{ "Event": { "published": true, "date": "2023-08-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-04", "timestamp": 1691193782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4c437595-c843-4c75-b2a1-b07cd7acdb29", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724241ea-3320-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691192494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192494, "uuid": "02040186-6856-4763-8fe3-f297e3642401", "comment": "Malware payload (Amadey)", "value": "040c7a43fccde78479a429810645a5dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192494, "uuid": "62f61ee1-06a6-442c-8613-713fb21fd823", "comment": "Malware payload (Amadey)", "value": "019a8b07b738e203f97a6d4b7f08c21f4ba9927e0696eeae8c0ede74a6cd8cc7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192494, "uuid": "cafa64a9-9d66-4cdd-a877-1a3f225bac8e", "comment": "Malware payload (Amadey)", "value": "696d24f73ab93344562c98eb2c4ae580b8ff782d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192494, "uuid": "d301f660-81be-4adc-930d-2919dd5e6c22", "comment": "Malware payload (Amadey)", "value": "650bd048a34afd8a3a78809655ff8c32d1eedd45439d58ceba7bca345b3f36353691f03c11a53e1e8ace5a21738502e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192494, "uuid": "d6b514ca-5626-40d4-aafb-16b9e1caeb00", "value": "T10903F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192494, "uuid": "1641c628-2afa-4043-8269-222d443b0cd5", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691192494, "uuid": "e67a2d31-b47e-40c4-99ce-3018b0e5922f", "value": 40152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691192494, "uuid": "30ddb32c-5d6a-4c65-b606-acc90617e8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192494, "uuid": "c68663c0-57bb-49b4-a40b-e87d0e341078", "value": "040c7a43fccde78479a429810645a5dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db43574-32be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691150476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150476, "uuid": "6c092ef4-66d3-45d2-b2d2-d4d41127fe2e", "comment": "Malware payload", "value": "98154a62f5e9ea0dfb7bb319c80e9d8d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150476, "uuid": "d28d4807-b664-477a-8047-d87a98a99c30", "comment": "Malware payload", "value": "0303df63ff8d94fae617ae7a9f2611d51e4f0ec18d4f46b2add504656d231c7b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150476, "uuid": "f53fff7f-463c-4850-a58d-6bf2dbedcc40", "comment": "Malware payload", "value": "032d3d8a324995deedd3f075692591d96de40157", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150476, "uuid": "752b62f9-682d-4474-b61a-2d65e878b5a9", "comment": "Malware payload", "value": "2518322acabb5694c0b3c29ea88e8af2df475ce0815f9f98431f0144a121e3a9191644f368cfbaa56eef7c8749cb6df9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150476, "uuid": "4207d9bc-53e2-4204-b9b7-237496348bda", "value": "T1FD612BE867CCADD7DF920419AC533C3D531AB1DB8BD75E502449E6E109DE4426934D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150476, "uuid": "beb554c6-0688-4c9c-8fdb-1569b34aa2e6", "value": "96:gAKi6hYGzi2EFngL0VAUp8KkddFtPSGS/m:p6hYwuFggpTkddrSGOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691150476, "uuid": "dd8f36e0-fa4c-442b-a423-4bd5208f3c4c", "value": 3204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691150476, "uuid": "2e6561aa-e798-44a6-8d82-ed3c197cecf1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150476, "uuid": "9827a6e4-cb27-4c08-b50e-2e41cc36cceb", "value": "Diagram and Items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d26035-32ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691170731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170731, "uuid": "e527d5bd-66c5-4839-a74a-d826c78be72b", "comment": "Malware payload (Stealc)", "value": "789eaea81291addedd12202fac777c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170731, "uuid": "12677326-2e10-4b20-9b0d-c9eb39de4bc5", "comment": "Malware payload (Stealc)", "value": "03eccfa5dea23fc185bcca277520d7ef473ff752649aac485ac055dd4111b2c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170731, "uuid": "c4bed3d6-7782-47b3-8e71-a6c236c2b8f4", "comment": "Malware payload (Stealc)", "value": "a790504363ecbc2308e625a6a9fb6b4978a321fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170731, "uuid": "2c60fbd0-763e-4554-86d0-958c119e8a92", "comment": "Malware payload (Stealc)", "value": "1b0e9671e13c34f2d5130e7458a1ed146702fbe04ea070e90dd72355b7e25b8682b0c23802fa93bf5bebb93b49eea64b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170731, "uuid": "66d86208-7dd2-482d-8ab7-5e7a1c65098a", "value": "T1AD54AE1262D1D872E62745358E1ACAF46A3EF8705F596BC737446B3F09336E2DA32341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170731, "uuid": "c8f48ce4-14aa-49f1-89be-5cdf707033ec", "value": "724ad9571755841c2e0f4aa3cd09706a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170731, "uuid": "c5ca0b4b-aad8-4ada-892d-8246146cd25c", "value": "3072:ZtOpyD58tS/0MmL+JmSxT/fgd3fn8jJaVxmB+AEEb8jRMvw85oicKpSdBqI3:Ey6tG0MmLrSxT/oxaxB+AxHoi/SDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691170731, "uuid": "97035521-eaca-4965-9b0d-6a4568282860", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691170731, "uuid": "5b0375a1-6804-4ac1-a795-9bab82e21f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170731, "uuid": "dd3fd8e8-4151-427b-bc69-4d036d59e618", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f142aebc-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124417, "uuid": "ce749b12-1300-4066-8507-a2322afbc8a5", "comment": "Malware payload (Mirai)", "value": "5543ba3c7b81a7a19ec0a056be00deee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124417, "uuid": "7e289edb-917c-494c-9847-3d9a6cf240b0", "comment": "Malware payload (Mirai)", "value": "043cb1766c34c2bb3f0feb5765dcd985d84f00ee8b7eef2a4e5adf6905fa47b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124417, "uuid": "7685bbc9-2b5d-4ddb-84e8-01e0105fbcd8", "comment": "Malware payload (Mirai)", "value": "66d5ef0d2250b461a17df10a4122099035872d56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124417, "uuid": "95f8ded1-fdc6-4fce-b4d0-79d7a178312d", "comment": "Malware payload (Mirai)", "value": "7c4073b8b214f8ca78b37f3f221056f5e09bf72acf325bf4f177c37b8d47548f6dd5002381996c207c8883883efc2f2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124417, "uuid": "1e8eae5a-44ff-425b-9696-10727c55e723", "value": "T1D2D2E164D1D80F92FBF65AB60DADD7C32BD4360CA7D787A22650AB42C2117272354ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124417, "uuid": "ffac0c09-5d06-4184-82be-3d234ee846fa", "value": "768:gLZxDk9Xhamuf5oPgY/nyX7RjJZDxmAwtI4uVcqgw0RTWXk:AxShaJSPgP9Dxm9I4u+qgw01WXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124417, "uuid": "abe20a7f-6a21-446f-a5ed-2f0abb3e211e", "value": 30496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124417, "uuid": "4d51e142-a56e-49bd-a93a-1df8beea70ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124417, "uuid": "ee0e71f8-6aa8-4f0c-a05a-a65fe3aeee7e", "value": "5543ba3c7b81a7a19ec0a056be00deee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9797202-3301-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691179272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179272, "uuid": "fa9ca4de-f6a9-4915-b168-bcc0c6d41790", "comment": "Malware payload (RedLineStealer)", "value": "eb236c5e34ce7de93bad30ef461fa2c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179272, "uuid": "7c594534-276f-4aed-a36c-2e5f3458a2fa", "comment": "Malware payload (RedLineStealer)", "value": "04da6c1da31c1d50f6a541d9fb83e6bf477c12085ef8f81724d6157181e59e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179272, "uuid": "b3f68f71-fb04-472f-b63b-fd4c0a38b2be", "comment": "Malware payload (RedLineStealer)", "value": "b2fae3cd997c8da83ac85d30a3cb7ddd518af201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179272, "uuid": "ccd79230-e538-4aac-83c7-840931e53f33", "comment": "Malware payload (RedLineStealer)", "value": "9f74f977915001b3ad285db21357edbfa0bd5bc8f6c92cf8bbe22b80a480a0e8b54de5cdd23f601b352d37ab9534ede5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179272, "uuid": "4f41ffbd-5e43-4b9c-8e9f-991dc807a90d", "value": "T1BBC41207E7E84072DCB4177048FB02D30A367DA2AD7C82AB6784596E1DF3AD4A57532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179272, "uuid": "c54a3802-273b-461f-85a5-9e9dc99bb777", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179272, "uuid": "9861a2fa-4361-4dc0-844c-d0a5cef3fd4c", "value": "12288:GMrgy903bEwJ6pijbbsvOJU5XhgBYCNDzQQd+Ej0T0:SyQbEwQpi/I1YzVUDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691179272, "uuid": "f549851d-573a-4695-85e2-4e06fefb0eb7", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691179272, "uuid": "aa286351-8f27-4652-9169-be075f1a3474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179272, "uuid": "7e2ba83f-4910-44bb-b951-1f01a037924e", "value": "eb236c5e34ce7de93bad30ef461fa2c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b8f2b9-32c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691153608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153608, "uuid": "67ee7096-357c-4bd4-bb65-f3c41a667b76", "comment": "Malware payload", "value": "ab892c661c77f700c1b3d7585c1a90f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153608, "uuid": "e674ed19-431c-4a04-b0c0-aa1ab1f6372b", "comment": "Malware payload", "value": "0516368c67b4d7a375bed396aa666d04f1148357cc8acd302d4986ab6473f77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153608, "uuid": "910ffe2d-cc03-4896-bf59-29e8da33eee4", "comment": "Malware payload", "value": "16faa97e60a86fe0c4cdbf743644903360251d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153608, "uuid": "64379cfc-2eba-4ee3-bd20-c2a188ffdcc8", "comment": "Malware payload", "value": "1faee8194edb25af4d16f43cf5ac987d2a4b7c979c99678157f95fe141919cce79c0d54d54b33f0698e8e472166499c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153608, "uuid": "9717ca6b-fc7d-4d57-a2bc-a61078bbedf2", "value": "T1C995E013FF228446D12E007ACC3A69DE65152E6D2840F8D377EA7E6F19F2753686930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153608, "uuid": "cba99a20-800b-4e9a-bbd4-f53b3b226fdf", "value": "7f13baf4188aebcc322a567e9b8e195c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153608, "uuid": "ed0d0fbb-6a20-4571-a53c-acbef0e749b8", "value": "49152:bVgymcIWkzk4qySxG4mrQMCJaHMZSBm6Mf9N:bVgyUWUk4qySxO/HMKmJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153608, "uuid": "084efaad-c635-4cf9-b0c8-0daec118c71b", "value": 2026403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153608, "uuid": "4050df8f-d696-4733-bbad-b5cfd7bec614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153608, "uuid": "ee5cba43-cc4a-4499-bd1b-c48a5eeac5f9", "value": "Especificaci\u00f3n de pedido (00394-20230803).pdf(58kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546ee0d0-32f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173546, "uuid": "dfbd2b4c-c340-4e63-91f7-f4495bdec91d", "comment": "Malware payload (Amadey)", "value": "e4fb512de5cd558b4ef8304db91356c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173546, "uuid": "80f65799-d5b1-478a-8d99-d31c981b215e", "comment": "Malware payload (Amadey)", "value": "05eee7f2d1be00d75ae1c36846d070fcbe0a9e623f5282cbe1d6e60312adc577", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173546, "uuid": "bd668cc9-6dfd-477f-b197-0927301343a4", "comment": "Malware payload (Amadey)", "value": "d34584c3e2d78db3672b4b344f2849b9cde8c0c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173546, "uuid": "30601a95-aec5-442d-b078-75fa0ce6a759", "comment": "Malware payload (Amadey)", "value": "224ec8bd2707d7df5a19ce0a57bcaeaf05a8ca493e3f132823b936b9a5002280986fa3c82edaeb8a55b27cd33fabba5a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173546, "uuid": "ddcef938-7778-4b34-9494-57b593048376", "value": "T146C41217B7F85227DCBA27B048F707D30F3A3E615E34036A2684540E4EB2699A57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173546, "uuid": "f06ccbc1-0696-406a-a02a-496e5dffc3d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173546, "uuid": "07cff0c3-a2cd-4c2d-8468-20bcf7852e59", "value": "12288:tMrEy90LElcb6KR2/+l+W5doq3oTdR8y:Ny2S/Y+CboTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173546, "uuid": "e80877c4-52ea-4993-9565-6358c9f31223", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173546, "uuid": "8c9dbdb1-579b-4a46-821f-d73900f551c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173546, "uuid": "133d447c-d9e1-4ec1-879d-a24c02073e93", "value": "05eee7f2d1be00d75ae1c36846d070fcbe0a9e623f528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de59e1b9-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691124385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124385, "uuid": "c2ed9b4b-7bd7-45ac-b3da-ac94a3c2602b", "comment": "Malware payload (Loki)", "value": "c8a0babfddebbc52e4d62cc9b7387dfa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124385, "uuid": "b157171f-c49c-4490-9b25-cab0be227e4f", "comment": "Malware payload (Loki)", "value": "0683d2ab496637e5700f38974cb1da56033bc761856b9aa19862c6c65e968fe0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124385, "uuid": "54572f23-669e-47bf-86e4-8eab97221339", "comment": "Malware payload (Loki)", "value": "811be111b5d2554d9bc97e09ccb2281835a44fb6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124385, "uuid": "cbeb9b27-1b49-4185-a3cf-3b8965bdbf33", "comment": "Malware payload (Loki)", "value": "d656efe53ab14d49ce61b56ce0a69278c78b28e94f4b01c5f59108f6989b1a58fbca86d9ec20dc0e5efb55dadfe8791e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124385, "uuid": "8eb30454-a0d5-4bfc-b18a-7bd3730ea211", "value": "T19BB4125821D9EF36F42D83FEA4E1E63117B56D126412D308ECEA62D63973F490582F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124385, "uuid": "14ff397f-1004-47d4-9aab-d0b7effe763b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124385, "uuid": "73b4f82d-b143-4ba6-9ba0-8ba3b731d18c", "value": "12288:v+10YQvjOTzucy4F1PKu8GpY5pqYIcoDCFxjTg4+n:v+1KOTyd6pYmssln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124385, "uuid": "5b33a266-c703-4898-945c-13624aaf95c4", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124385, "uuid": "c5e09e5b-d7c4-478f-9ef5-3a336a771392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124385, "uuid": "efcd0800-91c0-4dbe-9d07-af726c77b2f2", "value": "DHL Express_1301284170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b53d43-32f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691175717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175717, "uuid": "9d1d7cc0-099a-47d3-a132-a75bf0507b4b", "comment": "Malware payload", "value": "396dfe316295e45d3dd2fc9f71d3ae18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175717, "uuid": "061266d3-b090-4f18-a40b-7f7aa6400cb3", "comment": "Malware payload", "value": "06983be195b430cba257a50d768e2eb1c3dea5cbdada43d9c60baf477c6bf0e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175717, "uuid": "bcd33e0d-4a4d-47bd-920d-9a2ca8f6dab3", "comment": "Malware payload", "value": "0ef87c72e33c9dc6aabb764e3be1eb7feba60115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175717, "uuid": "6fc1eb2c-6e65-4ef1-84df-cb5af46c0f04", "comment": "Malware payload", "value": "d6fb1f257a40a304a31692599a6281232cc4eca394fe659c4ab7ccf456179c30e50c0c2e16411597cc7d89c690f222a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175717, "uuid": "2fb24452-6d19-42bc-a0c3-bd3c35976462", "value": "T189E4022872ADC917F97A46F198E1E51843F0794A6C2AF1EC9CC139CF22FAF445501B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175717, "uuid": "1f7a82df-2e79-4814-be35-6c7a895cf5d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175717, "uuid": "282aa067-192a-4d2b-92c6-bbfe25f43224", "value": "12288:znjOMxnVhS1rWaueBg+Lcya5kzgBqvtqJfmsmY1LBQyVtoAKgubPaLjTpEi:zjOMxVhSBB3haovt4msmY1LBHTodgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175717, "uuid": "b395d216-4c70-4352-be79-d3c645aee501", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175717, "uuid": "08c0d97c-5dbe-411c-8f8f-60d5e8820c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175717, "uuid": "7221d0f3-4a89-4b0a-9776-2ae8dac73fd3", "value": "396dfe316295e45d3dd2fc9f71d3ae18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a6b727-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173244, "uuid": "5cce4c68-7bbf-441a-a396-5c7573ed4117", "comment": "Malware payload (Amadey)", "value": "c6502b94e1d78e4a5f25cd5f20daaa41", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173244, "uuid": "0800cebe-7a85-43f3-a98f-b808e515d514", "comment": "Malware payload (Amadey)", "value": "0757545b5cf02ec23e90b1a413bca2f7559cbee176cf611f2d9665f9165966a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173244, "uuid": "da847601-ff5f-493d-9913-7c595e78d3a2", "comment": "Malware payload (Amadey)", "value": "5de2d9f2bbf01638fc1c55fc844860cb70f06175", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173244, "uuid": "615eca8e-b979-4de6-9e25-991b321b630b", "comment": "Malware payload (Amadey)", "value": "407540a589a2ab90e0b43273d9561ffa7a09ba65661dec808b0631f0828652479cffcd8847e8247b53d7e232f91f202c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173244, "uuid": "7131db16-ee60-4cd2-988b-8c9d0a418779", "value": "T19CC41203A7E88133E8F51BB05CFA06870B39BC655D74934B2391986E5CF26C5A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173244, "uuid": "13e7508a-9daf-47e7-9cb0-60ad9577304b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173244, "uuid": "a4b20c42-c280-4198-bb5e-aa98462fa813", "value": "12288:uMrgy90QwMyJSTwZ3lmKxLV/naGCp44hSwfHP:SyhwMLTwbLNaGCpjHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173244, "uuid": "87639ff4-cac1-4c5c-b3fd-d30789885866", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173244, "uuid": "6bc21f2f-dbc0-4c9a-953c-361748c68e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173244, "uuid": "2f0c9b0c-498d-441d-8df2-9e0a4733456a", "value": "c6502b94e1d78e4a5f25cd5f20daaa41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537e9909-325b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691107831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691107831, "uuid": "ecce53ac-ea2c-43d3-99e0-9615ad27758f", "comment": "Malware payload (Amadey)", "value": "feb341c8e07673a6caca5214adbc4807", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691107831, "uuid": "711ccb1d-1398-4431-9efe-296278b5c9cc", "comment": "Malware payload (Amadey)", "value": "0885da2c8dc631e7cc03fd350e9cb8eee1191926fa2c3847e1080ffe703db8f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691107831, "uuid": "1cbf91f6-c96b-4f11-9d25-aae92ba18fda", "comment": "Malware payload (Amadey)", "value": "93af6ce3e58ef5c900b63d01b1f1b63f52cb48ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691107831, "uuid": "190490ba-bba6-48e1-845a-49972dda6b55", "comment": "Malware payload (Amadey)", "value": "7fc42df3f4ceddd831b76ff9529cfbae86813edc3947bfafd29f29e78de239f19d41131e9a01af1405cfad25a6ecd4b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691107831, "uuid": "909fdda1-5712-480f-a082-c8739b092d28", "value": "T171C41206A5E88073D9F6177069F242A30B397CA19D74832B2B559C1F1DB37C0B936B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691107831, "uuid": "84db2b3b-6d0d-4d32-8751-edf12207196a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691107831, "uuid": "cd1cc50d-1bfb-42cf-be58-8943043e1156", "value": "12288:3Mr0y90VcS03xnoZ0FgMANquRhATBIGNilXWJ17xIzE:ny7S0BoZ0FgMANqusTBnNiUxoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691107831, "uuid": "977a7e0f-3f94-44ba-b9cf-73747a2421a2", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691107831, "uuid": "2dabae34-47ec-40ef-9023-fe1ee875d68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691107831, "uuid": "b69ea203-f133-445b-a672-ebcb83763b91", "value": "feb341c8e07673a6caca5214adbc4807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521b5f0a-32f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173542, "uuid": "1ca8b556-4361-4e5d-b601-4d085ac511e8", "comment": "Malware payload (Amadey)", "value": "c6ac5be50ec1f17081828629e8e6d9c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173542, "uuid": "a2f02741-4ac8-4cb8-9c50-882eba73d067", "comment": "Malware payload (Amadey)", "value": "088c00fa3dd6aea07cfdd4c753bcde7a7d8ad1c0114571022b6fde7f487120fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173542, "uuid": "bda364b8-248e-4234-a93d-67f78e1640e0", "comment": "Malware payload (Amadey)", "value": "1e4d141743ec0077f4ab2c72dc32e0df2ec2338f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173542, "uuid": "54af0697-adb7-4352-9a3a-bf045d2aba3b", "comment": "Malware payload (Amadey)", "value": "33690835385c8306abc98f626ebfceb719d3b75def34309ef6cd85710713d1a0f0010105f02b6a23d07e51f018931568", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173542, "uuid": "ec02386f-9296-4cf8-9815-e423deeda1b6", "value": "T143C41243AAD950B3D9F11BB108F713D70B39BDA19A70836B2755E85F0C72B84A836727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173542, "uuid": "739e3077-b238-48b9-b590-2d07c8d8a574", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173542, "uuid": "50cc0e6a-d854-4879-9ba3-49ae1fdae96e", "value": "12288:8Mr4y90jnOOI6WjcmU6zmyPf4i2wqL1u9kM:8ymIPjcmU0myn41u9kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173542, "uuid": "227402c4-f84e-4407-9a80-e014d06b94b2", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173542, "uuid": "a5062bc1-6f2d-43d8-b2a0-7a2fa53852b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173542, "uuid": "70fa73a8-67d4-4769-8572-f1dc1015eccb", "value": "c6ac5be50ec1f17081828629e8e6d9c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de7230e-3268-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691113540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691113540, "uuid": "82ebe8f4-f2b2-4dc9-a4d0-033bc12c8f71", "comment": "Malware payload (njrat)", "value": "2cda9cf35d8d05c05edbc5c3dd007e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691113540, "uuid": "d89b4d85-cccc-46bd-8d6d-50f65820860b", "comment": "Malware payload (njrat)", "value": "0896e4b7c6ed0432d5b7d833dedb07dec372c1d8faf6e3a15b7b216c029d9a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691113540, "uuid": "3329b553-e3c6-4916-aaf4-79387f8a9233", "comment": "Malware payload (njrat)", "value": "28ffad9f374c3a6d46a0cf6921e56ff0035c884a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691113540, "uuid": "175b2f1f-7e6d-4b82-aa82-87226c0d2329", "comment": "Malware payload (njrat)", "value": "e31e718e54432f5accdf93a30a4cc26ee0bf12dcfdf4380544acd51582eca953fe259dfba6e818c6220d98292e9b7f64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691113540, "uuid": "9813d652-6264-42f2-95fa-b25664587dbc", "value": "T1B594D00375C2C471C0B72835872AA755A77ABE201F29D627A3E63C2FFB351D36219693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691113540, "uuid": "9fe30e8d-3eb3-4e02-97b6-c735b7f1054f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691113540, "uuid": "3e80808a-f8ba-4b95-b270-266f7ee305ac", "value": "6144:XOYGXaPNxdgSdcq2pVZPOJHAbK2VjnoGytGYR10fKGF0gk1vubfjZsU:LGqN/XdctpVtkmVoRfYA1v0jZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691113540, "uuid": "a0d0b644-3ad0-439e-9bca-d2fc8b2a4f61", "value": 443969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691113540, "uuid": "e0028602-e150-481e-8d90-2313c19b89a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691113540, "uuid": "8fe45823-8820-485b-bee6-f71ac0399f18", "value": "2cda9cf35d8d05c05edbc5c3dd007e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ba67dd-32fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691176855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176855, "uuid": "ef3a7252-0443-4f31-9806-009cbcd96a8c", "comment": "Malware payload (RedLineStealer)", "value": "bc75a5b5216fa12dc541799a52868739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176855, "uuid": "19e54b61-7861-4f54-bf2f-89bec77668d3", "comment": "Malware payload (RedLineStealer)", "value": "0914df806c1140c9863a6c70da8292eefe58f5cf4f99771c9e6bc02942c45c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176855, "uuid": "db8c11ca-ab36-4ec5-a3a1-ff2ea8c8aff0", "comment": "Malware payload (RedLineStealer)", "value": "dfabbb569c7d49f6f8bc315a3b23e34ee2e3698a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176855, "uuid": "ef2cfe34-ff1f-4488-b730-b2fc31f53f1e", "comment": "Malware payload (RedLineStealer)", "value": "09fcfc62b59528dad39fd31f58742a1df7bb6b775855e3587d9bfa98cb1b2400fd85d7433cc1653c3b89f83d10193cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176855, "uuid": "02a9ce64-664e-4395-82d1-91c453969437", "value": "T15DE41226A3F88532CDF51BB01CF6038B1632BDB1AE74C28A2796746A1C739C1D57176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176855, "uuid": "265d7f5c-2d9c-40d2-9f5e-53a6dc35d52c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176855, "uuid": "c648a2ec-bd03-4d04-a0c1-82d3b322a184", "value": "12288:/Mrjy90VrfdEaQEBqcAai+4f07PpEqSXDdHZkHHuKIdsIVhykgemO8kF0DD:8y4FIqW+A4ibOt4yxeukF0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691176855, "uuid": "6018a545-08f8-40b0-ba72-4d37a000341e", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691176855, "uuid": "1480c618-8fbc-4617-acc0-e803a9cab196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176855, "uuid": "ccccf783-7fc7-47f5-ab2b-f32e4bc93a57", "value": "bc75a5b5216fa12dc541799a52868739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2531eed4-3276-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1691119350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119350, "uuid": "d347ef3f-e0c8-481a-b637-e370b60f5176", "comment": "Malware payload (IcedID)", "value": "60f8d1993043c054e0ddb91e11fc184f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119350, "uuid": "6b800855-9b38-4add-abcb-d23330be2f37", "comment": "Malware payload (IcedID)", "value": "09a537a7c4bed33cfb33ae7d7b5360b52e6c1396a893b67b5e71acc28e3f74c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119350, "uuid": "73a4f2b0-2d7d-4002-afed-fc4606b4e151", "comment": "Malware payload (IcedID)", "value": "80d274ff4278baff08418d48c647c8c0604db3ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119350, "uuid": "d7687bc3-89d8-426a-b5d2-52186504e09e", "comment": "Malware payload (IcedID)", "value": "66734d4a6c7817573796f62c9ed9a7e514b538c812c88bb44f2c940ca614e006a5e7a3edf49f9b65cf5d92d13e03f5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119350, "uuid": "d7a0dcc7-fb00-462b-b3d3-ea66a175f8da", "value": "T191B4E827ED4712DECEBEC2B4839AE3737635B46A62756F1F253097302E40E549B1A708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119350, "uuid": "f16ccc62-aafa-4acc-a173-83f7c9c89d93", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119350, "uuid": "a42b68cb-2ff0-4876-881e-1a85b88eea12", "value": "12288:jymcE1WefvUdDpWcc/9scDp6MGuXxGSthFLEXCRF3MK:e6fvUdDp0/9sY6MGuFoCRF3MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691119350, "uuid": "b606e5e6-1e14-4fcb-af6e-578b8268792c", "value": 540205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691119350, "uuid": "4d6c4a16-1de5-43b6-bea9-50119d6398c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119350, "uuid": "46692c6a-4e9c-4023-8ed1-141b4698b364", "value": "d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b9add9-32e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691166936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166936, "uuid": "fdaf063b-3728-4a62-baf1-82c3f47b88b9", "comment": "Malware payload (RedLineStealer)", "value": "4b37996c4268d4ed4412f2160e9fe87b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166936, "uuid": "b9c26bd1-8b3a-4d64-810d-8a930e2ba07c", "comment": "Malware payload (RedLineStealer)", "value": "0a56d1053c20ab67c54c3d3d7500ef72cf0895a1a852f30f75d1324a1e46115b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166936, "uuid": "1e4cdf77-435a-457c-b833-b90f4c4ee3b4", "comment": "Malware payload (RedLineStealer)", "value": "1bfe4e13e6f048feb615d8b06d14774caa7bb1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166936, "uuid": "048c5788-7553-4fc2-98dd-bfea542c862f", "comment": "Malware payload (RedLineStealer)", "value": "8c76907f82f014f86bf145c246f99b596f8d4082a3cd29ce88fc63fe31d3149e406c32f5782d04b7c4123ac2fd4fec06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166936, "uuid": "6fb028c9-517b-43d9-9e80-36ffbf20f85c", "value": "T19674F112A7F89572D8B5177058FA03C31F367CA2A974832F27896E5E0C73684987177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166936, "uuid": "4b3f78db-069a-44e9-bec2-5a6d7deb45b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166936, "uuid": "0d30fa0e-3018-4395-80ee-205fc318f018", "value": "6144:Kmy+bnr+kp0yN90QEbd71dnb7aut72ZzQIQYamBmLYM/vGOHX0bdMO:6Mr4y90Xbb7nMGnRL75HEbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691166936, "uuid": "f6761542-d527-4eed-b3e3-239193348ef3", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691166936, "uuid": "121bfb0e-5136-47c1-bd43-257ebf4f71f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166936, "uuid": "d476f068-a230-43b6-84e9-721f9e2b24a5", "value": "4b37996c4268d4ed4412f2160e9fe87b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf11e58-32c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691155362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155362, "uuid": "f16da5d4-a4f9-4049-a3eb-d7ef02b60c40", "comment": "Malware payload (Amadey)", "value": "a6abdd70b7682999ad2436bc1d07a16a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155362, "uuid": "bf2ae94b-6bd6-4ec9-ad5e-f3030cafc42e", "comment": "Malware payload (Amadey)", "value": "0a961c00df355978dbb93dec1bea9ef32bac8fee28c4b4dc9b550c32bd7258b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155362, "uuid": "389936a3-c54e-4685-a62a-a918634af00e", "comment": "Malware payload (Amadey)", "value": "0fda2902768448a50182442ed70aebd72221080e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155362, "uuid": "da95fcb3-c89e-414c-81ce-b9cbb486fff7", "comment": "Malware payload (Amadey)", "value": "b16ffc2c7fab582a272bf6a357ebaf30e39879fff1add111ddeeeca4a6d491adf72ca127f95fcc0f4f42704d50858b15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155362, "uuid": "60bb1533-ecfc-4e8d-b7b5-fdb7ae937f6c", "value": "T15334E113E6D88472D9B5277018F703C30A367CA29D78936B3785A95E1C73AD4A8B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155362, "uuid": "8fafa655-c25c-48db-a3d7-e80424b27a76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155362, "uuid": "f521e104-ad0f-4f0e-845e-fc7d84e81261", "value": "6144:KBy+bnr+6p0yN90QE6WkTnrhjB6gBZ+t47DS:jMrmy90MJXhjB6gBYC7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155362, "uuid": "8905de38-6548-4fd2-982d-f4192315f1e7", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155362, "uuid": "6beb1d42-afc6-4b79-b74f-767c0fa62bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155362, "uuid": "78cd5db2-c20c-42c0-8bde-4103809bc8a2", "value": "0a961c00df355978dbb93dec1bea9ef32bac8fee28c4b4dc9b550c32bd7258b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4073e728-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184679, "uuid": "21bb2116-6b45-4326-b359-dbb24e43385e", "comment": "Malware payload (RedLineStealer)", "value": "6f4079d24c7f56b50a285f977d6fef87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184679, "uuid": "8f35ac56-80b4-4056-8608-cb61eb4ff133", "comment": "Malware payload (RedLineStealer)", "value": "0b159eac328af241140e98f1c8c7fdac54c73bf9a5d627cbff7dc9aa137b0e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184679, "uuid": "aec4fb12-b2ad-4dd3-aa38-6e405a06119b", "comment": "Malware payload (RedLineStealer)", "value": "f5f2e1e5ee09ebf8fed6feb66a7ed848d77dadcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184679, "uuid": "cae27c83-de3c-40b7-bee5-55a5e598ba79", "comment": "Malware payload (RedLineStealer)", "value": "7d81a0ba657c70ee7e8eddb53981399204b2bcaf217b43c74390b9fc6dc67efffcfc9d2f50aa78d47349d184b5387356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184679, "uuid": "21439bce-6404-4ac1-9ffe-5a3968d81988", "value": "T116C41213BBD990B3D9711BB098FB03430A35BDF14D74866B2B96A99F0C73684A13176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184679, "uuid": "94cba30f-edc1-4ba5-bac8-55dc15fb16d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184679, "uuid": "b86d84e6-9b00-4bda-9f7e-e64de5a5a099", "value": "12288:1Mrey90zIOFX+E9oT4cp8yg5uicjTQR5aI+:XysO8or8y4upjTS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184679, "uuid": "87ab5015-72c4-40fd-a4f0-eaf3c4251637", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184679, "uuid": "0ac60000-aa5e-471c-bd7d-0e1203d76be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184679, "uuid": "17f5b917-230a-4dee-b3e5-1f2c5c81e558", "value": "6f4079d24c7f56b50a285f977d6fef87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4499c8f3-32cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691156769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156769, "uuid": "78727851-b99f-41bc-885f-9279f3f24290", "comment": "Malware payload (RedLineStealer)", "value": "360a815f311a748b5d2ec02c21345add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156769, "uuid": "c74b5930-5ee7-46b8-a120-c57c343fd0f0", "comment": "Malware payload (RedLineStealer)", "value": "0b2f711508b34cb3b5a05d73cf25803b751738428b311b75bbee6542d97cd66d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156769, "uuid": "c4fefbec-a551-422c-b37b-0aed5eb04161", "comment": "Malware payload (RedLineStealer)", "value": "6d8c536023cdf42a3e8c9fc7c305eaa42829e3f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156769, "uuid": "ecd8808d-98a4-4fd3-9bec-84f0960352dc", "comment": "Malware payload (RedLineStealer)", "value": "6a13e9531cb7e1ca95fdaf7aa88a9915a150369f7725495fa39c5e4b32aba3f1936609c7efdb2cf5c62fa723d743addf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691156769, "uuid": "dcaeaf41-bf98-4ca8-8631-07902195e425", "value": "T1DF03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691156769, "uuid": "f1a872da-0a8f-45e4-b09a-8aa3f4e4eebf", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691156769, "uuid": "84ec125a-0b67-4e50-8005-4d31f62c0572", "value": 40262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691156769, "uuid": "e9f674c4-5fbe-4fbf-a053-961f091017b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691156769, "uuid": "c2741699-ef12-43f1-af6c-34967c52bf08", "value": "360a815f311a748b5d2ec02c21345add.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93eb00d-32a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691140241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691140241, "uuid": "e77b1e17-a8a6-4624-84c8-117b5cc091b5", "comment": "Malware payload (RedLineStealer)", "value": "bee8d0f1fae32787f43b26af0e11906e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691140241, "uuid": "99670052-e97b-40af-8c05-e8ff4d25fd35", "comment": "Malware payload (RedLineStealer)", "value": "0bc35c2c32d0c5e670abd9cbfceaeab8875f8024528a3d7264ccaff50392e6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691140241, "uuid": "2e314068-b7e1-491b-9338-f9ec113c05cc", "comment": "Malware payload (RedLineStealer)", "value": "15aad73df1d31c15bb841c7be102e4a820deb7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691140241, "uuid": "3f489441-4b2d-4c86-8589-b28ed466e418", "comment": "Malware payload (RedLineStealer)", "value": "d8097dc990a16d924f374f76b63f1fc076ae39efba41c10fa31ff9327af9db4e60d59e4caba512e947549c922ba35689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691140241, "uuid": "6b0e1229-b67d-458a-82a1-72ab7d39de8f", "value": "T131C41263E7D85073C9B617B014F707931F327EA15E64531B2781ACAE08B3784A8B676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691140241, "uuid": "b6e36f04-f585-49cb-9c0e-346606910b52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691140241, "uuid": "758e3899-b67a-455d-a7ab-375f826d455a", "value": "12288:3MrCy907mEdPeIgRuZPgByN+J0KSjVyVWyihNiGkKOqQp4/O:RyAmQPURuJ+J0KIywy+NMKokO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691140241, "uuid": "6cdc0cca-8107-4bc6-9a10-9912ad2550b6", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691140241, "uuid": "6afd2823-e4c1-44b8-8ce7-955dbc403989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691140241, "uuid": "f6a6ff05-4e05-4f88-abc9-8be2698a56ee", "value": "bee8d0f1fae32787f43b26af0e11906e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534b94f7-32f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173544, "uuid": "dd755b90-84d0-4521-a6cb-633c3c7fab79", "comment": "Malware payload (Amadey)", "value": "cf6ecd4e57a58f3732db777e7c28cce9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173544, "uuid": "bd100eca-b2d1-462b-9540-1df01ede3374", "comment": "Malware payload (Amadey)", "value": "0d752c298c3fc1939a93062283c2a49805996225e541c5845e6b356f1f16c3a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173544, "uuid": "969fac4f-47ce-405e-8cc9-70a657d64211", "comment": "Malware payload (Amadey)", "value": "0d9da8cbd516a7b80cbbeeabfd79988189ad3093", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173544, "uuid": "407246a4-8af0-415e-8ff7-7a772d8a0b35", "comment": "Malware payload (Amadey)", "value": "8c0ec6c8446a9eb05948df8672557623463351f4ee7682a8f32d7e735f1c9bdb17ea067fb3b282f7127d8fc11939bb79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173544, "uuid": "46a780cd-1433-4367-a5b5-9218be75d313", "value": "T17AC41213A7E98073DCB427F058FA02830B36BE659DBDC63A2245985B1DB3394A53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173544, "uuid": "1cf2fda9-5a51-4bf9-9c56-6979bae1f7aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173544, "uuid": "be6cec79-8289-4c97-9810-52d3b23d4f71", "value": "12288:KMrcy90CvjQP++kwvHK8rShTGdvgBYCZJUD4fvQ:CyDrQ2+kwPprStxz/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173544, "uuid": "d1ab4939-809e-42ba-bf23-69da012a7f71", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173544, "uuid": "0dad909f-e747-40a0-8296-56f228a28628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173544, "uuid": "d87d4793-cc15-424e-bde6-c660f7367610", "value": "0d752c298c3fc1939a93062283c2a49805996225e541c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23da766-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124419, "uuid": "9d950a57-6743-4a9a-81b4-1b9d0c574143", "comment": "Malware payload (AgentTesla)", "value": "4979580eff32c54789e509e9a85e4c6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124419, "uuid": "53605a0e-278d-4399-985a-a0be22224f95", "comment": "Malware payload (AgentTesla)", "value": "0e82c2e8a06d1d835549bd871253f3f51ce5ad25876014d765684f1016b1e801", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124419, "uuid": "ed79e965-e59b-496e-b099-bf54fd62d16f", "comment": "Malware payload (AgentTesla)", "value": "4d8bf00fb4177c7874ea8383a03ceaed42276599", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124419, "uuid": "6df45db1-9999-487e-9ce3-23db23027e31", "comment": "Malware payload (AgentTesla)", "value": "2566afe99ffb3781863f22b5391c87c10c95319582be955661eb060ebb3c83eaa498ef7785401a67e6ae4420ac1d15b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124419, "uuid": "eb5a50a5-df03-4ce4-8fe8-6594f1b6adba", "value": "T1CF151826E77B645AEF19A5E88E1F847238C6DDC0F1B5C488A7E76C0385C23214D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124419, "uuid": "6272309c-f62b-4d7c-8fd7-a8b31eaa1733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124419, "uuid": "cebf315c-dbb5-4461-87c9-fc67f51b2c2e", "value": "24576:pOgul2RKPHDWn/OkYCvT4ORs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOS:nudPHa2d04ORs6CE3jLbO9Rs6CE3jLbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124419, "uuid": "fe44d2d2-3374-448c-a39c-65036b83bbd6", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124419, "uuid": "5f899561-117f-4737-92e3-09767d033016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124419, "uuid": "4d4d03a4-72e6-4932-ab69-4863db201e93", "value": "USD20,000 REVISED DHL STATEMENT.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e7ce0d-32e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691168817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168817, "uuid": "20238863-ad2b-4673-af7d-c22ed8b04ade", "comment": "Malware payload (RedLineStealer)", "value": "bf181b18b0c88b985fdb1216cdabb916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168817, "uuid": "5c204980-126a-41da-a66f-ecb5ab660680", "comment": "Malware payload (RedLineStealer)", "value": "0eb8836fbbec229856e5b8ec0703cf55b38c2c94fd1719b994fa23cc8a1b7ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168817, "uuid": "1e761ed6-0ac4-4346-a9a6-b5bb469fd556", "comment": "Malware payload (RedLineStealer)", "value": "507893fd2085d14cad1c25dd4ab9ea184eb35185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168817, "uuid": "b7ac61cb-1707-49fe-a7bf-5dfc7d1a10ec", "comment": "Malware payload (RedLineStealer)", "value": "d7f2590630a9f49dcdc8509f6ba76b014a524955f6ece219d1955801477f9233a809181b895a970b5f9137da4dc6955f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168817, "uuid": "d0227852-b995-48f5-86e3-6f4abea0d6e0", "value": "T180848D0352A17950E5664B369E2EC6E8371EFD91CF15BF9A2318FE2F19B01A1C673702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168817, "uuid": "49ed78bb-95f5-42ce-beaa-0da1569e2d9f", "value": "e9d58d04128ce66edda6debd8a6afcde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168817, "uuid": "739f527e-aa9e-4afd-90a2-39216352a855", "value": "3072:0Xovi4Ff6BI7wO0prGg9mVUUiR+opBCNjCKid2fOrbUqo0w7YuGG8PWLhc0j3v0e:ifsvMOeZ8i3tqOPo0wcLVepj3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691168817, "uuid": "0fe60506-ae2c-4626-931e-0b2f58b3835d", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691168817, "uuid": "d8ff1817-2461-4cb0-8655-a287443bb2e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168817, "uuid": "e2bbef97-3475-4250-a5e3-d6d6113fc417", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e8640e-3291-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691131240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691131240, "uuid": "bf3a033f-cbcb-4202-b6dd-930dde3511e0", "comment": "Malware payload (Amadey)", "value": "b49b3f2bee940d41ed2857555a10d1d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691131240, "uuid": "7d69d646-6e37-43a3-b8f8-013bc8dc9eed", "comment": "Malware payload (Amadey)", "value": "0eea69e7a0c28e3400e60ee8474727ecb7c98cd84a0a43f87b445a2180804f27", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691131240, "uuid": "2d6ad13e-a77d-4276-8e19-3c86b2d082bc", "comment": "Malware payload (Amadey)", "value": "3f148d9936f815b6fa3fe7cfff1258f93c2f0bfa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691131240, "uuid": "ee5cddc0-ed5e-4ad1-8eb7-1c489a6de55b", "comment": "Malware payload (Amadey)", "value": "15dfde650bd92becf1976d66162d55763ff44e6310451a025ae688944a4dc08608ec8ce6f4911acee3dee705460c54ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691131240, "uuid": "e8830ac5-3a99-4d8e-8cd4-5fe3afc7c981", "value": "T19AC41213B9E89076D8F647700CFA03A70B397D668D74525B2A85AD1E0C73BC0B631B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691131240, "uuid": "38581396-fcb8-43cf-a6eb-a4d57418e361", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691131240, "uuid": "7d8a49aa-9f67-4fca-84dd-2fcf33af9e5e", "value": "12288:dMrvy90vIwVChSljoYSGWzDJ2Ru696UNiTX27IbU:+ygvoYSGWzDC9rNYbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691131240, "uuid": "33bd3439-6362-4eeb-8838-b6a7bdeb2118", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691131240, "uuid": "ed110ffa-a513-4af6-9a28-e6f9894687fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691131240, "uuid": "8ff7e47c-554f-4e4e-9f72-d3da482e14b4", "value": "b49b3f2bee940d41ed2857555a10d1d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219d7c70-32e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691167877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167877, "uuid": "a55667a7-ceaf-47cc-a00c-a9d07d4660b7", "comment": "Malware payload (Loki)", "value": "934834b62d84d90afd7bb755aa12ad81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167877, "uuid": "1e484194-15ec-449a-8f86-d048c5b33860", "comment": "Malware payload (Loki)", "value": "0fc20cce6837bf4c422edb29a17a139d282a036d9cb68abb1b8290a694dc8026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167877, "uuid": "74e4f3eb-258e-4293-a9aa-8b7796a6c09e", "comment": "Malware payload (Loki)", "value": "9fc38765f8456f16282ad2a491aebe001e6ae3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167877, "uuid": "7dfc4385-81a2-49a0-8f21-ad6012c3ffe7", "comment": "Malware payload (Loki)", "value": "b19dbb544a73991127a99ecd9f5f955250162cb6421741f344c0d2df3b4489f7cbdbc62e04893d6566e4d9edfcfb7f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167877, "uuid": "44343619-0568-442d-bd2e-0cf66f1502e5", "value": "T1EEB4225925D99F3AF83C87FD78F1E13013B1A95A6822C748ACDD92F52933B860485E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167877, "uuid": "42141649-67ed-41c0-829b-424af2d9f711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167877, "uuid": "247b667c-4fee-48bf-955a-870bc4b6fa1e", "value": "12288:a+1WYQvjOKEmkEOKJ9Gk1a1iskRZ09Eneq:a+1kODm/E1n8qOeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691167877, "uuid": "d1229b6a-c1ff-4da7-872b-635c5a6c60f6", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691167877, "uuid": "a4f4f191-e323-4fac-a70d-c690a57a79bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167877, "uuid": "a9a6e272-2981-4d35-8dcb-59b583135753", "value": "NEW_HENGTONG_ORDER_TP030823HGC.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436a35e5-32cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691156767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156767, "uuid": "71038251-aceb-4c9a-b620-bebec224a12b", "comment": "Malware payload (Amadey)", "value": "13ff42fbd37ef7f1c7f75b7ee1f334e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156767, "uuid": "b447e224-a65f-458c-b35e-f5d63d9c471b", "comment": "Malware payload (Amadey)", "value": "108bb90a0f8789575433d2413e6f92cc46459ec1d81695b9ff244ee74361053a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156767, "uuid": "28e90a9f-f967-46ca-9e56-2ba06a7387d0", "comment": "Malware payload (Amadey)", "value": "415aa0a8b0bf8ac566799ea339457c967424f124", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691156767, "uuid": "38b15a1a-9598-4e77-9acd-6ef2224db7bc", "comment": "Malware payload (Amadey)", "value": "2d3e01b03b5f62fd7cd5a1ccfcbac4ef5d699fc717b6f7a7af071104baac0fcf2c3f0e4918618e1b056af8144943f442", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691156767, "uuid": "5e1e0a93-dfbf-4a51-9794-6ce9ed71723e", "value": "T18203F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691156767, "uuid": "bae43fc2-28ca-450b-951b-26db00899766", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691156767, "uuid": "2b1737dd-82e9-4466-94bd-e10a70acbf48", "value": 40474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691156767, "uuid": "1d4dfaf2-62fe-4165-86dd-1c7f652de8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691156767, "uuid": "eead5ae2-4e1d-4939-8a0d-dbf7961e5696", "value": "13ff42fbd37ef7f1c7f75b7ee1f334e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cfcb71-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124203, "uuid": "a3c067f7-dc8e-4f05-908e-3f8dc5280034", "comment": "Malware payload", "value": "7c2a9d58e144b4000c87b50529b0cde8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124203, "uuid": "f329b8ea-e24d-416e-b90e-19e76fb95315", "comment": "Malware payload", "value": "10bbf0e704485e52fea9ba5ceaf19489e04afd0736ff63ced71c25c3b7ae85ad", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124203, "uuid": "01c78419-f42f-4601-952f-e33b6b5429ba", "comment": "Malware payload", "value": "b6862254d1262ecadb08762f12a1079bd7f03c7d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124203, "uuid": "3b6586cd-a130-4fd3-a547-359f8c781794", "comment": "Malware payload", "value": "067cbf904c88b39e0eafdea2ba1eea18b2eb9d3ce97bf14924d4b38d7cad6fcc72fc2be10c329923f2d577dbb033ae26", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124203, "uuid": "0b3167c1-c0bb-4749-abc3-a7af10bda2a1", "value": "T1F9D4121072C88E8DE4426BF868B6368F114DFE7376D4A1C36A84B70A84B4E77D5275E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124203, "uuid": "03ca6470-85eb-48fc-a21a-a9287f270f36", "value": "12288:9ZoiUWQmmme6v3QLQuE6o8V6qUu9VneseTmC7aviAIKRAx4eVR3T9969:8WQmmav30xxeu9V6b7xEAeeVj969", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124203, "uuid": "8e956303-007c-463d-bb8c-491cfa39d542", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124203, "uuid": "b76c8974-6ef9-4f9d-96c2-113786e3567e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124203, "uuid": "c1e7fbe4-4336-431a-a213-ad20b85aa9ac", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4622f7-3314-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691187389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187389, "uuid": "c8af6a68-10d1-4f5d-87b0-fa4d1db88913", "comment": "Malware payload (RedLineStealer)", "value": "5f23f6acdfc7d00a2eaadafe4a69c8a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187389, "uuid": "dc40698e-7ebc-4f2f-b451-771c22ad93fb", "comment": "Malware payload (RedLineStealer)", "value": "10c14c8b65fdeb72ea10c327213f511d0a5de9b456d2a9c937c53964dbc677d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187389, "uuid": "3ced4c83-979b-4820-96b3-a23bbbc34f51", "comment": "Malware payload (RedLineStealer)", "value": "8d26df7b4eb3a269704110a1dd3ae4943ed5deed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187389, "uuid": "ec8d46e7-c551-423e-98b9-63a015abb440", "comment": "Malware payload (RedLineStealer)", "value": "2b676413e7e436be5c7786b52ae9bcf2c5e0eb8069783c490c8c7edec31e0a92e668458bba51e65c485cff6177f94b17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187389, "uuid": "949e0f11-4e79-4cb5-8de2-8438264a781b", "value": "T1CBE4121267D49033DEA513B059F703D30B3ABCA19976C36B23868E1F19B2694E57633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187389, "uuid": "74aaaf45-2cee-4112-b300-2d5a1b9402f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187389, "uuid": "3675f661-103b-42f1-b629-1f1095af6910", "value": "12288:iMrsy90Ap8h1euY0nRP149zP8r3c9fE3SFKNU0Gefpgp6lP4B:Ky58HP1WkI983SFoUVef81B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691187389, "uuid": "db2cd801-ea9d-442c-a13a-b0fb1e6047cf", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691187389, "uuid": "7910d9da-d463-4cff-a3db-05b3168cfcee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187389, "uuid": "79514741-0e4d-4d0c-be56-133208b14a34", "value": "5f23f6acdfc7d00a2eaadafe4a69c8a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3572eff0-32d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691159321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691159321, "uuid": "52ad9283-5f7f-4e02-8d77-a5396f987705", "comment": "Malware payload (Amadey)", "value": "7d025b981b305d0c7cf55d38e3418054", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691159321, "uuid": "b279c522-488d-4887-a3a8-9085bebaeec0", "comment": "Malware payload (Amadey)", "value": "10c5faf1316a4caf9edafd41c9c5a87a346c3cceb81de7ca106eee22be3069b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691159321, "uuid": "e1e64223-ccdf-4272-a8a8-108550beb36d", "comment": "Malware payload (Amadey)", "value": "80c86c019f8d18efc938c07bf952f4fd89705c71", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691159321, "uuid": "0a76f1de-8dbd-41ab-a293-f5f11f081e98", "comment": "Malware payload (Amadey)", "value": "b121f20524facc1f0375d1df753defa2a3bd639dacd577aabf479216bb74e4d8314b39c38d944d8ff1151c8cfcb30eda", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691159321, "uuid": "ef3cb167-6038-4bb1-bee9-d5e2b30421e6", "value": "T1E0B4DF1412CC056D9540EBEC6E749BF69C5BFD634752DFADC2A9326F880318BAE0607E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691159321, "uuid": "88ccf092-8da7-46fa-b6a5-e352f495f927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691159321, "uuid": "fef63fd5-c97e-477a-bfc8-fff10ac18490", "value": "12288:0QGSHbpuOQUgZ89fOThAtzislufo+hcdG2YGuV5:ZT7kThglKcRYGuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691159321, "uuid": "2e6029bb-2e78-47b7-8a37-65a7fed02786", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691159321, "uuid": "0849ad16-8725-4b92-b74c-5b7627e970f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691159321, "uuid": "234509dc-1c94-4016-9c18-6c9aa507ae1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb54256-32d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160969, "uuid": "58465ad2-4aa9-4844-9c44-bc100eee108a", "comment": "Malware payload (Amadey)", "value": "ab3fcbe684f923a4ab97c9630af28088", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160969, "uuid": "522ec725-68e5-4b1c-a762-79392e717455", "comment": "Malware payload (Amadey)", "value": "1143f8f747413c824ed7e83371a264f88fc97958c80e6d16dc597905bef81a52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160969, "uuid": "a86df5a0-8aec-4a67-a091-a12db14ff834", "comment": "Malware payload (Amadey)", "value": "6d6b76a555221329adb11f3a0ff4a1da9f1aa087", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160969, "uuid": "9a89fd04-dba9-4445-95e0-6c013f119563", "comment": "Malware payload (Amadey)", "value": "99a1f94cb3b606d6f90ade7b8f11fe22cc320a299a70a0af70136011d3f33288cb2320fc43620cd67bef56f1216a0b35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160969, "uuid": "f9c25832-e7aa-4b3b-a53a-4f143d38f128", "value": "T1BFC41222B6F95036E8F6177029FA46831F36BC729C38536B3389955F1DB2284987533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160969, "uuid": "71b4c47c-ec42-4846-8d5b-dcb44a9945c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160969, "uuid": "f912d7e8-2cbd-48cb-8e3c-4c271cd0f5a7", "value": "12288:bMrsy90RyxNcR0hSZN6z1CQotcb0+SsSK/rqdlRqLC:byTri0hSz6z7ot676lRqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160969, "uuid": "a5f22178-7b81-41fc-86fc-78313cf50f2a", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160969, "uuid": "3edc29d0-cf6d-4c4a-99af-778c188bf83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160969, "uuid": "9176343d-6c39-4b02-b0e8-fd612d6089cf", "value": "ab3fcbe684f923a4ab97c9630af28088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3694493-32d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691161277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161277, "uuid": "ff9f09f7-d5ec-44fa-9cb9-7a8d80e94274", "comment": "Malware payload (Amadey)", "value": "332fe1546f87c32222aee61c5a21af58", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161277, "uuid": "176346e0-34ba-471c-a1be-cf6ed89ecf8e", "comment": "Malware payload (Amadey)", "value": "11b89de9c094c734e1e099292a2567d503510b102b4861b38608662c54372a99", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161277, "uuid": "b5031586-f277-4472-aa2d-968c01086887", "comment": "Malware payload (Amadey)", "value": "0385fe1becb67f54e4240a5f9d160fc9e4e45ba4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161277, "uuid": "9f08de07-dd90-4c5e-86d4-082ed9870837", "comment": "Malware payload (Amadey)", "value": "b78ef2e3500b7dc766904a13b6e7af19b5727a5beb72246a1d63c10bc1e594d4de7f1153a8f862c221181a668f7a9530", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161277, "uuid": "08a6df59-7ab5-495e-a4f6-77a630304375", "value": "T133740112A6F85032D8B527B018FB06831F377DA5A974877B37829C4E0D73690AA7173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161277, "uuid": "afcc9249-a0c2-476d-894c-64ca0988acd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161277, "uuid": "54e1f73d-bb68-41f9-b7ff-73bdca0449a5", "value": "6144:Kcy+bnr+op0yN90QEs3mVnr5PR8ztdgR5DEqmkGo0yqDKCaHX0ys2PYs:8Mr0y90KWVdZe+UqhGaqeHExcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691161277, "uuid": "e50ceec7-2f16-4336-add7-54fe2577c851", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691161277, "uuid": "107d651e-935b-4d40-b450-820508510ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161277, "uuid": "b20bbc2a-f5ac-4658-8147-d79a2026bbc7", "value": "332fe1546f87c32222aee61c5a21af58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7d3486-32e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691167872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167872, "uuid": "ab3e2044-6c7d-40ae-80dc-9ee832cd8f17", "comment": