "uuid": "dec3aeb2-eea4-4219-bfe4-215d319e1adf", "value": "6177fc626d11c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd84d51-366d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635260634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260634, "uuid": "d8c77039-ff8a-4806-abb4-91420570bf79", "comment": "Malware payload (RedLineStealer)", "value": "d930e2debbc15a856a4b3dcc256bc606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260634, "uuid": "1c35015e-6034-4e1c-b204-f4c949975e1b", "comment": "Malware payload (RedLineStealer)", "value": "c9f3f0f3bd64376d43254b4757644e5fcefa2c6c1d715f8078e806b3ab682030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260634, "uuid": "97afb62a-4965-4586-b679-87ff08698be4", "comment": "Malware payload (RedLineStealer)", "value": "a6095d2c85283567abfa90b60202d76b510d4eff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635260634, "uuid": "48f9b382-7e55-4a9f-a45e-ac4769f61bbf", "comment": "Malware payload (RedLineStealer)", "value": "c179cd58409c398de279241d0e4448233d3eeb290cf65e5ddcff97c5c0749294d8d9949f77f194793767a6a2e65a6c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260634, "uuid": "34d611ec-22a6-4c03-a6fd-f9192ec71b2f", "value": "T1B3F3512B812284AADE480130DC1ECF777924DCDC1940BAF4B6EB4F7BB41529EE8B7165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260634, "uuid": "4319b43d-ec9f-444d-8bea-1bf50348098a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260634, "uuid": "f714b408-23e2-4924-ad35-3817f9a4823e", "value": "1536:csAmvP2v+ba/LkFmWiAikI12WFRrAwQZi+V5L:XR92ok9wu3dMi+V5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635260634, "uuid": "4c620096-da08-49db-a8e8-c597b0ed9a8d", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635260634, "uuid": "e5c9dad4-f7a0-482f-81c0-057779d47b4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635260634, "uuid": "17e689b7-782b-4e87-8c9f-e2a45e6788f9", "value": "d930e2debbc15a856a4b3dcc256bc606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe2a831-366b-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1635259695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259695, "uuid": "04137eab-d355-4c02-a6af-5a13e10eabc7", "comment": "Malware payload (ServHelper)", "value": "63151e4f7c3972f18a23c0e9996e14ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259695, "uuid": "0324449e-9e38-4f71-99f3-41b68662f533", "comment": "Malware payload (ServHelper)", "value": "cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259695, "uuid": "aabeb96c-9075-4bdf-a93a-878f223528e2", "comment": "Malware payload (ServHelper)", "value": "5d041fde6433a8ff8fc78a69fca1fd4630e3f270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259695, "uuid": "352a2906-e2ec-4413-8736-231b231068d8", "comment": "Malware payload (ServHelper)", "value": "272178e905b4a0f24d7e5853780b49a2dc4a6c79a9e4f9eba48243c98133d427dd031e13dbf234c4688d59d2eea371fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259695, "uuid": "3adfabb7-a016-447e-b6e4-3c427fd8d4bc", "value": "T12E56F103BC9264B9C5AAC2328DB592A13731B859073177D32F54A6BB2FB77C01E79364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259695, "uuid": "7a47c86c-722e-4a6d-bb20-6e8de8007935", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259695, "uuid": "fc2a999d-dab2-4097-b850-0fb2b2a81bc2", "value": "49152:H+zcyKrb/T/vO90dL3BmAFd4A64nsfJdItom5VWIKvZeUW+EMioAnt64mtCvtEhq:H+nvKojmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259695, "uuid": "4d06b9e5-d3b9-4f5d-80f9-be6aa9adf988", "value": 6024704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259695, "uuid": "24b85d5d-dd3d-4f3d-8690-ed95ae3f13fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259695, "uuid": "a7eeac4d-cf30-4031-8b4d-7f776d537c86", "value": "63151e4f7c3972f18a23c0e9996e14ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cdcac5-3637-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635237312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237312, "uuid": "28b952aa-d5f0-4b47-94f2-d968c2b9ccb5", "comment": "Malware payload (SnakeKeylogger)", "value": "f38ca09e0399ce10d78f4a79992b4212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237312, "uuid": "14b0aebe-f4da-4bab-91d3-f44fe4f9e691", "comment": "Malware payload (SnakeKeylogger)", "value": "ccadf2c2dbf2d49d266db7bfdd5179c2a9c11cc81f7b93ffe4af9533e859b8ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237312, "uuid": "65687f67-7d76-4914-b7d3-4e13c3d820ee", "comment": "Malware payload (SnakeKeylogger)", "value": "f604dc5c9b523302b1417d5a5dd0931b76e84cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237312, "uuid": "a657ea50-c194-42c4-9298-3c89d6b3dce9", "comment": "Malware payload (SnakeKeylogger)", "value": "4a912aa721992bac258daa483ef5897a79163f5f6f6c929dbfa63e94bde5ec002c2b2797c670e2311ea7a7688af1dc13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237312, "uuid": "a6f9c347-5c42-46f8-833b-b5f0ef4305e7", "value": "T12F052FC2F5C3EA5FC5D825B096818E1074646FD8442FB9A1FA6A7E5FE33F690A81C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237312, "uuid": "cb5b2442-42bb-4e11-8f67-d3bed6362eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237312, "uuid": "aea0f85f-cf3e-4c80-84bf-a2749d2ea28d", "value": "12288:pwnqIsyOzLq5gl6iEC/MHmg789IW1dXg:6BTOfq53C/MHmg789IW1dXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237312, "uuid": "01377f8b-10dc-4f53-9c27-db680251a715", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237312, "uuid": "ae1e9af0-f099-4b56-92d7-5677fa423f13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237312, "uuid": "b4016fee-6bce-4737-8d28-4a90139b9e60", "value": "A86gmDlYqpHVq5d3QIMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5182960-3673-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635263139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263139, "uuid": "9c0b84d5-1cc1-4e4e-80da-6a1de9a134d5", "comment": "Malware payload", "value": "3543caec69c9de0ef273bba9e6717d5a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263139, "uuid": "a33bccef-c03a-447e-a56d-200c0335bc38", "comment": "Malware payload", "value": "ce5206382981544899e5fc7f5f2e07a0b1b2c7bebc88e29d11315189508bddf4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263139, "uuid": "e455e03b-25d1-435a-8a12-f2b433a398b5", "comment": "Malware payload", "value": "a9bc4b2dedbc636cbf3b67be24ba8c454b935cd8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263139, "uuid": "6b85d519-373f-416e-9ca2-e1d71d381563", "comment": "Malware payload", "value": "7d412d1816bb62f672ab460b532c11ac53b86aa31e6bda34d299faff84615dae466abeed68eceed881524b45326ac722", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263139, "uuid": "80d82de0-9b37-4c1d-87bb-2664eec8edaa", "value": "T1820351B7B383DE05C96407754DF38BA2272EFC345E96825A3645F33F1A79A809923253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263139, "uuid": "2c4b533c-84c8-432c-b42b-69a55381863e", "value": "768:zSk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJdUem+WalvUes:Ok3hOdsylKlgxopeiBNhZFGzE+cL2kd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263139, "uuid": "d3a29750-f429-41ce-b3a1-daf847d59bdc", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263139, "uuid": "3da99d26-2b3e-4fd0-be5b-c1c7b2435315", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263139, "uuid": "fa5841e3-28aa-4556-8b12-550b5e4ad157", "value": "DHL.Shipment1.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b746c3a-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635233380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233380, "uuid": "3111ef0f-2aab-40aa-baf6-1f32eebfce96", "comment": "Malware payload (RedLineStealer)", "value": "efdb04047aef4d0303e213ae65480690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233380, "uuid": "04778ac8-00c9-4288-8000-106cfcc2454c", "comment": "Malware payload (RedLineStealer)", "value": "ceb956e84c39e479924846f8b16948012a26dd8c6afa932ca445afd06cabaeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233380, "uuid": "9f8089eb-ecba-47f3-a2a0-5b0d9106882d", "comment": "Malware payload (RedLineStealer)", "value": "9093627786ef5ef6aafa0f7a276e139fd4275098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233380, "uuid": "3ed2ddfd-254e-4f5f-8d8a-deeafbdc49bb", "comment": "Malware payload (RedLineStealer)", "value": "3f5023852c28c8d08aba8e1ac1c763c82fcd165a55f8f89d2bb85f04c3f275895c5315dabbf252496b64c794cd18a2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233380, "uuid": "39d5d65b-b97b-44e0-b40b-21c803051bad", "value": "T1F926027323658162D1E1CC328937BEE972F5176B5F43ACFB66D91DC528322E0B222953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233380, "uuid": "10e512f8-c984-4e26-9ba3-318fec2a635c", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233380, "uuid": "43cf0367-ce37-4931-8f4c-358551946b50", "value": "98304:BLPhsSzHsL7LQVnI+dbyWi92F7rFMrvvf3IhTKEY9DXP69EzOj:NHWcVI+YWE2lJQPIhTKE6TP69aOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233380, "uuid": "78a14c46-3f63-4b70-b7fa-16e6c76dce18", "value": 4774912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233380, "uuid": "fb78e89d-85ca-4b01-a3b7-1c9e62838ab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233380, "uuid": "ed77eb46-7cf5-44fa-beec-7a9ef17238f1", "value": "FortniteModMenuInstallerV3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31c579e-3630-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635234306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234306, "uuid": "9f4c8312-7965-4736-b5b8-23ab018feea4", "comment": "Malware payload (Loki)", "value": "d1ca5f940218b1f6f4e6a7e8aaec48c8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234306, "uuid": "06413239-b9fa-4f1b-a9b3-ffa6150d8a11", "comment": "Malware payload (Loki)", "value": "d03d6a763a133ec9a9de300bfb993f5231b76da17f318043968121aad350b598", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234306, "uuid": "59e74de1-8461-4580-8b01-6e7d63dd567f", "comment": "Malware payload (Loki)", "value": "a78c5efd7975fdd827e069b9f824c4adac3c5c30", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635234306, "uuid": "a077a9b2-4f05-44b7-bc24-fbc60b560344", "comment": "Malware payload (Loki)", "value": "7fb35845ec1e29844658889157f821c09eb46a0de177b3e46bdf7129f31bd8f734b5bf4cd4cc159de29a0015593202ed", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234306, "uuid": "06e3ff85-e0a9-4d89-8753-eeeb9f0c4fe5", "value": "T19634220459B7ACFA9CBCC4C2A8A73626E387C73DCD24FDB9609115828D1209F4B7676D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234306, "uuid": "d86ad0dd-f50a-4d13-84c9-47bfbe7ab37f", "value": "6144:lv6RdLGKpUoRxPTnbqe2qTeg8RwJY8JnIvJ1H5sIg:R6RIKaoRxbZbig8yuwIbH5Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635234306, "uuid": "df1a5f0f-1e2f-4549-87c0-f99121bac9b3", "value": 234302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635234306, "uuid": "bc11c307-747d-4a64-a8a5-7966c7d89c83", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635234306, "uuid": "fc1ad483-ce62-4537-a9b4-538afb02ba43", "value": "RFQQuote-REF MOITB102125083.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682d477c-3625-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635229483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229483, "uuid": "58e25f2c-94cd-48c6-8cfa-bf46257756c1", "comment": "Malware payload (AgentTesla)", "value": "b183ff63d3365f0c6fced13528b5e1b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229483, "uuid": "cda4fc81-65ae-47e9-9cfb-abf19809f777", "comment": "Malware payload (AgentTesla)", "value": "d0c0f2d139a43aa0cc60742dcf96c6743747696cc75abe7a0cd7793354b562ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229483, "uuid": "6296f03d-2641-4367-8cc0-f2a1982af55a", "comment": "Malware payload (AgentTesla)", "value": "bc9ffd1eb4431c8e734c54d5ea4e058808e544ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229483, "uuid": "71e61659-6430-40c5-83c3-3e4e9fc4aeee", "comment": "Malware payload (AgentTesla)", "value": "fbb2bff0d427f3dcffbd268a457aa3cb2fb158d8b7e81dda37f5263a992701c7f9a0f376fa69b769d23e31570cbf2af5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229483, "uuid": "ce5e84ac-cf6c-4075-ae1b-be210631941b", "value": "T1AA8413898DECC339DF7D8FFC3651461492F47190BA02F2AE2954A1EA1F7B700E8D45A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229483, "uuid": "a280c57d-20b4-4d16-abe4-61a43278f9eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229483, "uuid": "348406a9-46f2-4202-85d4-74ba4d77c354", "value": "6144:hkORlL25VLGEo9btRI1/fTnibA8UwWh0991Zc8QqRjPZxBAy4/F:rLwLGEoWG0FwWIi8Q+7ZxBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229483, "uuid": "f5ac3f99-8370-4faa-a323-fb7c06e99118", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229483, "uuid": "a73b6449-a6cf-4d62-b91f-9e6d465c012a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229483, "uuid": "fe8545b3-8be9-4568-bad1-4c63fca1608a", "value": "PO_DOX367892,XPO_4700102874,XXPO_4700102412,XPO_4700101391,XINV36782SG..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746392fb-3611-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635220913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220913, "uuid": "b0067199-fbdf-44a9-8a3c-4a44a750d438", "comment": "Malware payload (Formbook)", "value": "57e634d27ebeb3eb96a21efb56654952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220913, "uuid": "b93bd92e-c56f-42d5-914b-6a9658373571", "comment": "Malware payload (Formbook)", "value": "d0df1d753742cd9d3144c77f0b343aac22fdab2a2d32bd41872dd838e2eb8a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220913, "uuid": "355c3686-4fc6-4761-92f1-a3d1c02206b5", "comment": "Malware payload (Formbook)", "value": "3a73a99013039be2615cbefd0cba1e4f5d10ea45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635220913, "uuid": "a78e723b-5832-4f41-8651-95658a2ca969", "comment": "Malware payload (Formbook)", "value": "7dee5ce3420412d16593359528923c2df24f4165f85c62f99fbcfee23b8335de10d4fec3b67c46c104f814a38f96dcb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220913, "uuid": "99bf0b08-4dcd-43fb-8d61-d8483a675f82", "value": "T1CF44125A36D260B7C6674BB54A7B6A63F7F681080735A05F1BB18F3BB6317C34A06183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220913, "uuid": "91118001-a05b-44a1-b702-0dcc2f7b86f1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220913, "uuid": "ce0a7842-9815-46d3-bd08-7c41aa629e24", "value": "6144:wBlL/cc4oc42RkFS2z0SOC1WExR7xS3HWEn8wL2EBoAKOrySM1I+/2W:Ce62Yz0e4AN620aE23Oyyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635220913, "uuid": "2083e458-5809-4984-986b-a4ac2e9ea355", "value": 265930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635220913, "uuid": "2e58fad2-1bf1-48e0-ada7-b261f3d988f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635220913, "uuid": "73501bba-8998-4f9f-97d8-1e0618d95ee0", "value": "Enquiry docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6affba9-3625-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635229722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229722, "uuid": "b3d01281-6247-49bc-835e-c2f7694a0605", "comment": "Malware payload (AsyncRAT)", "value": "e997cd7475a509f40927b1931a685cc9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229722, "uuid": "cbff0996-daf7-4c99-bcfc-7125ca2ac3ad", "comment": "Malware payload (AsyncRAT)", "value": "d42e5f2e60b39e2aca3dd09a4dd5803a04b33821e6da8808ef9ef450d6771e30", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229722, "uuid": "162e5e36-d93a-4718-a61c-3809325dc877", "comment": "Malware payload (AsyncRAT)", "value": "ed1029eb8317be5ff127978fe7fbc9aca57b63af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229722, "uuid": "c2c1ee3a-e669-4f32-99c3-3ba811f2b951", "comment": "Malware payload (AsyncRAT)", "value": "d2cc5f2677d48e919b9bfa988f2e096538a8cc9d7c3d350248a5ca45e073aa4215e2b2a0943c1e1993ac8f77dd157b6c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229722, "uuid": "14aa0d7b-f6c7-4f29-bb75-2372f9d17a6a", "value": "T153F0220FE42BEBC70A217A13F0F7913D953080C60BA8CA7C822643CD4B604753E251BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229722, "uuid": "53e31bff-9cc4-4a0e-b391-2a99984a7792", "value": "12:TaVLMUVb9wCJhIgmVeljehfMWUBAzdqsH3wuSdgCXg0TC:mV4UvXrp+fMWPnwuSdZQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229722, "uuid": "172d68c6-935b-4571-95e5-636f26d1989b", "value": 505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229722, "uuid": "273ef287-994a-4312-bd6f-c0bca7015bb4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229722, "uuid": "e6776b8b-8740-45dc-b07f-5bc96ee5cf4b", "value": "Waybill.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0032e1-362d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635232821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232821, "uuid": "93d7d7cd-4ffc-4c5a-9fbe-3cd8d70366eb", "comment": "Malware payload (Formbook)", "value": "d2e2cdd6fa6b98ec2ce195bfc0079835", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232821, "uuid": "b207489b-180b-4df2-bab5-452a290f08e3", "comment": "Malware payload (Formbook)", "value": "d45bd3cd9838ab93a42cfbacf31527272ea2862f18577a4fa5465d5c47f2b726", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232821, "uuid": "8a2a12b9-7759-4539-87a3-17bbfaee3e60", "comment": "Malware payload (Formbook)", "value": "2278b79dd18aaf91d28822e52c11270c1726bb5b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232821, "uuid": "95df4213-cef9-41d6-bc12-f55fb66bce60", "comment": "Malware payload (Formbook)", "value": "149a2431cce88aff6037181b6c62fa4e77a92aa0e8d408e213b7682a3f44e7579c9b6892857be1f9ca3b25fb306b0f60", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232821, "uuid": "d6ff7396-e159-46c3-be1e-52a3f4548cf0", "value": "T16C5423AA8499DE288BD195F8FC5E4BF1F7098117C4E57F8A1D11480B4ECDBDE3A62E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232821, "uuid": "2fe24d33-5a4a-429c-b6e7-b9d51a176fd8", "value": "6144:o3VRtyi5hZqGpdoHUza1SpKyW9qSQ4brtdpi/2uxIZOzurXwCNd2:oPtz1voN1VU0w+uxGw42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232821, "uuid": "cead8ed6-ff10-46d9-87bc-f71ac8dfb404", "value": 295408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232821, "uuid": "cd180203-b76c-4d95-8188-ff7c1d407178", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232821, "uuid": "f21cc60c-1973-4d0d-aa1d-c70352c9d2ea", "value": "Attached-Payment Done Today", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb768879-363a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635238669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238669, "uuid": "9fe9bcb0-5e27-49da-9b73-0d26ea73dd5f", "comment": "Malware payload (Loki)", "value": "20f11c0bb7392ff78f4ab89637cb68f4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238669, "uuid": "3deaf909-5abb-4663-862a-a2fa5462082f", "comment": "Malware payload (Loki)", "value": "d4693da12f8db16b0fba165e085d2d6aed22002c6eb7c6a710a28085ed68d005", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238669, "uuid": "aa788a67-bc9c-4193-8fad-335a19ea12be", "comment": "Malware payload (Loki)", "value": "4713537257bd3b53a104dca735fb601101ef77e1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238669, "uuid": "5b7c547d-5b2c-4367-a796-a05818eeed88", "comment": "Malware payload (Loki)", "value": "c13d111ccc40c32c4ab147e0309db6b3683897c95775fd0e75971b56bf22c05f24418b2935aac5f4045d2157c5e87859", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238669, "uuid": "d99d876d-d5b0-414c-a4c8-5d4301c62ad3", "value": "T14BA4D19DB631BD66E605273D8C453E0A4159BF14633AD592632CFA0F683AF3C3B86588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238669, "uuid": "7fcfd524-8dea-41ee-889c-05df73149f13", "value": "6144:TP4E26Pn8jvMF/a6wFg2Nur6yNKxSRy4LkDlZyJwfOq55innsmEF1UbLnxAA5zEj:f26/8jv8/cFg2YWyN7HLLwGq5Innyytc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238669, "uuid": "2114a648-91b6-467f-af27-1ea3dd889fb6", "value": 451352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238669, "uuid": "e25d7a3f-cef9-4dfe-83b0-d25cefec8d1f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238669, "uuid": "894bc57f-526a-4e33-9dbe-0b04423d141c", "value": "Revised- PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eaf7e16-366a-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635259182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259182, "uuid": "14c36aaa-9069-45ec-b14c-a627cb487af5", "comment": "Malware payload (NanoCore)", "value": "ace96cf7ef24eeac993b4da172a5a8f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259182, "uuid": "caea2ff6-9561-46cc-ae70-d5603647a564", "comment": "Malware payload (NanoCore)", "value": "d4ee80500d9c280e85b290b467592a5910e9d4ee127cfda17ad40467b2c88942", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259182, "uuid": "26999684-27b5-4597-8e88-efb95241f6d9", "comment": "Malware payload (NanoCore)", "value": "fa89615f55a87ef1d9ee9330ec5b0c040f54e8c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635259182, "uuid": "7fafbeeb-8b26-4ed6-a718-04044d6684d0", "comment": "Malware payload (NanoCore)", "value": "9af49507e69c26d8db1c5648cae9165f871a9751c768c662127248b071a66d604c20fcc3fe1c5dbea4575ebd6ce42ee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259182, "uuid": "eae5e2d5-f8ab-4ba7-904d-eaa2056e42fa", "value": "T1D67412809BECB220F7ED0B7D2890042897F6E2177A66F7498F9073EA593F761C119B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259182, "uuid": "d77c9694-11d4-4477-b806-73d1c6f52892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259182, "uuid": "b96eeb48-7af2-4d6f-9e60-d824d9c33899", "value": "6144:biuHodpZO0/zxllEpjNGLTk+eRSMjf9oHpqUFNsWPAyJt4SKbxF+wkonJx:upZOu7EpjAnkR/9a9rsWPAmyScxFRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635259182, "uuid": "6bb1d629-b925-48b2-9620-a2c86c41c157", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635259182, "uuid": "34bfe503-8bd3-4ac0-98c3-24ca374dc4bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635259182, "uuid": "b2cb84ca-5271-49eb-b2f4-d7175f0d5a61", "value": "ace96cf7ef24eeac993b4da172a5a8f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e070c9c-35f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635208903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208903, "uuid": "2b375270-f90d-49ef-9e64-b7b65e6f8369", "comment": "Malware payload (Quakbot)", "value": "7547f03a9d71c1b576e61967f246228c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208903, "uuid": "78431c2d-a38f-44cb-a7f4-ddc10948bcfd", "comment": "Malware payload (Quakbot)", "value": "d59ea14883b19cd3a51c3742d5e86e474266b9fec821b0b5fbd6ec7b55eb58bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208903, "uuid": "63df5fc3-9920-4db1-a0f4-1e69b2165725", "comment": "Malware payload (Quakbot)", "value": "4ff6339c382b4bd17c2c067e4d2941997db79795", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635208903, "uuid": "3f12c127-e648-406d-b8db-cc458e46c585", "comment": "Malware payload (Quakbot)", "value": "c6a7939e100f90728850b0f3fa18f026d25eaad911bfbb1a54e7ea6fae6964679e6da6818eafcdef50ceaadb0484d65c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208903, "uuid": "6930dfd0-f188-486d-8acc-4343d0ff1d02", "value": "T10AE48D103771C436E177123889F6D4E54EAC78214FB0ECDF7284276E0AAB6D2A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208903, "uuid": "f66c09be-0d31-40fe-8564-321072d06dce", "value": "d11410e20cbdb2178b72bd1ad82d1ed5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208903, "uuid": "2977b142-bc3b-4331-b797-bd5c017bb062", "value": "12288:/RD5ZM4/o2Nmq4twYY32OOHsle0a3yAqSqhwM8PZeMMK3YNs1dxS3D0d:/ZB/XPa1Hsl2HPMMM3sEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635208903, "uuid": "22afb220-b82b-4fa0-b5a5-26ed9c36b96b", "value": 704952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635208903, "uuid": "21e5e978-2e44-40eb-b59e-4506fd6d26de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635208903, "uuid": "59f5da6a-9ebc-4df5-8072-1747d0462f87", "value": "d59ea14883b19cd3a51c3742d5e86e474266b9fec821b0b5fbd6ec7b55eb58bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7793dc-3625-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635229624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229624, "uuid": "c67129f9-92ba-4a6f-b782-b1ec9a7d7f93", "comment": "Malware payload (AgentTesla)", "value": "231cec4f63028cdcdac30caa196d45b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229624, "uuid": "5dd37c9a-019a-4445-8c1f-a35858d0d5b3", "comment": "Malware payload (AgentTesla)", "value": "d685747fcfcdf80f50b8611fa8f6d992a0d702330a117cb137d8cce80594e696", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229624, "uuid": "4adc9332-9a97-4c08-99f9-a70db9b72a61", "comment": "Malware payload (AgentTesla)", "value": "40e0a297b92c7ed3451f0e2aec37edb06018bf55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635229624, "uuid": "eeb392c3-4802-4565-91fc-4d06a27e4179", "comment": "Malware payload (AgentTesla)", "value": "312681a25036a8d4418f82ca0ae109e68faf937bb6de6b740b75e99ae7295fccc43713a633135ebcc06f9a0f0e816ec6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229624, "uuid": "2a95a6fa-5bc6-4def-b65f-bd99d6a58a33", "value": "T19FF2E14BC6611539C3BA98FC254951EA18692D4FC4A0BF5A3131B8F87E3411F03E3AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229624, "uuid": "ed0aa706-6293-4484-ac41-0e35bd918054", "value": "768:inpoHrkdP32KMgh4p35IV/+oufgh8MUpkrz8so:inOHrOPGKbh4XQ/+ouIGMUpkrYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635229624, "uuid": "dd31686c-32e1-4655-82ba-b96ad98e75a2", "value": 36303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635229624, "uuid": "34497fd5-293f-47d1-bcfb-5866ec1794c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635229624, "uuid": "492def4b-9d7a-47b0-9a20-c1c665e6b2c0", "value": "purchase order # 4459.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d216715f-3681-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635269174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635269174, "uuid": "74147e6e-e17e-413d-bcae-d6c34e226531", "comment": "Malware payload", "value": "8b86961029a4fe9d89b5c19c6aa0851f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635269174, "uuid": "4b5bb42d-5aca-4167-9ddf-782047dc82a0", "comment": "Malware payload", "value": "d70213d3b8e5b730e840218d389bd4ae096ca8632a1180eea39820622dc4fec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635269174, "uuid": "7c0da5d6-99a6-48a6-acdf-579e651c3a70", "comment": "Malware payload", "value": "07e6cb84a5f040bf2c87088b72c9123f448b6be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635269174, "uuid": "37bfad0f-eb26-4d5f-88fc-b130f0d8881f", "comment": "Malware payload", "value": "d34f919e2121e8aa2ddd2b9c1f67456a230431608763a60e26b5ca248ae08951c7d15f3e77e8df66128b8bd354a0c3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635269174, "uuid": "eda20715-b5d4-4693-b4f3-58816a96434c", "value": "T10FB4C8AA5032164BFEE34C35DD98F6B5CE87793C8E3BE5F25C62E0302968161B956313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635269174, "uuid": "e3d5d346-887f-4295-8948-80fcaee8de74", "value": "1d30df1e5b7623c4b3e7485c04815cbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635269174, "uuid": "89d07413-94fe-4a00-a350-63d5af33a71a", "value": "12288:6j7vysLMeprlBhTWrX5zq3IUTLrinpFT6KaOVN4IIlZLcxjzK5jJFjLBBlTC3weV:3TetTkrUPCV2IIvcFzO9Jf5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635269174, "uuid": "37786edb-6f1d-4a7c-a3b3-9cd3e6145cd2", "value": 497171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635269174, "uuid": "5ac76c13-ebcf-4732-8b3c-48dd61f50bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635269174, "uuid": "25684e4d-8870-402e-9cdb-07a57a535d7a", "value": "07e6cb84a5f040bf2c87088b72c9123f448b6be7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f46788d-362e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635233253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233253, "uuid": "18c4348d-5ba3-4b39-bf81-8c3b1151034c", "comment": "Malware payload (AgentTesla)", "value": "ada464721d55e6b7045a8423ad2f9766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233253, "uuid": "1861fda2-554a-4815-a8ba-66f9f2372914", "comment": "Malware payload (AgentTesla)", "value": "d729c3f46c9afb7644af2fe692b0b1de1bbe5470cda8229603b3dea97c72e268", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233253, "uuid": "e98a6339-4d34-4882-a790-efd8dcb26745", "comment": "Malware payload (AgentTesla)", "value": "71988f682844b4861f97966060073defbb1fe84b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233253, "uuid": "58e0446c-8b27-4220-bc43-18269123b70b", "comment": "Malware payload (AgentTesla)", "value": "e546d48a772edf42315cbed29c04ea26a762646d74eaf68d43b868d3b3212c91cac8a64f516d75edab54ca743a7d1a71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233253, "uuid": "df0090df-b779-4ec2-95dd-5edf99574900", "value": "T147F47CAD364073DFCA6BCD36C9541C24EBA0B4BB530BD243906315ADAA4D997EF250F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233253, "uuid": "7126948a-0537-4b54-b0dd-4096097fbfbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233253, "uuid": "6f673e2c-aa93-49a7-b2a7-0b5f0106a9af", "value": "12288:1fw/ImQxDpW27oXSS/1AkfrqjEsEI81muk7mhgjfuo0wI5LFOt9Ssdk9MKAaH4vn:1fII/W27crN3cnGkR7Ggjft2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233253, "uuid": "3315d1e0-1935-49a8-b067-67647e1d1543", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233253, "uuid": "dfe90973-54e2-4e94-8f7f-cb8c7c8403d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233253, "uuid": "3546a2c6-e320-4ccf-8749-1dfa2d26d30e", "value": "purchase order 2900517+2906627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f66ca5e-3637-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635237279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237279, "uuid": "81dcd8f2-c4fd-43bd-8daf-138077613d95", "comment": "Malware payload (SnakeKeylogger)", "value": "b128c0e3bee6f1127c3588c01ae2e7a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237279, "uuid": "0014d850-9de5-4a3e-ab15-36fe2af79027", "comment": "Malware payload (SnakeKeylogger)", "value": "d750ce4ba1f1bef45c9448f020f144fffec9da31844926d54dfee11ceb4edc57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237279, "uuid": "35e0b6cf-0bd3-4e72-be1d-5132e737f4c1", "comment": "Malware payload (SnakeKeylogger)", "value": "d318a33ecae9621ef765b78992994f64c5697ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237279, "uuid": "47e4d1d8-2d49-4d62-816d-192bfc11d7bf", "comment": "Malware payload (SnakeKeylogger)", "value": "45fd62c6d4c71797ac0fc08ed14e7c456f1713ab721802655b692a5f413bbb91a8842aa2eb1fd4259cf646b806f1baac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237279, "uuid": "6ef48e29-e54f-4b12-8199-9a4332531f54", "value": "T1AC82E80263FC833DEAFB0735A87282380B75B3A76522CB6E4E64B48F6E35B1555017B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237279, "uuid": "3b409c04-3ebc-4a23-9c94-571e1a1dfdcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237279, "uuid": "3022bc5a-cad4-4ef7-af52-cb614f31b135", "value": "384:FuSy6bIVYytiZxu/53jqscmqQ7qwXCQzNsME3W4yW:FNbOuxuhzqscmqQqwXCQzaME7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237279, "uuid": "71fec7d6-8991-4a06-a395-c463dd7405b1", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237279, "uuid": "94317ef3-f578-4a65-a8c5-b6df8c08d937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237279, "uuid": "341fe0db-81b7-4863-adfb-d2f5bc7c7a61", "value": "INVOICE 003.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f1fcc7-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251360, "uuid": "20903136-b572-4da9-8119-7e92cc8b15f3", "comment": "Malware payload", "value": "17cd8ce9aaf8660e3e61be1fbe75739b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251360, "uuid": "b7ff3da7-6f25-4b07-86c9-54058d343ff9", "comment": "Malware payload", "value": "d885752fe577498943066682b6a67007ba2307c0a1c1b70d4cb7c46e8f37f1af", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251360, "uuid": "c02b1286-d6fb-4690-8835-af4c70bd5414", "comment": "Malware payload", "value": "82a3e208429e161597ac18fc1571297cf64bd57b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251360, "uuid": "f6607cfe-2352-45f3-b141-47879a539b5d", "comment": "Malware payload", "value": "6268eda2bbae0ac779e863ae74078c03438a7495854333cfadef7a717a8899a480b8c86da7b6a6a6f6cbb69e5e28b8e5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251360, "uuid": "ec4afb72-1a0a-42dd-94f0-3101e20d5a88", "value": "T1D8C58E22F2D28937D1732B389D5BA768993ABE102E38654B3BE43D4C5F352813D192D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251360, "uuid": "2242ee29-b0ef-4b87-ab4d-85c5197a47a7", "value": "24576:bSDe5GYMINf3OhfiW5Ah3tOhyPfizT/c4yQDTHvAUKV1nIC4/BGjuecM2GwTES5v:bSGGY7AoAhyPfKbDTH4DHXqYTPQm3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251360, "uuid": "32d5a443-c93e-42f9-aa65-5442d351d06c", "value": 2501120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251360, "uuid": "8e4d9074-9840-421d-a204-23ba5384d262", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251360, "uuid": "a6150fec-4b1d-4e23-9ccf-02a587ed68fb", "value": "FacturaFecha2510EndesaCarrefour.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a8143b-3648-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635244514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244514, "uuid": "bbfb613e-3240-48d4-ab85-77727f09242b", "comment": "Malware payload (Loki)", "value": "ed1ca0ba73aae6b17e04277fa1376557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244514, "uuid": "4ded86c1-3de2-4136-a42c-9a42a73c37bd", "comment": "Malware payload (Loki)", "value": "da09c47e1d0f26a9c152b7b0e2d62c1e3729fba9828fe84515c3d2493a400a19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244514, "uuid": "63da874c-e225-4382-9ebe-13f7f050b8bc", "comment": "Malware payload (Loki)", "value": "025891c10e234f1a3defd2218fd3dc1dd5fb8b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244514, "uuid": "f956354d-e506-45fd-a273-293897b10009", "comment": "Malware payload (Loki)", "value": "86f45be5245c8807610bf02847363ae09769e715c99cf0935b46c7e9f358373b3b9f625936cfbbe7e2c9eb49ccbfd740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244514, "uuid": "786871d7-381c-43a1-bec5-dd7f88678daa", "value": "T15564025807BD9662ECB81B7A90950859277660803033FBCB7F1470F6ED6B743AD03A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244514, "uuid": "f968cd76-9a83-428c-9501-84fc0185d773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244514, "uuid": "5c24057d-eb8b-4d61-a609-7ffb761d8360", "value": "6144:kNszobvN+xLc/zU2Q0OIM79nO4UGqetz:ibvN+y/wTZV8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635244514, "uuid": "fa60e8dc-931f-4f22-9bfa-dee58b4e05af", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635244514, "uuid": "b73916e1-7b86-4327-9348-ad0ca99f8a66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244514, "uuid": "06a9a08a-b31e-4720-96ea-de0b6e961c6a", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bd4a76-3613-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635221823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221823, "uuid": "7e7876a0-623c-4f41-ba82-502a8026bf12", "comment": "Malware payload (AgentTesla)", "value": "42ca495d2da951c33eb97eb1b5dca02c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221823, "uuid": "62f83af5-d5de-4796-a84d-a9c11ea3ae71", "comment": "Malware payload (AgentTesla)", "value": "daa3b0d4f7fe78a4525edd94a77767330b6a37c23ae0a576ce5b53e7fb21717c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221823, "uuid": "b4bcd782-721b-4e1f-86df-bd58a1b58761", "comment": "Malware payload (AgentTesla)", "value": "bb76ea2952bc8706df0f7ef51e336adce40500f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635221823, "uuid": "e8caa8f5-a223-4fc4-9968-e1d133ea1d04", "comment": "Malware payload (AgentTesla)", "value": "7da428ab5edb98afec5bcec81995acbdcdbb9c22817aeca743e46e4030204583f085bf3c2481fe38c75f8c45a4fb8cbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221823, "uuid": "6c9ce514-eacd-40ad-abb9-43cbfad32695", "value": "T1CB8412089FFD5335EAFA47FD617640185BBC80003A21EFED6E5E20DCAD7671690066AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221823, "uuid": "9564106c-b0dd-4346-a48f-339f005d8e1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221823, "uuid": "632ad343-b8d3-4450-a424-da32c0f31d42", "value": "6144:TDS5iZAcdNxEYi4qNezGGgeWP8tRqujAeRSzzgK4vd+MkK/2uGDvtK7A:7AcliFc4e/PAeRSzzgK4vd+MH/2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635221823, "uuid": "e9b6a9b6-3794-4344-8f68-39c2d1fbb339", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635221823, "uuid": "8ede0860-7ff3-42ad-bf98-a20bcfb36ace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635221823, "uuid": "7e55843b-3760-407c-9c5b-b46410486f6f", "value": "New_Order_PO#960780_MT_Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd42dbc-3639-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635238293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238293, "uuid": "81dba559-213a-4101-a83b-06a24179a5ea", "comment": "Malware payload (Smoke Loader)", "value": "42353c5ebf60b068a96af0411096283b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238293, "uuid": "900f5884-6564-4407-adc3-4dbc93c772a9", "comment": "Malware payload (Smoke Loader)", "value": "dcbce5bc929785a63efb6d9180a479c33fcf882e39b4d0f0b581713b193f38cf", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238293, "uuid": "d748fd5c-d911-4261-8462-447a17c2611f", "comment": "Malware payload (Smoke Loader)", "value": "1edf10e7269cb14659d3a13c94f433b8b8c6a1da", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238293, "uuid": "7c1653e0-73ff-430d-b07e-7c948554d892", "comment": "Malware payload (Smoke Loader)", "value": "3ea54bbfcf62898d5eabe70f3c419357ef57d24a3934e55d95fc63582edfd3d72a05047623302855b068c6e1682cc1e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238293, "uuid": "555f33e1-e4a5-45cd-9884-f2514f660a54", "value": "T162747D10ABA0D039F5B311F44AB99368B53E7EA15B2454CFA3D42AED5B356E0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238293, "uuid": "2c80c5d6-88d5-4fda-ac25-c7ec95ff0ccd", "value": "b7fe04bbab1899d3b5577e802d0eadc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238293, "uuid": "683516a1-4e56-4b4e-8db1-e328522e36b2", "value": "6144:Av6qO1Qphpufao4YBIksxSTwu0FY/WX80zocddcN36dZEFe7rxxm9aE:AiqO10sfzPIksU30WOXZzocddcN36QFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238293, "uuid": "c76ac377-e685-499e-987e-3c0e2cbf1a03", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238293, "uuid": "110ca6ba-09d1-496d-b214-3248ea4db4de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238293, "uuid": "9be13abe-afe9-437a-9d01-f13ce110d56b", "value": "42353c5ebf60b068a96af0411096283b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a773592-36b4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635290770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290770, "uuid": "859b2bed-6fdd-41bc-b91f-1c05a1c9102a", "comment": "Malware payload (Formbook)", "value": "7bf1a9ce32851c40625730a89f1b32a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290770, "uuid": "7b3bf450-5b1a-476d-b726-305eb7aa3dee", "comment": "Malware payload (Formbook)", "value": "ddeebc8cccc58e25ce1709b0e9a519b2bd46472e928606bc4b0eee2553303203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290770, "uuid": "56422659-c88e-469b-b589-115433a5bbd0", "comment": "Malware payload (Formbook)", "value": "b1056e092c871bab1095882d873e01fe5650f32c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635290770, "uuid": "8278c26b-beeb-4de6-b366-3015f8862998", "comment": "Malware payload (Formbook)", "value": "2ce2ef959ef49e80b781ea9ec48a84daf9b1d6c72986e6fb8caf1b3042e5947b2113094d21c9c93f9e87e66e727563e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290770, "uuid": "02df9061-5b11-43bf-ac0f-c6a94054c226", "value": "T16DF5338C31A4EAF5F7E21F7A315848ED26B491D4B63637D41E743648F882790B4C6B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290770, "uuid": "367e51f0-721c-4707-a38a-ba6630c1bfb8", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290770, "uuid": "56e11a1d-ba4c-47cb-a514-c92d46bee51b", "value": "98304:y4nWezC8Al3QB5lDD7NKsOLUjSB1ORb8CGE6C8aFoYJB:yhcki/cfgj+ORb8Cf8i9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635290770, "uuid": "d77584af-0981-4c7d-a7b2-02e0485e72c4", "value": 3485531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635290770, "uuid": "e0a22caf-416e-45e4-b213-d9fb83c9b860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635290770, "uuid": "f8746242-47f4-448b-bb7d-9480e87fb304", "value": "DDEEBC8CCCC58E25CE1709B0E9A519B2BD46472E92860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c309c9-368b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635273534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635273534, "uuid": "fd8975d3-7825-40fb-99e1-1dc5efd4b0a3", "comment": "Malware payload", "value": "c93333fe99d1632e1ce1640a4fb45668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635273534, "uuid": "d0589534-7cc5-4b4d-b826-76c0808cd1e3", "comment": "Malware payload", "value": "de163f60abdb7811f8d46a847e81340bcd1458a7f6a9477cf8b8c7c0381efeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635273534, "uuid": "80435a00-545d-4a72-858d-ef7f74f70862", "comment": "Malware payload", "value": "6646fca7bb968fd2ec3fbc5e02b268c8b99ce024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635273534, "uuid": "c6c97324-b0a7-47de-b36b-c8b1347d5e3b", "comment": "Malware payload", "value": "0b3379bcdb366b57c09ef51ca3ad0529c9a79d24817e28682085b9aebc7860a05ee781870ee3270385f743b440ad2dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635273534, "uuid": "a318749c-8a4c-4e66-9c15-5bc0802007c3", "value": "T139153CC6F1B3608ED7A3B0780F0515854A471D7A6B519AF5AF35AA6B21F37A1CAC3303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635273534, "uuid": "e033cd82-775e-4b10-857d-ee3d6fad0cbb", "value": "835da68f7e7e29ef9a08f899d20e0925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635273534, "uuid": "d5a56bae-3323-4d2f-9d85-de78323afb33", "value": "24576:RXjjTA8p86u3oOPd1Q8FlIZzKZBXC98Gc98jv:RzjTA1bZw9dbjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635273534, "uuid": "76c0ded2-5a5f-4d07-893f-e78db961ff1f", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635273534, "uuid": "c9f68d37-2fe4-40c1-bcc6-654e93e8e058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635273534, "uuid": "739284b2-087c-4865-8407-4860eadaaec0", "value": "LauncherHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8b44fd-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635263153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263153, "uuid": "08639582-9da9-451f-8f3b-87a242555c8a", "comment": "Malware payload (AgentTesla)", "value": "03bbdcead22e9329a234dc39f55f0a2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263153, "uuid": "a3e748f4-4e70-4e7f-84ef-45e07879fee3", "comment": "Malware payload (AgentTesla)", "value": "deef43f7490a5db9f8f9b688d8bc669ecc360d068e3b40e39de124f85068db2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263153, "uuid": "07424f55-2fc3-4b70-ba05-d9155a2cecb5", "comment": "Malware payload (AgentTesla)", "value": "465b5a304541a673ce583bc20d2dc4746ccec421", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635263153, "uuid": "371549e8-f75b-4c54-a680-84afe550e342", "comment": "Malware payload (AgentTesla)", "value": "881907f7aa510ee6f8049e1a54b6ac87ea09d395cf6d44c64a6e4bb918f97dd9233b080ae7c55b535b7070993ca8f509", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263153, "uuid": "7e6f3aba-e7d8-4111-8db8-0e8c6a4387fa", "value": "T11FD17C04BD5B2A99C736827CC14608321C4AE1525D45F38DBC8A7BA1A9F27D4967782F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263153, "uuid": "27dd5a78-1a9d-44e5-a211-7ec27bd04c45", "value": "96:x7XwkNP1maLc8lLzMrHHM1mJHde9mmbQFxbMGB5xBAmUxWAFBr5+u:x7XHPhjMrHo4dmkFMGB5HAmUxWAFBr5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635263153, "uuid": "bba68c29-34f5-472c-b549-81c50ccb6989", "value": 6214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635263153, "uuid": "e02dbd6b-8ea1-4b66-8de1-eefd3ce7069b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635263153, "uuid": "ac786af8-e85a-4e92-8ca4-f56a763436c3", "value": "13.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1633c8-3673-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635262881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262881, "uuid": "3259e11f-045f-42fb-9497-9724ecc321ca", "comment": "Malware payload (RaccoonStealer)", "value": "169f798cf5f0ae7ae21e0b4716b33d0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262881, "uuid": "3f8f2c82-a4dd-4a37-a580-5427a5abc55b", "comment": "Malware payload (RaccoonStealer)", "value": "e079da0f750cdb631d242e0c473e2b3b9384256ad256d7aef51e34b29555c8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262881, "uuid": "2ef10ca4-d30f-49ce-ae62-137e896ca70a", "comment": "Malware payload (RaccoonStealer)", "value": "a3ba41b4439e2cdece93d87f0a62cbef810e7a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262881, "uuid": "ff4554e6-e431-4009-90a3-1b2ccdd8acbf", "comment": "Malware payload (RaccoonStealer)", "value": "098d73f43a3b0ddd6e4454b7265b18126584a62ea2e6c8c89095f2ae29ed8ce4c7ac9bf5a4aec2565ed2c7a602a6d076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262881, "uuid": "9c8bfd2c-8ff4-49c7-8c83-e49e8403b0d5", "value": "T191A4011176A1E033C5B28A308D65D6916A3DBDD2D93E815FE7C73A3F2E702F05A26349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262881, "uuid": "a1477897-1bb7-4027-afd2-425f63980bd9", "value": "0f5ea2bfadfc0cb42c0db57501b4ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262881, "uuid": "bb402700-7ae9-4056-a7eb-707b5134e5b8", "value": "6144:jj2fNdyW1s+BO2jp39Ps2vvGwKNt9M/wAcHPwKFJAuvM/HRbPdzidb4wmmynVP:C/yWZ1jp3hsMOnN3SufroxbPF0nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262881, "uuid": "2233709b-1131-4f71-8f37-cf46b92b9a92", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262881, "uuid": "f6e3b273-ad05-442f-86d5-04a7c7e3cb02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262881, "uuid": "215d074a-b98e-487e-b987-caaa60480fa3", "value": "169f798cf5f0ae7ae21e0b4716b33d0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c5c024-3628-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635230985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230985, "uuid": "e650b6e7-8e7b-4a2f-b58b-9de7fdcea3f5", "comment": "Malware payload", "value": "5e4bd71725fff39ac8a6bcc472d64c0e", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230985, "uuid": "d7d2935b-a6c7-4a56-80d6-c3c885e2ae4b", "comment": "Malware payload", "value": "e22c8e63a85b05a5902a9eb7e8934c48ffa09fd4dac5365da68189771d4296b3", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230985, "uuid": "24b06a05-92f6-408d-848d-4523120a6345", "comment": "Malware payload", "value": "a79fd023e4c92fb5b2c3273e6a871f9f164c2d23", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230985, "uuid": "564b7e2a-4b56-4802-8d01-01ed005d0798", "comment": "Malware payload", "value": "668ee499653c6398502e44ad6a62ad72d6c6b7da98dd003ac65bb23da7c2f51e149985cc28cf452eff6fc7f752dde989", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230985, "uuid": "3c70b365-91a0-45fd-a474-86afeb3d1c91", "value": "T191E4233894843DAB033149563B2FC32B0E44F0BCF44551592A7BEA50BEDA98117EAEF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230985, "uuid": "5347386d-3eb0-4eea-950a-99288eab01fb", "value": "12288:eTFlvQWEBGWYzP+5ovjF3jtkTvyXaf8dF1ICCLqGe5zKs0QrE:gvJEBGHzP+5o5mTm48dFSlqT5msHrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230985, "uuid": "bc70a675-a922-400f-ad5a-2cabab466dcf", "value": 663476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230985, "uuid": "6a9e3522-1e20-4e1b-94bf-de032ee774c4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230985, "uuid": "c6f63dea-b817-4fea-9c9f-062c33ddb800", "value": "Payment Advice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2707539-3639-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635238251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238251, "uuid": "869bc947-af5a-4c59-994b-e4afb01752e4", "comment": "Malware payload", "value": "57b657a084673c12fc782431eeab9966", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238251, "uuid": "40ea14be-0fd3-40b5-8ea4-5a6ed75f7420", "comment": "Malware payload", "value": "e29b02a0876a0976ef5899b6aa9f0a6b51e84e6aa76763e7f44cb13ea75c3782", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238251, "uuid": "317f7c4b-9925-40d2-ae33-8b6e4986f498", "comment": "Malware payload", "value": "d836466344428a4acf23f988e394be1de7807499", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238251, "uuid": "33b5baa1-fc40-4de7-b1c0-93e8f0481b57", "comment": "Malware payload", "value": "20d4c0609a8413f9a380a6c5cb14a74e027af4dcd9fbc5e0c2ab99d5e1db15d00d470371633ce1f55557ad934bc4ce74", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238251, "uuid": "66933c86-92df-4d88-9e31-2e6401760c90", "value": "T19CB59A31B5357A87C2660570166FBE0A431C7D47B3DA1F58854ECBFC2CAA8F4A309E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238251, "uuid": "48a61213-8650-4bd1-9c77-b49d40820a23", "value": "1536:KxxxnavIR/f34HkrepdpFpOpmpAp7pFpepAp+pypipApupWpNpfpspppepAp+pyz:Kxxx9xxxzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238251, "uuid": "36cf8f7e-e649-4733-8fa1-96b40a11331d", "value": 2345244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238251, "uuid": "c95e2294-eeff-4654-959c-a588365f16ce", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238251, "uuid": "700ac75d-b001-4666-bccc-9fbaaa26829a", "value": "SMC Req Offer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595ac726-362f-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1635233753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233753, "uuid": "4904c590-d703-4fa5-a0c3-427877a72a87", "comment": "Malware payload (njrat)", "value": "a872f0414e0834acab687a8beb9b3a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233753, "uuid": "732950ef-4129-4598-b805-07bcab3970ac", "comment": "Malware payload (njrat)", "value": "e5a4e8eda9d21d29b21f4d665823cdcbf9fb7004c8a4e6f74df126249b46c67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233753, "uuid": "d9ab775a-e4f8-455f-a3bd-f0b9e4854f92", "comment": "Malware payload (njrat)", "value": "3c5e60d56a0fe1378453e38ee4be9a589f3f6f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635233753, "uuid": "5692a4b3-5a4c-486f-a736-a1b45265e9ab", "comment": "Malware payload (njrat)", "value": "cab98d3b04474b146233766b38da3ba05a06a3d25e88d14c5dc2fff3145a75cc8a4df271cf6601450716ef780958875c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233753, "uuid": "c3f976db-adab-46d7-b6cd-1745f222d212", "value": "T15D13D78DB794E174D5FF8BF1B4A2B2890B71A01BA802930F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233753, "uuid": "c72f2954-7107-4270-8ba3-c307fda1bd1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233753, "uuid": "62f93144-af60-472b-9c1d-f05ec1afdeea", "value": "384:AZyrisNU1SoycwJGjlJWhYY2Y+wEHvJI8Grz0Iij+ZsNO3PlpJKkkjh/TzF7pWnC:m6qglcwJcHPnxIvuXQ/oI2+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635233753, "uuid": "24981360-be6a-4a62-8e23-929b29a66439", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635233753, "uuid": "a2ded02a-a162-48f4-944e-07dda351eac9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635233753, "uuid": "4cc3adf5-5472-4f1a-a3be-925167aa37a5", "value": "a872f0414e0834acab687a8beb9b3a6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1badbd6-3627-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635230438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230438, "uuid": "a80b5011-c368-4675-adf5-b0c4c83270fb", "comment": "Malware payload (AgentTesla)", "value": "7c62839323f6ecabba2f48447f6156d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230438, "uuid": "c8f24f98-7cd9-454c-9666-2083e587cf20", "comment": "Malware payload (AgentTesla)", "value": "e6306620e2adc8f1156897260b7d7b0a52b21990ac0ce957adfdc4a8b37eb133", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230438, "uuid": "02bb9492-d0ae-4b1f-87a7-8bdca2ae6640", "comment": "Malware payload (AgentTesla)", "value": "1ceec6e1c508c9708674d89a5fb571b1b1150a96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635230438, "uuid": "c2f59a1f-14cf-4fed-b8e6-6db5867d28ca", "comment": "Malware payload (AgentTesla)", "value": "b7e41caee7dd2f1c6c14dfceca2c51d7383d4800a2b8bc97ddf9b71437efb6bfeb784d94099fd1eebec92af7109731ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230438, "uuid": "7aa3f7d2-a419-493b-a0f7-e38776d0e890", "value": "T174742349F092F79EA03D0B5C4B2B6AE53C4972423888C11737C0919B5367E7BAE677C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230438, "uuid": "2e689278-04dc-4c50-a8f7-5a53bb4a779f", "value": "6144:VVpp9ZG8vc/sevS1KpF1ssUMX+nsmofLy7Df6p2tdPo6TljEBFgS1kwG8:VvZG8vc/se61KaI+nsmofwDypgh5TlYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635230438, "uuid": "059e1a4d-0bfd-4e1e-a439-898c90017aa7", "value": 365007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635230438, "uuid": "9f02fe9e-616a-4768-ba72-2d0b8c30e96c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635230438, "uuid": "e8f5b7e9-a18d-4f07-8a24-d8c0522859ea", "value": "PO #18703-A.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4752e6-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635252791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252791, "uuid": "8ebf87aa-c1d7-4628-aac6-27fb170e3849", "comment": "Malware payload (RemcosRAT)", "value": "ef19fc5cf11fa3a197553a93352dc295", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252791, "uuid": "3e1b345e-dced-4437-bf3b-975b50fadf57", "comment": "Malware payload (RemcosRAT)", "value": "e70ca541f94d8cca778993ca8ac74fdfb9dea65e7d450bc6bac9a5b350f1e9f4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252791, "uuid": "7eea1853-a285-4a42-baac-bc11a196b589", "comment": "Malware payload (RemcosRAT)", "value": "ff157eaf2258413ed84e6f379d1a00a61c0bc4e9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252791, "uuid": "0246af34-6170-4eca-a418-1bd27cae51d0", "comment": "Malware payload (RemcosRAT)", "value": "37c49a44837d3fc26721141b80e7f95d7caf38005cbd1c8ba27f07efa2b51a87548cf4edd294b4cb7ce682684c799a25", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252791, "uuid": "149d1cfc-77fe-4dc1-8adc-fb8a6d2afb4d", "value": "T173258E6165C18976E4333A35BC1F3AB95E267E102BACDC592BF0BC885E3D241782B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252791, "uuid": "b03102ea-4b66-4e81-836c-07d4adcdaae3", "value": "c408e5d23334aeef4d12e2007ba01029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252791, "uuid": "15981848-2b39-4a4c-8a3a-34f7d07d4ed3", "value": "24576:WCGsKsGgpPL50KrzgCfDGjLkEg/0EZcN+fBPLtUqU9PPj2hqp8Zs7SZxD95UCcow:WCGsL/LGZg/0EZcN+fBPLtUqU9PPj2Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252791, "uuid": "ae3138a8-fc98-4f22-969e-df2222e5be33", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252791, "uuid": "556c7ee4-17c3-4896-af00-8439716165c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252791, "uuid": "ce0189f5-4070-4a2b-9cfb-af7c80c79bfa", "value": "Recibo de documento DHL_119040 ,docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1cef75-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635252763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252763, "uuid": "5e80388c-da71-40ac-a8e8-e1c3593b36f4", "comment": "Malware payload (Formbook)", "value": "bf9559bae40a450c2d86251d929d397d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252763, "uuid": "008244f4-6d3f-4908-b927-c992c83d45a9", "comment": "Malware payload (Formbook)", "value": "e73dc3f222b20a50ba5035ec188cc24142275ab9b7e1f6388992dc00295613be", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252763, "uuid": "3fcd46a1-5272-4597-b54c-c26c6aab3c4e", "comment": "Malware payload (Formbook)", "value": "938ac10ec453af8c10decfbacad868f08fe091d5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252763, "uuid": "f2e17406-aee5-4f95-9bdf-3128bf8d6e54", "comment": "Malware payload (Formbook)", "value": "4ea3cd519a60e27f45a11d1333bc15a32ea82c6ab88d7980aeee1570f4d7c21d4fea5b279a945e93ffe13b0aaec2c45d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252763, "uuid": "6cea0f4b-9cbf-4d88-8042-fc43ebcbf976", "value": "T18DA4BE9259DC448AD82507334473AD3E206BAEB92FB295DFCF9C3B712B337C2452651A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252763, "uuid": "cdc14b39-67d8-4035-88d3-6cc622fd948e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252763, "uuid": "a3646c88-092f-4454-96dc-dfa03943b255", "value": "12288:ESRTNRgO1LUi6Vh9L10z17HPDA6odafWm7e+nFImrBK:PvUiEh9Ch7vDA5dsSbmFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252763, "uuid": "7bad5c3b-e540-4cbc-b949-6f6285ff6e80", "value": 457977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252763, "uuid": "848cb406-d1a6-490b-8f64-227d3d7c0ea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252763, "uuid": "8e44453d-7d50-43cb-844e-a671eeef3622", "value": "DHL DOC ARRIVAL#20008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9654751a-3638-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635237720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237720, "uuid": "14129cdf-0dd5-4385-8e24-b5739c404f29", "comment": "Malware payload (RedLineStealer)", "value": "bb3fda7a343c058de6e70eafbd2dbfd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237720, "uuid": "348a9056-95e3-462a-9466-a3945eeb2f86", "comment": "Malware payload (RedLineStealer)", "value": "e74283eacb55319a19b7b34b0d1ef5938f8c06ae462fb390099998084e29e55b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237720, "uuid": "ed34d964-a53d-4ace-b57c-3f43ae97aae3", "comment": "Malware payload (RedLineStealer)", "value": "3141f005ac4e1cdc58a7486cc4eabcdc4c44ef11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237720, "uuid": "9d87c9d2-7bb3-4c6d-97ba-1ac20f1f8865", "comment": "Malware payload (RedLineStealer)", "value": "27d21b2344d29f2e6d7a1c301455298c3ebe065ac1a37655aea294bc39ff251cf02bc624261c2a2bf552a81fb9a3487d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237720, "uuid": "1eb29421-f683-4cfa-94e7-82c16329eafc", "value": "T1E126236272B94055D2F6CC39893BFEF131FA13274B42687A26AA6EC664311D1F233D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237720, "uuid": "5eff97e3-4a95-4097-9131-26ce6edfc04b", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237720, "uuid": "5652e98c-bb63-4f29-acb9-1721e80aa2f0", "value": "98304:Q7RnR6nidMmVC8+DrWBTPOdID/KIYZnyCLjtPDrWGDb7F52JFf+eHtSU:MnR9pewWdj/VyCLjBPWIHaJsUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237720, "uuid": "ee2d8e2a-f81b-4d3f-8663-4159005b9fe9", "value": 4536832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237720, "uuid": "cbf68131-342b-45bb-965a-b240ef538398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237720, "uuid": "f90f89b8-e698-4843-90b9-22806ea10a90", "value": "FortniteModMenuV3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9ed841-363c-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1635239479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239479, "uuid": "048ef92d-ad02-4153-b2e8-9d64eb65104f", "comment": "Malware payload (LimeRAT)", "value": "9a5366d7cf3585ec5289f5a05eb61afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239479, "uuid": "acbfe1b6-f489-4884-bd35-238998e3ce30", "comment": "Malware payload (LimeRAT)", "value": "e86f6ed8bf23a27971680b091908e5690582db95d962776b0835810089f8ff44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239479, "uuid": "9fec67d3-420f-4de4-97d1-6e6e06782630", "comment": "Malware payload (LimeRAT)", "value": "613c8583f1629914a7350403676b12f277528867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635239479, "uuid": "33c07efd-4d39-4124-be1b-b39376dc094f", "comment": "Malware payload (LimeRAT)", "value": "23f5125a76c05bb1115d143e71e3ec5e445aeb26aef0a613ad100a9c8f5bb80c364402560ddf70e6e408a922c5612f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239479, "uuid": "5bcc2994-5b1b-402f-90b6-5de7624064be", "value": "T138A41677E543C658C53482FCC2AB738313645D51E8F6CA1E2A623198073AFD268BF667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239479, "uuid": "506c2e9f-7438-4ed2-b4d2-8565fe7a4448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239479, "uuid": "28118155-3998-4599-9d00-9e38ec7fa8b5", "value": "6144:AKfc4b4/Xz+Jec6iR3ZiD244BOcyhmZKJW7Wz0ocYnKhtJSORIF4:/fc4b4fI5JiSPBOJ8WqZocYnKrJSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635239479, "uuid": "2e134414-231c-48b2-97eb-c19c06cac0c9", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635239479, "uuid": "39c5cc8c-edd3-41ac-826a-4eb32f91239e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635239479, "uuid": "bc9861dd-ab6d-4bac-af67-9c43ebc4ba1c", "value": "PR21000938-101pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc21f00b-3645-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635243421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243421, "uuid": "7bb4b6a3-b8cb-4e3e-9e62-28db80be23b2", "comment": "Malware payload (AgentTesla)", "value": "b615a5e9f736d8ea0b9059b2626a97bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243421, "uuid": "e4cb8ec1-d63d-4311-ab87-c8c001dd38f6", "comment": "Malware payload (AgentTesla)", "value": "e8e134ada5fe4a1490659f0666bac7c63b95c051119438c43f94a09a54c75f45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243421, "uuid": "edb2795b-0a5a-4ec3-b7ea-1277fd4572ed", "comment": "Malware payload (AgentTesla)", "value": "9e8baec4860e815032adb261932cf7666a40c139", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635243421, "uuid": "4c229e4e-e499-4996-b7f4-331426e2b691", "comment": "Malware payload (AgentTesla)", "value": "bd4bbbeea3a7de63d05a4b9530fd261f829fa630ca88f2f705dd35cf90bcc01f4deb5ad7f180b58eefef819f450a46fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243421, "uuid": "dc8d4f36-a8ba-40f9-a5f1-c68968e877b5", "value": "T15074233103AD109BFC9C4C3608EB37306572FAB16955B7AF32CC66AE3E738A5C546915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243421, "uuid": "53f12807-86f8-4d3e-84ac-aea283905f9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243421, "uuid": "c30f446a-17c1-48b4-be80-0f3c17050364", "value": "6144:pRlF5OVX6KRfdzSPQ0a7xa0DLwFhhjyN+aMTaanLfdKAO/926M+guObbtgr/05YO:rl7OVX6adWPQ0szUjY+aMTaanLdKAK9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635243421, "uuid": "354ed241-6601-43c2-b13f-593ef165d2f6", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635243421, "uuid": "a92fc70a-852e-41b9-ab83-88216193bcd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635243421, "uuid": "060fa530-41d5-4ba2-b471-eb4f3cad6e13", "value": "PO300000003614645-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df9fa02-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251262, "uuid": "5203a0ef-b890-4968-b022-f9c8f77faa64", "comment": "Malware payload", "value": "6cc4bfde8996d2950aafdfbae354ae04", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251262, "uuid": "b899dcf9-f4ab-4ea8-827b-83f8275d91d7", "comment": "Malware payload", "value": "e9d4e64c6606d46de0c9dab02903cb050869eb97992165228f2f3d2ef37bb4fb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251262, "uuid": "3fb83dc8-8668-4927-a62f-31d22b3da7f2", "comment": "Malware payload", "value": "a8db6c1e79a674988b487a2fb02024a00aed2298", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251262, "uuid": "1e8acc13-3423-4f23-93c3-0f873713ead9", "comment": "Malware payload", "value": "14fcbde6955d0194ef1a9ac7ad62230c9399ff3c24d14aefd2bad9e56ac6cf0dafc272205395a70e833166b1b675a031", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251262, "uuid": "ae9f8b90-5eb6-4803-ae9e-795181e58652", "value": "T109C58E12F2928537D1732B389D5B9369993ABE502E38584B3BE43D4CAF3A6403D253D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251262, "uuid": "0f92f300-f0e5-41f0-8307-211d156ee0f2", "value": "24576:JgipoZYQlPThW5A5E9ELawXDDQbKoZQ35kFPowtETU+dEte5+YSASA:Jgf8gawXDmKp3YKTPdEA+YS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251262, "uuid": "c41f5871-d3b5-4ac1-9763-49c3b3622784", "value": 2725888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251262, "uuid": "691632b7-9899-4560-aabb-5ef739f65532", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251262, "uuid": "4071dee2-f82c-4650-a47c-d3770a5a4c83", "value": "_--mrjc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7c77fb-3642-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635242192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242192, "uuid": "b3df6ffe-d13d-4cd4-84a7-565ce93349d2", "comment": "Malware payload (Loki)", "value": "ffc90ece293d4a8d6d7d5da217ab51be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242192, "uuid": "4ace6f2f-35d3-4cfb-a01d-f142e53b98bb", "comment": "Malware payload (Loki)", "value": "eac4f37afa8f288129ae9279dd82d7c80c2e2d7fabc7c1a933de7e9c2c44c521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242192, "uuid": "6c0f5580-1097-4ae3-a5f7-2e540a8063fd", "comment": "Malware payload (Loki)", "value": "334a40485139055c97eab436fa18a03b2cad9f58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242192, "uuid": "d7a34a4a-5510-4511-b3d5-ddbb44f1a142", "comment": "Malware payload (Loki)", "value": "76154d6bbbfcc43f248a09088228541813e5942f9de5213656e41be3f6552dd0fef8f0dce1bc739696aadb8b8162746d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242192, "uuid": "0cff38ab-960f-476d-a398-b381c1397b74", "value": "T15744120C6BD8D324DAFB6F3E20415058A3BD65053951FBAB6900B1FFAD2FB01C266697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242192, "uuid": "0a10a1fa-05cc-4598-8dff-122788675f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242192, "uuid": "e7928f5e-9a3c-44b1-8c9a-35425cc2ebc9", "value": "6144:ohLwGClVkyagc1HY6NfvlEC7uwvqq1i5b8zw5:/lzEHYEECiIVY5w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242192, "uuid": "58024320-59c6-4d87-bab4-c8543e830e44", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242192, "uuid": "74d7d6f5-d694-4a8d-9b0f-a430d7bf47bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242192, "uuid": "a30b9310-c2d8-469a-a8cf-38890a085911", "value": "ffc90ece293d4a8d6d7d5da217ab51be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071d1557-363e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635240057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240057, "uuid": "0e0e35ee-20d6-4e20-b79b-e4cbc6e5d9aa", "comment": "Malware payload (Formbook)", "value": "79c6ad84e9a64439531ef1197e68587b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240057, "uuid": "2fbe6510-83eb-44c8-90bf-a5c399456e70", "comment": "Malware payload (Formbook)", "value": "eb4f57c9488afdfcae998056c4854f63c921e45d077c4a53fc6d927463ea5267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240057, "uuid": "4edb82bc-781c-4fe9-a019-0fdf2310cce7", "comment": "Malware payload (Formbook)", "value": "ce9360870150cba1c282b631d7257b5d1f740162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635240057, "uuid": "41b199ef-e744-45bf-a0ff-784675c1713d", "comment": "Malware payload (Formbook)", "value": "35215b7c752ca53880cadf80ef844a79cd6a9ce0a54b63aef20144d53b7d400879a3847bf0305d203299eb1304445ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240057, "uuid": "bfeb5a12-7858-4d65-829e-4c5dd7e373eb", "value": "T1BE44232779E018FBDC9A47BC8E7B622DEB369E041210AE4763D60F572C21ED2D2564C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240057, "uuid": "06a97513-f7bf-42d3-a957-1a7e28d81b0e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240057, "uuid": "76109f2f-092e-4c7f-98a5-6d63627d76b3", "value": "6144:2BlL/9XsksvbV2uyK6EDnOjdKLzQU3l5C8k5+dEEZvAr:U/s75VD2dKXJZdjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635240057, "uuid": "995efbdf-9324-4fe4-a9fd-b59c3542d490", "value": 264916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635240057, "uuid": "c0298933-9eb6-4dfb-a175-d6643274c353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635240057, "uuid": "02b1c375-7c5a-4556-a60b-0a0a84acc8ca", "value": "Unpaid invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef081836-365c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635253331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253331, "uuid": "cdcb724a-f57f-4377-a2a8-a80312f8d3e8", "comment": "Malware payload (AgentTesla)", "value": "40746965ba5f2ee9b0095f20725c5d92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253331, "uuid": "6922ae40-9095-48ba-a7ed-a322fdbd1e58", "comment": "Malware payload (AgentTesla)", "value": "eb79e35ccebd02f6d8f990f16ba68fe3597aa0957fcd7321a11d23034c647cd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253331, "uuid": "340e34c0-2381-4782-9e62-e61c7534b88e", "comment": "Malware payload (AgentTesla)", "value": "c62e4699be46425de7f1eaa3d58d9f8905c3f1b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253331, "uuid": "cedc9b3c-d78e-4dc9-9e26-84f6646c3624", "comment": "Malware payload (AgentTesla)", "value": "fd3dd6cf7f99eb059859124961eca594117adfb63986e702b4ed70d26af0d00060d566afdd4f9f9d5095b3f1e1a68dbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253331, "uuid": "98b4fc9c-cf3f-4838-bc85-852da972207b", "value": "T1EE8422985F38D739D1FF2BBC61713A15033892043A1AFB6D155990A53D2BB02C8B6EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253331, "uuid": "5b5861ab-9843-4d03-8b5c-0bdcc3914f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253331, "uuid": "1f330691-c059-487f-ab10-56273a36cbfb", "value": "6144:t43oSjl/kg163ONpW5LiLv44w8QLzP4F7yVHYZOwzZ6g3A0yo2knil:aB/N163ONKrPkhjOwY1I2kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253331, "uuid": "9bc5f0a8-6084-43cc-be0a-623e82fe8386", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253331, "uuid": "d3ca248c-5b4c-4a15-8832-4ec886d299a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253331, "uuid": "881c5583-7cb9-4b49-803d-ef393f11406f", "value": "PRQ-12211222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a8527e-35ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635213314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635213314, "uuid": "2181abb9-b5d5-4a82-9519-ccdc80455a46", "comment": "Malware payload (Loki)", "value": "4a5070b6c45e413d0405c3c4f5b4d9f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635213314, "uuid": "b7cd6fc2-5fac-4e2b-ab36-7a2514b59a3e", "comment": "Malware payload (Loki)", "value": "eba3acfab359f405b311cbe69952fb063cb6ec9508d0a41cf5902bcfadac9eb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635213314, "uuid": "a959e45c-30c1-4f9a-becb-fc7b0411692e", "comment": "Malware payload (Loki)", "value": "837f284f77eae10dc4e5973658d6e9013fc38d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635213314, "uuid": "80e06cd2-70f6-46ce-ab00-317bb6cb4a0f", "comment": "Malware payload (Loki)", "value": "3e82c021c2bb3b406ec9dbeb4cafa47efe5191fa96bde65732c4fc4b01f30d8d71145e7e6be7de9887dd5f3ac9ff9caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635213314, "uuid": "055c0681-5202-47f6-a967-9f2e1fcaf359", "value": "T1AA44122931C0D5A3D57AAB74DA2B9BE98275A319B260511B47F01FBBA0143C7AD0938F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635213314, "uuid": "30f820e7-b5d8-4df1-a349-24c72b31923a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635213314, "uuid": "7982bea0-3e0c-47c9-b524-ad0178520a59", "value": "6144:wBlL/cGSHstXEagxszG02CDSz90GT7KKMXLQshyg99:Cevt6Jc9/6Spgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635213314, "uuid": "502974c1-bce1-4785-9cc9-b9bfd8e7baf6", "value": 257331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635213314, "uuid": "ec569cd8-8a0c-4b2b-a14e-6985c4532e97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635213314, "uuid": "84f39f70-e5cd-4a41-bc2d-1f7d6f223390", "value": "Msptt901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aefe8bb-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635258559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258559, "uuid": "51d20dcb-c140-409f-abbb-0f5738661fbe", "comment": "Malware payload (RedLineStealer)", "value": "06157fa9508a36bf6f84d7e9adcb4bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258559, "uuid": "bba36147-b1ef-4c38-b5d3-ccdd22cf3467", "comment": "Malware payload (RedLineStealer)", "value": "ecc19b1e96b761c7b6b62c21b7882ee816388dd22d708df55f41143ac44bd9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258559, "uuid": "56c2c3fd-db03-489a-99c4-71d3dab49c4b", "comment": "Malware payload (RedLineStealer)", "value": "db0e489232805597173b6cb7a75c36f5c0ec7d4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258559, "uuid": "3cc08302-b576-40c3-a515-348ed7ba8cc9", "comment": "Malware payload (RedLineStealer)", "value": "5b4f7dc9817e2dc5d8dca255eac5afa9037cbc437c926d4d419a4e273bb9f690863fd6e6cce399e7b38832166e4d3de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258559, "uuid": "7f94dff5-443e-4ad4-8861-ee02ca1afa79", "value": "T1076473FE31D2DE10C99166338AE3B6418B6133E5C31347C8DB5887AF5E096236EC59B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258559, "uuid": "a37f71f8-c380-43da-bf02-8cd46cd292e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258559, "uuid": "66240345-bb6e-411a-98a0-db7cc9c89056", "value": "3072:VZ/khzSTcIrkW+3K8MVtTq0fjR9tTWh1anwADuzJWFOvLn0iFY5tF/Zef0vz:VZXYIrrhVtTqQRSLa1uzJWFOvI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258559, "uuid": "a0371328-6bd0-4ecd-b833-7b3c5332e899", "value": 320416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258559, "uuid": "7726a299-e3cc-40ee-84bf-6bfb6943fbad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258559, "uuid": "985a31e6-69a2-4eed-bc93-e68a60193838", "value": "06157fa9508a36bf6f84d7e9adcb4bc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08497dc8-3659-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635251656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251656, "uuid": "16854c1c-908b-44e0-90ba-1b2500d4670f", "comment": "Malware payload (Formbook)", "value": "dec13802e723232db458c1c996a9cf85", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251656, "uuid": "f8b007da-357d-49c9-9a1e-c35a98778fa8", "comment": "Malware payload (Formbook)", "value": "edfa14bac59d32b6e20f48367d76f5488b74a1ca6c27fd720a5c937efef624ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251656, "uuid": "1a109668-aa03-4794-be64-1db3bf1f7782", "comment": "Malware payload (Formbook)", "value": "69d3cfb96bb059311888add6aa17b1576a8b7392", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251656, "uuid": "2884e6c2-8b20-4812-bac3-c1626bd75fae", "comment": "Malware payload (Formbook)", "value": "27790f038b598ebad57afb15cd20b57513c3610b205a61fa5a59264da12fd92e3dc41a91b7e02ea8492e05ba802d8ba0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251656, "uuid": "2fae6531-5463-44a4-abd3-5f9fdda0a78c", "value": "T1CB74D1CED342AF83FD42193D8806AAAE1C77ACB105137195B6F2B10D9DB6F51348E49B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251656, "uuid": "cc26e9a3-d6ea-4a81-bc8b-ba534aba04bc", "value": "6144:mS3Ma5/sLgEWa1NC5d2HVpWmXbGEbE8+lNVYENEQee6osJfLf:TV5AWlUcmawE1YnQeenkfLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251656, "uuid": "19fa37f2-634b-4317-83bf-ec80bb211489", "value": 366872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251656, "uuid": "1a0b2687-b4d4-48f5-b3d2-198d6d9f7956", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251656, "uuid": "ec147025-a67b-469a-83de-9f31d7882053", "value": "CONTRACT 18641.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72f2471-362c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635232648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232648, "uuid": "aa26eb28-05a2-412c-bbca-f667bb21de55", "comment": "Malware payload", "value": "694f4dc9b93b11c4438b117c838f04e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232648, "uuid": "925e0f61-ec53-4ce8-b53e-c04cfdaf9b36", "comment": "Malware payload", "value": "efd5fe28ac30904f4e75f53b07be50dc7d53c6b12f266c0717dbff7bf5fc63b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232648, "uuid": "e34c2590-c094-4faf-8ca4-f1b1c8f416b2", "comment": "Malware payload", "value": "dbdb095b767f5ddba55c9cfa696f43b0e0092da4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232648, "uuid": "96e01ad5-4116-4f72-9007-d4bd73ae4958", "comment": "Malware payload", "value": "91038fdd84913cd4700fa4dffdfa06044d7dd8e3c42c3e486b6fa4983a21ec5ac6ac0aad4a4ba742d6ff8b6658fcb577", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232648, "uuid": "2e58f3c8-c0b5-455d-b3b9-abd25e8f273b", "value": "T161628111B3A2C667D0590E324DE5E6DB3739BC52AE54C30B3284B72F3CB9A90CD12356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232648, "uuid": "2245306c-2405-430b-9455-bd3591c91f2b", "value": "192:tSjbYfETEVTtYagafqH6V7Hv0y4wG3as5NBiNJg:sjbxENaagafqaVjYwG3as5Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232648, "uuid": "32ef1dd2-3c79-477e-8b06-d480f8cdc0b3", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232648, "uuid": "c7583787-fa58-40b4-aca0-7fff529db3b6", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232648, "uuid": "0f862d5b-5a45-4e9b-9a5e-1fcc742f02b5", "value": "SecuriteInfo.com.Heur.3081.24950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa07da1-3629-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635231124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231124, "uuid": "fdc9304e-b907-4523-9674-ab0414f9ed94", "comment": "Malware payload (Loki)", "value": "0b77ac4eb7dea205b07c003760f1b49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231124, "uuid": "9d3a8fad-3c45-41a2-91f1-df7636de3197", "comment": "Malware payload (Loki)", "value": "f2881be41dccd003e05434a9968ac448e6181a5b386eaef0d705ba41ff22ac84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231124, "uuid": "afb844af-0ce1-4356-8fa2-8abfc27714b6", "comment": "Malware payload (Loki)", "value": "95edd361ceae4e418df2c98380655b0ea4f14b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635231124, "uuid": "4e9537e0-b8f3-41a0-8e69-4cb8975854f2", "comment": "Malware payload (Loki)", "value": "df89feaa4c7c82f16078eb3c02ece188ef23ba48b019b7bf84170088037faeee458588e7e8effaa1b90b70df8f2d685f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231124, "uuid": "e627a3a2-68ed-4123-8909-23262d65e654", "value": "T1A8346FC5E98456A0DD59AB71AA37CD3582237EFDA874942C28DE3E273FFB2931025053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231124, "uuid": "42ac769b-b3dc-4e9d-a437-ce8538184116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231124, "uuid": "c8c285db-2168-41bb-853c-e1ae29f71a08", "value": "6144:RNFlAkzL7r9r/EDppppppppppppppppppppppppppppp0G:R/P7r9r/+ppppppppppppppppppppppJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635231124, "uuid": "2dd0b87a-2a3a-4f1d-a395-a23bbb01f2c7", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635231124, "uuid": "01f68d21-07e8-4503-a1a7-8d6bf74e9ac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635231124, "uuid": "9445bdfb-f2a6-4957-bf1a-9982c009ce05", "value": "IMG20039010262021_Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d5ae13-36a8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635285949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285949, "uuid": "5f751c8e-eac3-484d-97fe-513496b1fed0", "comment": "Malware payload (RedLineStealer)", "value": "5242345c42ee4ceaa8fae3d2c439f224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285949, "uuid": "d4e969e3-196d-42f7-87ce-0dc9d346685e", "comment": "Malware payload (RedLineStealer)", "value": "f29a3cecd0efa7f1f0c45c8572048c942090dcebdd968b9fcf4cce4380c01824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285949, "uuid": "74a8a62d-3dcb-4acd-b3f9-10d19cb64a3b", "comment": "Malware payload (RedLineStealer)", "value": "b218a9d8ef616d3ca0aa82057d27d06fa20c0fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635285949, "uuid": "325e4ca8-7079-4eb3-b768-339acfb2d1cc", "comment": "Malware payload (RedLineStealer)", "value": "9669383aafa5c1ff040973d0ee2f99ab046317b2620e83fd0e55a4404513f2617467912382a9da308675f7a4735e1a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285949, "uuid": "ad4eabdb-088d-40db-ad90-7c99a8e04403", "value": "T104163376EC04C12FE84FCEB3A6776F762DA19E5778895B0BFB10060E94711B21C89726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285949, "uuid": "77c8130c-51af-4d97-b543-cd1eba5c2de1", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285949, "uuid": "49081ed2-c84e-4015-b853-d820bb1365c7", "value": "98304:yMMoEWGtKb+IyjgHecekwecyCIzfsDF4hSeBL3aSGQPAoeAbL2:yMYKBHNfcTIzkqRvPeaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635285949, "uuid": "dbc9249e-65f3-42b3-ba8a-e03d246c1a1b", "value": 4075301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635285949, "uuid": "8f823777-5576-49f8-b28c-0a9e32a6a002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635285949, "uuid": "262e8ab9-75aa-4803-93fb-40ec0cdd38ac", "value": "5242345c42ee4ceaa8fae3d2c439f224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946f07e7-3668-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635258333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258333, "uuid": "13a50b23-19c7-4f05-b539-e6bdaabddbc1", "comment": "Malware payload (Smoke Loader)", "value": "858531422892e434fa9f94268705262f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258333, "uuid": "1f9c07b4-a414-4c3f-bea5-090ba54dd284", "comment": "Malware payload (Smoke Loader)", "value": "f2bda26791d421abe90af5077a8f6bf9dbc0577607df37980e01230c98b5e285", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258333, "uuid": "85923436-6505-4850-a784-6e86f8232780", "comment": "Malware payload (Smoke Loader)", "value": "c169de55a64c2e291d40042a6bdba6dab6404c6b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258333, "uuid": "d6d0117f-9e27-4946-a8d1-f31e0c51880a", "comment": "Malware payload (Smoke Loader)", "value": "df25d5107f9f0e1a1f34e095bf5b61cfa648752bc960212a76284e69f2c9ed884321c624436b2b8b25d0bb2f0008c30d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258333, "uuid": "c52ecf26-97b2-4ff5-9414-12341f797cd4", "value": "T1BC24AE1172D0D8B1D4B605308863C6E5167EFCE3DDEC698B339B362F2E712907A22756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258333, "uuid": "619b212a-191c-471c-bba9-5d574177b566", "value": "2b7a2a2feb79758ff89fe54c66664c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258333, "uuid": "1c4aede9-c456-45cb-8dd8-f1c48fe6ec3c", "value": "3072:ImhDm6a/6BO0fFX7vWTJXBzfRqlcDkKee8ABd5DIuVMO6P2+BwvHJ3/RJ:RDs/6BOSFX7eTJzkK6ABd5UynVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258333, "uuid": "a75ac379-d609-41c8-9692-bdd5735f3ee0", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258333, "uuid": "e140a5d6-640c-4193-a312-f9ebc3b7f46b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258333, "uuid": "9cfa16e4-fc7f-4565-9d8e-c0347aaf2ded", "value": "858531422892e434fa9f94268705262f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d12b994-3669-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635258723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258723, "uuid": "e5cf1f1d-11c7-417a-93a5-cd8d1221ee19", "comment": "Malware payload (DanaBot)", "value": "cfda3b14ae9f8db65a2731e219345f6e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258723, "uuid": "11665790-3c1e-4fd1-9b3f-d2dd7d8cb62d", "comment": "Malware payload (DanaBot)", "value": "f2bf6609d433e579a2bd41c64ba27576f3e82993dc1287a778f7f790814e2a18", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258723, "uuid": "ce117937-8b83-4d9d-aaa1-24b680cc590e", "comment": "Malware payload (DanaBot)", "value": "a35d0f874e7e85919b99259112c95b99d090155e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635258723, "uuid": "a0156c3e-38df-4b47-84db-5c76703a1698", "comment": "Malware payload (DanaBot)", "value": "c432cacc73b6a0c0343588f35eb3f8d946da5776997068677d57d0cd87bdf99796f5bb60047810640b089597f1bebc84", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258723, "uuid": "5d1db143-21ab-4052-9cde-45a9cf9e5b5e", "value": "T149557E22B2C8F53ED4E60B3A4967A784543F7731A6959C2F57E048CCCE2A2C01A7576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258723, "uuid": "d5ad6c0a-ef9b-47dc-965b-73a3197085c0", "value": "f9e81afd2870aaecd8ace36b2893b1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258723, "uuid": "00a4d934-b391-42be-b173-935c07fec94a", "value": "24576:5cF20gsLR+/OMF3PEss8MMWGTDX25sToTsQd:6T1Gv932T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635258723, "uuid": "73d0ed43-71a0-46a3-8425-022ed04b76a4", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635258723, "uuid": "e416b401-39e4-43cc-86dc-7fa1def980b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635258723, "uuid": "8359a8a4-4409-4b61-ad4e-7f75c1c0467e", "value": "cfda3b14ae9f8db65a2731e219345f6e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1111cf9d-36a2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635283024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283024, "uuid": "7ead116b-ff87-4782-aad6-fa3638af6b99", "comment": "Malware payload", "value": "dfbffb0059e6ef405d04734f9706ab73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283024, "uuid": "5851c1da-f1f4-4725-bc77-5f8e5a4558e7", "comment": "Malware payload", "value": "f38e481c382fadd2a4a0b30342c90f9d3b1945511089d8a94628a3a921a53060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283024, "uuid": "e80bcdcf-4d88-4dab-8926-139afa10ffbf", "comment": "Malware payload", "value": "ec6628c910d0d152cac4c3e421ce0181cf62ebf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635283024, "uuid": "6d09ad53-d2a3-4fef-8eff-407ce3ecbce4", "comment": "Malware payload", "value": "ad954194d25f0f6089993be33efebad29f116ac771d561c07547f57c328908ece3ae9e0b06243db078eabe7878d3ec4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283024, "uuid": "78e526d2-d839-4a85-bfce-e26339273224", "value": "T175F3082117E84A19F0BFAB7655B141001FF6F4C29727C72DA890649E0EA67C28F7B367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283024, "uuid": "76a29bab-4358-4bbb-bab4-d855dd598197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283024, "uuid": "650ed9fc-1563-43cd-a1ad-968eb2467df0", "value": "3072:0/mywJnjUU2oWFkefMzTjSMzTjoIe1UhA/:0O/jU1oIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635283024, "uuid": "09616054-4d8a-4acf-a977-3e7336234f73", "value": 166840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635283024, "uuid": "5d76e5c7-9b32-4581-bb64-04d27f9fd1c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635283024, "uuid": "f40ff0a2-75f6-48e1-8802-e4386c4f4052", "value": "payment.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab16caf-367b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635266477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266477, "uuid": "f4bb250b-2fde-4b91-9c37-5f434ba36e49", "comment": "Malware payload (NanoCore)", "value": "0475ed517da8a71bc4a87f14a44cf8fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266477, "uuid": "a0aee0fb-fd08-45fc-988d-8a7b4a0694d9", "comment": "Malware payload (NanoCore)", "value": "f475dda218513a22edc7ec2e734fb91ddf60dc7b38b87e7de487de6fe9307e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266477, "uuid": "368869ab-140f-4ce5-9ed2-f126b54b795a", "comment": "Malware payload (NanoCore)", "value": "311e146bcc1a342ab135240e0c8e31730f8ad879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635266477, "uuid": "43af7ee2-77a9-4c0a-be6e-063e3aa721a5", "comment": "Malware payload (NanoCore)", "value": "b63351812757e29ac446f2c3cddc00ae96285d6f7d6210ccd76a80dee7c85a5110b07c16443c3316e7f562c659de7c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266477, "uuid": "c4ba3374-a393-49e4-ac45-3c4223073f87", "value": "T12442D6A163788775C5BD0F7B7876739003F9A64389E2EA39148DD08BB8726050BE1B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266477, "uuid": "5beca529-6974-4996-b024-b216a10f1d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266477, "uuid": "474364ca-ae23-49b5-acd8-b55dadb320be", "value": "192:1xOLat6Hg6ZVHKhS2FtX20G1uDUcmuU/Vbw95si8:18LaJIHKE2FtXvGRcm3/xw/sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635266477, "uuid": "8e052de2-b359-400d-bb94-b6a53363274a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635266477, "uuid": "92b856dc-8094-457a-b6da-3e0a0eaa29e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635266477, "uuid": "fa3d7264-6c65-4247-8352-ec15a2588504", "value": "0475ed517da8a71bc4a87f14a44cf8fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88d55f6-363a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635238664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238664, "uuid": "114b18e3-975b-4eb1-a64c-604a32bec3d9", "comment": "Malware payload (Formbook)", "value": "295b9af11cde64a883299d1790239034", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238664, "uuid": "5777cf29-6784-414d-a53f-0c77a424077d", "comment": "Malware payload (Formbook)", "value": "f478d6aa621a6a35cb6c38307541f0ffbb151683a5f89dcaf497d5678bbb50e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238664, "uuid": "f5e85da3-f0e8-48bb-897d-58a02f8ffd04", "comment": "Malware payload (Formbook)", "value": "5c51f35a68ed2c0333d25aec2d456660d4b3cf65", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635238664, "uuid": "8d3f1105-109a-45e7-a7f1-176ad16a52a4", "comment": "Malware payload (Formbook)", "value": "4d7193186f7627ad989b53c6d178703cb70dddd6c3eb031539124a0c14b1ee5e3a67f2637211e5ff8b9314972b81529e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238664, "uuid": "5c33b186-d1d8-431b-9e1e-84d9d2434a95", "value": "T1A8A4E11B6EE407B7CB8A75398F48A97C08D64F4E2F345085E423312B4FF5BC96A98527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238664, "uuid": "3fb51204-41a4-4515-9da1-54f21022a13c", "value": "12288:x5MFVD60/1XqCOOJq6cWCCb6mYIE2gTnMx4MyI:HAV60tXgOJJcrCb6mYIbgA49I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635238664, "uuid": "ee08e5f8-a60c-4fa2-8b77-0e70508c8c44", "value": 457480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635238664, "uuid": "0574c767-4971-4392-9df5-bee571e9ef46", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635238664, "uuid": "3f589c8d-4bfd-4bde-8d6e-a5eb9577d243", "value": "IMS211323.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dc8c25-362d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635232937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232937, "uuid": "08179eec-b661-4b38-ab10-3bea33720288", "comment": "Malware payload (NanoCore)", "value": "fc57f298e10adcf52da5459bef2f6009", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232937, "uuid": "f5de3c21-5e08-487a-83a2-2ee30a3eccdc", "comment": "Malware payload (NanoCore)", "value": "f5047237825cb59540fbd413acf1ddb83fd6122b5675506141461033c2ea0965", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232937, "uuid": "adc5bcba-9f5c-45e3-84c9-12563adc4924", "comment": "Malware payload (NanoCore)", "value": "6a13df382cb6484b4f423411c7369afad50ebf85", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635232937, "uuid": "9ac28854-4e62-4dae-8a4f-8df391962fee", "comment": "Malware payload (NanoCore)", "value": "ead01079f4df8972eb1a285301a3bd5d5dd48ae6816f757a2ff5fe442921f74e04fc9d123ed3a241a3e0583b3d4d1752", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232937, "uuid": "32d44834-d71f-412c-98cd-6e696510a8f0", "value": "T11FE533D02284E634A50C12F2381787E663D3D74570DA63DD616AE73AE0FE6378B74786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232937, "uuid": "41a400dd-ff2c-4761-a02f-a466893cf1fa", "value": "49152:90ZcBMs/KvsjMOQB8wkXDGroUg4IsYKtwEIebNuyBeHFtkiXQg8flFwiCEYd+jXl:CukvO4YOdrxBtBICNu3TPsflbu+rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635232937, "uuid": "f94d080a-6c91-42ed-b180-1046a6af84a1", "value": 3198359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635232937, "uuid": "9167c6de-ab03-4188-9265-b0dc95df9cc5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635232937, "uuid": "bdac2b7a-2e74-44fc-bb6b-6d37cb26857b", "value": "Bank Details pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26fdda0-3640-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635241204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241204, "uuid": "d8cd818c-085f-415d-8f16-94182e05046d", "comment": "Malware payload (AgentTesla)", "value": "1b34d0ff0755da7c58678b8a12300b78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241204, "uuid": "4cf6dd5b-610f-4c16-bbcc-31b1b3e638ac", "comment": "Malware payload (AgentTesla)", "value": "f57657bfc2207026d109ecf85e3718b2e580e29c4eae3d62f4800a1fabf99495", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241204, "uuid": "74c4b6ef-0a9d-4204-a951-107b5d270777", "comment": "Malware payload (AgentTesla)", "value": "da9da903c44b7ee1fbaa0327173b29821d9df611", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241204, "uuid": "35c1feea-a3f7-4875-a6f3-8729495f3363", "comment": "Malware payload (AgentTesla)", "value": "e6b5af12029f20d22f9ed81f5e7505fd78f0d1862f25f7d3182de2481a4c5d9130a039f5358b8481baf2e31d2212bf42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241204, "uuid": "75fd37ca-6545-46a3-a092-408f9e8f45fb", "value": "T159841318BFE8F031C6B90BFF585000458739AA692650E7DE1964B2C9BD7FF42464B6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241204, "uuid": "906f8ef2-5eec-4527-a300-700394459a58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241204, "uuid": "7b5f5421-a8f2-4003-a4ef-32203f83218b", "value": "6144:uXq/KA9ZbyG83ByqnFWoA/dGPCltgdKKgXKxrl38PPNtWbPKTH7kEH+:zkx8PosdGPC/QX4P3Wc7kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635241204, "uuid": "d8f0c8e8-8c49-4fa2-93df-147153819334", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635241204, "uuid": "1445460a-66e8-471c-b83b-5572b10f4328", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241204, "uuid": "7c6aaa31-a5d5-4ffc-87ce-3d6656fcd563", "value": "PR-007493 PR-007495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4e0640-3649-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635244844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244844, "uuid": "bd063736-f60a-44d3-aa86-f918a468b2bd", "comment": "Malware payload (RedLineStealer)", "value": "3acffd27f09b4e78db882623901eea00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244844, "uuid": "f403d778-5551-4ec3-8d94-cfaf3f5b9b23", "comment": "Malware payload (RedLineStealer)", "value": "f5a160643d5d68888ca63351aa503284c14971b9d6d226e7bacf86a2b2e75dc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244844, "uuid": "b79b3b97-e593-4a2b-8298-22c01779808a", "comment": "Malware payload (RedLineStealer)", "value": "5299960321b184343b28df14cdd29205287daed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244844, "uuid": "d784b8fc-10b2-4f43-9298-21e32f3e54ed", "comment": "Malware payload (RedLineStealer)", "value": "8be9cccff7d8b8eb5a42553ccbca104328001d759712a41b6f5b3a351db3478065ef672af055c95696aa374b8631dce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244844, "uuid": "3bb0c2fd-8106-48e2-845d-eccbe1e32d6a", "value": "T15364BF10A7A0C035F1B357F88AB69378F53E7AA1AB2484CF12E516ED4634AE4ED30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244844, "uuid": "8573b003-e909-44e4-a2bb-be7baaa049e6", "value": "e48ddd3fb896f38a492982676ffb2f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244844, "uuid": "779598c6-c5ed-40f4-93c1-7e7595fcd7a9", "value": "6144:mTOI1iGRYOsQv4vye65rMq8mEj6XkW4sOQJTXDdNFmcmkaqq2hYNj:Wh1PYOtkZ2kDsOQJTXTFmTkZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635244844, "uuid": "ad40c525-eb63-4155-b069-cc5a991cfb33", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635244844, "uuid": "c6df2568-bb34-461a-83a1-89326db1b1d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244844, "uuid": "48bca8e1-ef4c-43a9-9f74-76dabc7b3b8d", "value": "f5a160643d5d68888ca63351aa503284c14971b9d6d22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a6d360-365b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635252745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252745, "uuid": "078ac985-c64c-40bd-a817-59f48f93ac1f", "comment": "Malware payload (AgentTesla)", "value": "9413abe81e45cc16409f67dae8e0fa65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252745, "uuid": "c7831316-3f0f-4d00-879a-537b8ebedde3", "comment": "Malware payload (AgentTesla)", "value": "f6069c39a20f6920e5900ceaf4ed66794b078b7ed7804a33fe169cfed9bae0ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252745, "uuid": "a02c34ff-bc13-4841-8cd2-de210f16bd7b", "comment": "Malware payload (AgentTesla)", "value": "3843419e22c2e4b0ac67953569de3ef5ec260c87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635252745, "uuid": "7ae87e5b-5088-44bd-b75c-e370b6efc3be", "comment": "Malware payload (AgentTesla)", "value": "f7b81f304f627bb3781f66d418bf917a7323b2232df266f73e424381735101946b4f692de4dc39e48bbdcd09f60b534c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252745, "uuid": "4a8eda0a-f8f7-449a-a085-a566de477dfd", "value": "T16694122D469C726BECFF47B41090145423BB162E2072C7AF3B05F9A8EE6BB478513799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252745, "uuid": "3cb380f6-6ac5-4dc6-b7d3-cb573c32c9f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252745, "uuid": "024cc3a0-82f3-4ef5-90dd-433e06602c4c", "value": "6144:SxpqIYACK+YZyEDpILHgphCedUcHRmNl7PDBHlkbO9y1oG602x8vsmx:DKfZyEDSkkSU5N9P9lkbMy1l69x8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635252745, "uuid": "71eff4df-f2bb-4652-9cbd-7ed2ac243464", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635252745, "uuid": "323427b9-0a20-4299-89ce-63f641c65507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635252745, "uuid": "969a6b12-c870-4ee7-9cdb-0aa4c84a8bb2", "value": "DHL Receipt#AWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899063f1-3680-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635268623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635268623, "uuid": "d5a53b6a-7c26-4c54-86cc-5c0ac8150211", "comment": "Malware payload (AgentTesla)", "value": "b97667898ff44c5e8d5906aa40cac91f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635268623, "uuid": "b9f6e626-98b4-4061-9b1e-a81443019d28", "comment": "Malware payload (AgentTesla)", "value": "f6e98b5e3fd4328707ab7875d77d13bc028c7b5c03b33b2e3672ced3d0b7c857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635268623, "uuid": "d4d614b8-603a-4122-9a71-84e29119aee2", "comment": "Malware payload (AgentTesla)", "value": "c9a503b682a19c1478d984a83b1729d5190b64a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635268623, "uuid": "02cce2ab-74c3-4842-8291-36e3c4c2c414", "comment": "Malware payload (AgentTesla)", "value": "2410c16ba1f2c27ef90330cf19540946cd8152c51c76e679f480074162a45b1595106d9785b875bdaecf657cf80d5fae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635268623, "uuid": "34823319-24bd-4d91-8cd9-8ac6fb4c0a29", "value": "T1DB45BEAD32A0B2DFC46BCD76C9A41C60EBA0B477530BD647A09711ACAA0D997DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635268623, "uuid": "706d499c-c2b4-4806-bb36-3c0cf1fe0cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635268623, "uuid": "c26b02a5-bae1-426b-8bb0-3efdc55df1e9", "value": "12288:JgswZZssnucg7I/SkdVmTPa6S4O7A/cX4BtQGBfIJ5mOzboQK4BTQEgXPG5LkEhO:JgsK7sWVozpLBtQWfovXhYXMkLXSc22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635268623, "uuid": "9dc5bc7e-f15e-4fc8-813a-7370820f7065", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635268623, "uuid": "2f02d9ab-349d-480a-bdc4-cd92d848bb4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635268623, "uuid": "1a38990c-f05c-4512-a706-6caa1ca93817", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053d7bf4-3643-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635242202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242202, "uuid": "2fba002b-e1e6-4db8-a5bd-813b9fb2cd5e", "comment": "Malware payload (Formbook)", "value": "2d84b38efa4ce09e9b92c7d9cdfaadfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242202, "uuid": "459d0355-da4f-4037-8d0f-47beb9e3dc1c", "comment": "Malware payload (Formbook)", "value": "f70490cd601507ae7dc51679c29788ac1a4b75d1fbea50022bcf43a98791287e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242202, "uuid": "052c5fb6-ea6a-4b27-a389-1bf6a58b26e1", "comment": "Malware payload (Formbook)", "value": "c25d0f34735fbc7e6839cc5159d2280bb6c5715c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242202, "uuid": "c7aecc18-833b-4b6a-8bc6-4aca2dbbfa77", "comment": "Malware payload (Formbook)", "value": "c2dd95fcc8a7199955eb882a76339012b093a2ffa9064100a86d667bf2dbd5ff9f905025baf07c7683dec92ed3ea3196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242202, "uuid": "f3e4bd2e-28e1-46c0-ad82-5f92d6cf9c8e", "value": "T1216412683F79D33DE63A077D98545A08133D705059ABFF0D2F04E5EF8A7B70281A26A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242202, "uuid": "216e19c8-ca6b-4f7a-966b-c9e17f983b5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242202, "uuid": "2abb1832-a4db-4533-ba72-3a037480fb2d", "value": "6144:YkENIBpHvZOP3SJy3hEin5jr+F4kJWXwCLLLOs/JFQHPVucG7Wdh:vPAP3SUhXntrZkbCNBFQHPVcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242202, "uuid": "8c610541-f368-423a-8501-3da4176e8679", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242202, "uuid": "991bfde3-28b1-498d-96b9-68f0b222bcb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242202, "uuid": "cf3266bd-e76b-4389-b05a-1a58d5956f80", "value": "2d84b38efa4ce09e9b92c7d9cdfaadfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587431cb-3638-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635237617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237617, "uuid": "7acf888d-ffea-41aa-80bc-d217aae568f0", "comment": "Malware payload (AveMariaRAT)", "value": "2cd1c85653a455037cc06e28f618cadd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237617, "uuid": "251f45cf-2bf3-40c1-8d60-248bec8ad291", "comment": "Malware payload (AveMariaRAT)", "value": "f76a6159bfa4a475f623a5969e9ed6f83dc9ba382a0a0e39332507fca8fc06b8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237617, "uuid": "9bf43297-2cf6-4b74-a09f-f56249166bcb", "comment": "Malware payload (AveMariaRAT)", "value": "1c73eecf53204098c00396764f440e94e226e85f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237617, "uuid": "a2c12ed7-6a7c-4b3c-9bcf-899902dee076", "comment": "Malware payload (AveMariaRAT)", "value": "46a378684d78ff5a894137ad7a255d247feab60c93cc13b427a8fe3b8a566aac1691419838ad5151e651d65ca4e7178c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237617, "uuid": "036fac57-6a2c-4840-9299-c455d21fe032", "value": "T157F2E04A9E536479C66C48FC76884AE92C582D6FC562EF167130B4F46E3420A03E7BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237617, "uuid": "0bf2bd1c-c32e-4705-9f7c-35761b9e083c", "value": "768:r2QnpoHrkdP32KMgh4p35CY7fc4+oufgh8MUpke+v/N:pnOHrOPGKbh4Xn7U4+ouIGMUpkn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237617, "uuid": "7bf0d5ca-ecd6-4bdd-a25d-0720d0744fce", "value": 36340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237617, "uuid": "4010c1d6-3367-4793-bb7c-0f8b6286ebc8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237617, "uuid": "3918ab32-28d0-43af-b5c6-650070f7d8be", "value": "Dues_Schedule.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c89ddbc-365c-11ec-843c-42010a9c0014", "comment": "Malware payload (Sodinokibi)", "timestamp": 1635253193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253193, "uuid": "8fc66377-0361-4c35-b0e6-9376fc2cb846", "comment": "Malware payload (Sodinokibi)", "value": "c83df66c46bcbc05cd987661882ff061", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253193, "uuid": "be9001b0-1970-478d-9239-ae62a8f6820d", "comment": "Malware payload (Sodinokibi)", "value": "f864922f947a6bb7d894245b53795b54b9378c0f7633c521240488e86f60c2c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253193, "uuid": "aaf29455-005a-4e90-b2e7-68ec57594341", "comment": "Malware payload (Sodinokibi)", "value": "48d1558fe3ac689b7eaac82738a023c13f4c0e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635253193, "uuid": "76eb14b6-9f40-4da9-a155-990e19f93c65", "comment": "Malware payload (Sodinokibi)", "value": "0e25faa96b1d21154b57813f04a7658164c1d89a03baeeda3f1e6e4ee9e3f6158d49adbd6152229b35dfce19c525e805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253193, "uuid": "407a76ff-f26b-4582-98f5-e642d3fb287c", "value": "T1E9B32AF7E6B551ECC676F33929CF7CF7E0A0707815B6240E6B86391D23249890D6623A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253193, "uuid": "f257b505-7f0d-4d8c-b98f-3832b9096842", "value": "3072:LQ7b+XdBHttsNgggwgggwgggwgggwgggYSWV:mZFTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635253193, "uuid": "6cce3b74-2e86-4d69-8e71-5526caa2ab26", "value": 109336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635253193, "uuid": "37c73c35-2890-44ae-badf-94361bc2b409", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635253193, "uuid": "5548c6aa-2c3b-4cae-8b84-453e0693cfa4", "value": "f864922f947a6bb7d894245b53795b54b9378c0f7633c521240488e86f60c2c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642bb8ea-3648-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635244508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244508, "uuid": "adb26dd6-1b89-44ab-93dc-e863da6f339e", "comment": "Malware payload (Formbook)", "value": "6ff3af29fcf1cabca1e7df8a6094e4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244508, "uuid": "90d00f8e-888b-4d8c-bbe7-80fa22124139", "comment": "Malware payload (Formbook)", "value": "f8b6860b5f79411ce377df615b3e72745e773c9e89347fdf00adea4f8200e51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244508, "uuid": "be32b6e1-ef18-4ffc-ac6d-c78945630baf", "comment": "Malware payload (Formbook)", "value": "f382d117151ad79fa9ecd42920fe63e105aed461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635244508, "uuid": "49eb9b82-b767-4200-9354-91357ac24cc7", "comment": "Malware payload (Formbook)", "value": "c2b5c3178543825b4963ae72c5dd62ca7cd9641b70c7b254577bff7d4d448cbcca9a7cefe92e7bfe13ba18bf69af57b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244508, "uuid": "e505d3b3-074f-4f04-80b3-dda124fcd8af", "value": "T1AD7412063EAC7330CADE0737E5F5B58013BAAEC74B02D75EA66431995EA3BE90142717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244508, "uuid": "f394c29a-0a73-4749-9dc1-404b76a612aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244508, "uuid": "d61951a2-7722-481a-b9ea-39fb8102e190", "value": "6144:cWZKLBWyEUEFrNbMZmvs8hhkEnYt5iVKbWNUy9YNCJrFRVFzCYRPQmRJ33oWI:dcLBWNF2Zmp9eiIbWNVYNgrFNz1RPzJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635244508, "uuid": "3b4a3540-4f6f-428e-9786-8d4e60cd454b", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635244508, "uuid": "dcecff78-a866-49eb-815d-366775c96ccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635244508, "uuid": "19bbf3fa-3631-4476-8112-4eb238bde6e5", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b16861-3657-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635251007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251007, "uuid": "c11a7ca4-9edc-4520-82a9-54b47d8c4099", "comment": "Malware payload (NanoCore)", "value": "e13b24cda6737f13b2dc3f2c20d8823b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251007, "uuid": "94478ebe-6e09-4629-a8bb-b068ce09acb6", "comment": "Malware payload (NanoCore)", "value": "f8ee546f04fa175fa9a8b1f3de8595bd0a4f6aebfeed50a95c5e309d49063e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251007, "uuid": "372bb65f-c6be-4330-901c-c32036bce524", "comment": "Malware payload (NanoCore)", "value": "b58a2436a4befb5b7465153a72f64fd17531644c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251007, "uuid": "68991834-6888-48ec-9d91-023b48a6435d", "comment": "Malware payload (NanoCore)", "value": "34000e3651842ed72a8e294c365abad811fb98af940925f2d3943740bd6819ba443e893d59c7d0970589f07f5b572618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251007, "uuid": "d0a252a2-fd5f-4ce1-823b-66cf084e1204", "value": "T11DC401C2FAA48081FC720D7AD87288A176656CB9CE93775919DE775C043B0D281EF4FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251007, "uuid": "b847fde6-ab80-4eb8-82bb-bd24992cb1ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251007, "uuid": "9837f18d-f3e7-4763-aa3e-d26a95d72362", "value": "12288:flGhdMhckf/KMU1oHh6ZL2tJ84K0AQZ+3GS4Wwt4q4W8wL:cAhceEshcqtJ84K0f+3gt4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251007, "uuid": "0cfe7113-dc54-4be0-bd85-5bf6db4d70c9", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251007, "uuid": "8e20c7bc-1ceb-4f65-bb38-c8c7b85e257e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251007, "uuid": "53f5f5d4-8fba-4141-ac07-7c1617f7d54c", "value": "e13b24cda6737f13b2dc3f2c20d8823b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa25c02-365f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635254532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254532, "uuid": "720b7f33-0423-4dc0-9810-9ba79fc13863", "comment": "Malware payload", "value": "c2dbae28535c8cbe4a615c06eaa4ed14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254532, "uuid": "a7b12dd7-6aae-404c-b76d-ee5190f89024", "comment": "Malware payload", "value": "f96a9919b9c54c646a792ff70222951b0606857a8cd627cbda7d11ff07f45e59", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254532, "uuid": "65b13825-ea1b-4c98-ad97-dedb95039ca9", "comment": "Malware payload", "value": "23285331c50cce86b6352eddede56ff3952a29a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254532, "uuid": "7db5b473-0ce5-48dc-ad16-8420a4180bb1", "comment": "Malware payload", "value": "69d6a2308a6216a5b498f0d03cb1615a8319e3b4bd022758b2ee561a3f5c334efbaee50b9c0662096b8bea1f98b864a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254532, "uuid": "1c025b76-0b58-4a8e-94e4-925bb0cb8f4c", "value": "T116254271B7BE45006C2524BEFAB65DB71C91A18CE58FEFAA012C1A7CA4C7C572E48CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254532, "uuid": "a258ad75-d072-4f26-a0e1-d84da3f91c9d", "value": "1536:OCODgvsNzwDUbzstGe+S2XEXtXX8XZXnmcZtDRhj7aqDfpbS8iopDGnpZ8Y:OHDg0VjbQUS8iopI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635254532, "uuid": "6a1da711-8b85-40f0-b637-ddcbadabe39c", "value": 981226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635254532, "uuid": "966e7851-4464-48e8-9bc9-608766b2bd5e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254532, "uuid": "c2c8bd87-592d-410b-95ba-189f35c45e29", "value": "pes", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f6c523-3691-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635275834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635275834, "uuid": "69791f91-fd82-4216-b6e9-6cd3c45432fa", "comment": "Malware payload", "value": "e06866bd60986105b598fccb9fc69e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635275834, "uuid": "38cafaf0-d60b-473e-a5ed-5e691b0be000", "comment": "Malware payload", "value": "fa8ed58e46070e9bf33b82ee0ee6ba684993d911de0db90069c6c882c2031d33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635275834, "uuid": "4f72aab3-d5ff-4641-929b-5a49ba0a4228", "comment": "Malware payload", "value": "346f9fbba69b60983db27e6c96c2ee63f034fdf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635275834, "uuid": "b02d7e9f-d64e-48ce-9761-9e9666fc55c2", "comment": "Malware payload", "value": "b8cf9d967accaa3d95e1c866d9e5975ca82ee20618a83793ed2c10cfca0856fa2a4755c0d9461c53fc25124698a70abe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635275834, "uuid": "6145ecf5-e133-4181-be6f-bc0d5f2f7a98", "value": "T13964E000F6E3C835D67656308D2AC6E95A3ABCD3DD3CC54F27973A6E6E312808926375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635275834, "uuid": "77a9bfc1-c517-4b19-9f49-38b7ec5c80a1", "value": "b8ef4a428f658ada3d2d48117cace047", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635275834, "uuid": "9ce6decb-7a8d-4f0d-992c-4861a415c5f6", "value": "6144:vOKNElg6fIDR+EVv4sJQfd+5XHEiD0QrYfChH7T7hMoca7ynVP:vIg6fI+kV150ixZhH7nhMa7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635275834, "uuid": "e8a90291-db02-4903-9e0a-7f2b6b7fb037", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635275834, "uuid": "8b20bcbc-2bf2-4711-a356-e90660a25502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635275834, "uuid": "d6d62f3c-89f3-4b94-9ef8-5a7ba9a5c419", "value": "e06866bd60986105b598fccb9fc69e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4321efbf-365f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635254331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254331, "uuid": "ff505ae8-80e5-4753-aa84-5b5e28dc34ab", "comment": "Malware payload (Formbook)", "value": "980c080857ff5a30b52a62d8649042da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254331, "uuid": "830a19b1-869d-46b9-856a-e0b18b408434", "comment": "Malware payload (Formbook)", "value": "fafcee9b031f24dbd150b43afbb5cac24bbdccfa4125f4f3017bdd8e94926e9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254331, "uuid": "51bda484-e5f8-4611-a3d3-109032394aa7", "comment": "Malware payload (Formbook)", "value": "526b740fdf0c8d3d16de1cbe6fc687719a6c2814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635254331, "uuid": "97b24f33-405d-482c-b762-166309bd079c", "comment": "Malware payload (Formbook)", "value": "b6d53a34a7059d6770a9f8dabe07ec5b730c98498acf4b76197c2945720f19da7cc2d5b28c286b6f6eacfaf7c87469c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254331, "uuid": "aa98e01b-c548-4d7d-a500-35b864ab5ee9", "value": "T10364125C4AECD73AEBBE277A109005D8237A62253512F75D8F1930E56F73F028875A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254331, "uuid": "d10f539c-3839-4f09-9ee9-141921165af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254331, "uuid": "716b3988-48ed-4ed6-90d3-9a49283fdac2", "value": "6144:zAGjpN2hFNrsRnvV/KloM3lkrEBGG5eR2IdOrw3zR2gQSQ6:p32hnsa+EfIdOKRfQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635254331, "uuid": "e170f746-ce02-48c8-8d5a-9b310cc87227", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635254331, "uuid": "a732ae71-6f66-4c42-8d01-a65ebe271ccc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635254331, "uuid": "63ab3af6-4db9-4679-ac69-3d50ce1e28ae", "value": "980c080857ff5a30b52a62d8649042da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51e365b-3671-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635262280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262280, "uuid": "88edccf4-bfd9-47f2-8777-7111750c627f", "comment": "Malware payload (Loki)", "value": "1addc2771d3f2274ca1d6f4a8dbb2ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262280, "uuid": "67e4ba46-8e60-4869-ba7e-5c93a04814b1", "comment": "Malware payload (Loki)", "value": "fbbf9773b211525ee23caa5ac2d18255f0c47909230ed1d1b29c4fd765e6d3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262280, "uuid": "f420e999-9efe-4458-8430-bafcd8f57b45", "comment": "Malware payload (Loki)", "value": "a8b063824acc5ba6a987df62b154a45f8b9a7bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635262280, "uuid": "c844e53f-f598-46f9-8891-e5ba002f7f36", "comment": "Malware payload (Loki)", "value": "b342bf65beeaadf5a4e42621cbc0c06e0b200b0a26058a4b509a55576d0a447595d7ca45b4a25e6e1783983023a9f64a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262280, "uuid": "0ddda05d-7eae-4224-b4ad-bdd08f5d266f", "value": "T1E64412495BBCD370D7AB17BC6489420853BDE24A39B3F28D1B41E5EB6E37B0142206DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262280, "uuid": "d0494c3d-d4af-4cda-b25b-433ab6fcd88e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262280, "uuid": "587196d5-0acf-4221-9c59-4702fb14ae4f", "value": "6144:w7OZOM3doK15orL2Ab0R0NMYUrJo8/BEjR2M/Mqryh:Q0doso3zyrJo8ijRZ/Mqry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635262280, "uuid": "915eaaf3-aac4-433f-9653-b28701c88c16", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635262280, "uuid": "6c29b93e-50b9-493f-a96a-1eb6ca5dd959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635262280, "uuid": "cdef73fe-2873-4f7e-89cb-4f0737eba422", "value": "1addc2771d3f2274ca1d6f4a8dbb2ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0f1e50-3637-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635237057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237057, "uuid": "af2ace70-1565-412d-b36d-403837ba5af2", "comment": "Malware payload", "value": "345e6bd6ad6ac8ecbb25a9858919e2c7", "object_relation": "md5", "Tag": [ { "name": "psagent.eo", "colour": "#D28FC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237057, "uuid": "3ebb4e0b-78ef-433b-b163-3ab7805bc20c", "comment": "Malware payload", "value": "fc01277de9858b42ce6f91e202fa7f14965f2e85296f5a307cb726f09b742ca9", "object_relation": "sha256", "Tag": [ { "name": "psagent.eo", "colour": "#D28FC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237057, "uuid": "b7cbf041-f2c1-41df-a84b-a439e9f58ee1", "comment": "Malware payload", "value": "a9e87e6197563abe62133cfef8e8408f23a9d2ec", "object_relation": "sha1", "Tag": [ { "name": "psagent.eo", "colour": "#D28FC1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635237057, "uuid": "326c1e39-9d48-456a-963e-993e6f207ea0", "comment": "Malware payload", "value": "7b6271e7325df73b9485f158f4e9c50efda1ca5b747e459c55ce48b12530b25397660f6ea75a4b9ff556dd9af409e83b", "object_relation": "sha3-384", "Tag": [ { "name": "psagent.eo", "colour": "#D28FC1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237057, "uuid": "b6cc1829-fc6e-43bf-b028-7861a85a94ee", "value": "T1F934285303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EE7BC3BD849430626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237057, "uuid": "6275ae0c-92e1-487e-a1ab-12841f20be1c", "value": "1536:EU/UTIZ/IdeczI9uutwlYcN5FywcYODDklvMoHWt1fe/ofOAvZspLs21hVW2ofXY:NLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635237057, "uuid": "3cbf01ec-4474-4cba-94c4-e8e3d9d78b09", "value": 231420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635237057, "uuid": "b15d84fb-5c51-4701-ae64-07a900bfd3e4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635237057, "uuid": "82304111-94d3-43db-892c-6442a4689e7b", "value": "2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975b9c3a-3643-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635242447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242447, "uuid": "87780c47-cb34-412e-9692-027a0ab6385b", "comment": "Malware payload (Loki)", "value": "e17907e78bff51fd0ffc739cf604de30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242447, "uuid": "b1c218a0-ac32-49cd-a9a9-6def042a412f", "comment": "Malware payload (Loki)", "value": "fc1dd9f646db9b8e62db754e7f6f133bae05dc96ba1aeed620e58edd1f2f92c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242447, "uuid": "08b61df2-8633-43ed-bb46-30da66820310", "comment": "Malware payload (Loki)", "value": "76b9ea683d3e9fd0b29320d6ca5b1afb70f39f22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635242447, "uuid": "7c9f8ed3-35da-4322-a027-668b865a642a", "comment": "Malware payload (Loki)", "value": "ac47ece2f803e443ba787f0fb8d4682666c622e9b80e47e3fc9d618da4cb31075d6b5e86525bef477f70b79f94974c9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242447, "uuid": "2805537e-abd9-4102-87c6-04c64cc4c312", "value": "T1AF44128CC6ECA331E9790BFA9095094413B9A4693920FBCF1A54B27F6DBFB0085CE557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242447, "uuid": "74f71516-ea23-40df-b3ae-a759a3fe6017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242447, "uuid": "d941f1ef-1bae-4a40-922d-7b24535caafb", "value": "6144:WieoiEfS+cSkeaaitn4epc1c3FykguEADjG3YTSDokOvZ:QEfS1SkejitnlCjkg/Z3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635242447, "uuid": "f7311aa0-f098-40e4-aa7d-75d9bc96cb91", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635242447, "uuid": "7a0e2697-3fa9-4e64-8313-024404c83d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635242447, "uuid": "b169e063-09c5-48dd-927e-4cb41d1ca1c1", "value": "e17907e78bff51fd0ffc739cf604de30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6be2687-3640-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635241265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241265, "uuid": "74013c10-030f-4b54-8804-27c36a36e6d9", "comment": "Malware payload", "value": "e8981a0dff3070596b5e31327aeaf649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241265, "uuid": "59b8dfaa-b21c-43ef-9a4c-128da069320f", "comment": "Malware payload", "value": "fd31cc24933007c321c78e0a3d4fe8e637e6779604c726fbbe8f66ec05102519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241265, "uuid": "80c31f21-472b-47a4-aad8-3c3e738a0fb3", "comment": "Malware payload", "value": "84b311b487b916864f9ecf65b7973247dff7fe2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635241265, "uuid": "16864620-2dd2-42ef-9337-3d2f5997cd24", "comment": "Malware payload", "value": "0b199ba37400321b1276ca9171beb752d34575d096cd0268f88ecdefda35e4291bcf9d581da2facd605cddebf83f6949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241265, "uuid": "070a456c-98d6-4ffb-a89d-5fec3f84da06", "value": "T10CC4F102BBD188B2E873193249396F156D3D7D202E35DA6FB3E4296DDE311816634BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241265, "uuid": "02c40422-72cd-49a5-bcee-6c28c005ee25", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241265, "uuid": "11a1a90f-1417-4fcc-aba4-c137eab3da24", "value": "12288:oQnk3GDYKGcblwtX+t4Y8gepPzfSAz3RggTje5Jd:8AOcZwXYZep7xNfep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635241265, "uuid": "d20f9097-25e7-41c9-8067-4ee84c40f81f", "value": 584776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635241265, "uuid": "2c2f021e-9f62-4b55-86ae-aceef678f613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635241265, "uuid": "2ec58fd5-91e5-476b-bd7a-00ceca209eae", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdd129d-3618-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1635223905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635223905, "uuid": "3deaa2c7-b192-4232-a926-2afed6ea2f98", "comment": "Malware payload (OskiStealer)", "value": "02cd470bb9b7e396177d0a1b22c2cfd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635223905, "uuid": "befcf7b7-59aa-44c3-8c90-4ff1121f221e", "comment": "Malware payload (OskiStealer)", "value": "fda2fdaaeed467e094b790f5913858e6a92c8ee571ad71cdf3645a247f3f37af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635223905, "uuid": "ddcea8f4-b6de-4135-adc6-de4adb595e4f", "comment": "Malware payload (OskiStealer)", "value": "5a557773f12d3401fc17e89a68eb94a058374ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635223905, "uuid": "cef86d1b-b50f-49cd-a420-cb5fe8f18ead", "comment": "Malware payload (OskiStealer)", "value": "5a7ade59d54df1987ca7b69d976c6a44260bc8cfbf56825f0674ab897d27cda0bfa8881118ec77caa2631a99b05e0835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635223905, "uuid": "171da4f5-894e-4543-b7d1-deb8d03f22c2", "value": "T164849DDAE560E672F80B9931912C3E194B0A6EF531ADC4458EEC7C173C62B1D364BE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635223905, "uuid": "d762bdba-9068-435d-8ddb-35862b35bacf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635223905, "uuid": "5cdee90b-96a7-4805-92be-8dcd4591bc07", "value": "6144:1BlL/G4BUKkY3PBmg9Ws3C3c6hoBXuzuPhqkkX9pqGP4DGPs:jY4BNPBTb38oBXuSpFkGDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635223905, "uuid": "ec4b7ea3-0860-4d88-a0e1-8d5993f4c073", "value": 396029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635223905, "uuid": "83d07ba2-7e48-4b15-a5ed-84e81f8afe77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635223905, "uuid": "830bfc97-68d8-4077-803e-bfae64e9ad4b", "value": "Zhang 25102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293c36ec-3658-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635251281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251281, "uuid": "beff7de0-eaa5-42a4-8d21-6f3f327a13ae", "comment": "Malware payload", "value": "299539c58a4ecdbde5640fda1abb542c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251281, "uuid": "c5b7bef7-0678-4f03-a8dc-347d3c509c18", "comment": "Malware payload", "value": "fe6a8379607bc2e1e877de4115ae49f53fa809376bb83ee94da07589b09fcec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251281, "uuid": "b6835a26-50b2-4092-8d2a-12f01a826588", "comment": "Malware payload", "value": "d1cf974eb14d14d584c6ad8504c0b505ac686ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635251281, "uuid": "b06ca7d0-9d58-4d64-bf20-98d64cfd0b13", "comment": "Malware payload", "value": "1c69e84dc00441e5812f54725e040d49ecc0b45d1da8f5089fc1041337fbdf97f1f8555891f1de4fae1de99e719a05cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251281, "uuid": "11122474-cb50-49ba-a1f8-7a136705cd17", "value": "T1989533D9DF1E805CF0ED6FB323C50D02E5F690954489404BE1E9AF99B21D1B16ACAF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251281, "uuid": "ea7f0f0f-fc2c-4c00-8f20-b1d6cbeef6b3", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251281, "uuid": "35eb42e5-4c95-48b9-86ab-fad5e8119064", "value": "49152:xvERMFZaYjBD0bjm/RKx9FeF8AydFrFImBIJ/N3hyOXAdVL+2/V+z:xsR2BDCjOAAF8AwFrFWyOXA62/4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635251281, "uuid": "2a4aaa53-21d3-4c97-b02f-762a62993f6e", "value": 2043392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635251281, "uuid": "479c2f26-e139-4f04-956c-dfbbd3be9005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635251281, "uuid": "e97d3311-f291-4fef-9281-727844ddbb97", "value": "299539c58a4ecdbde5640fda1abb542c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }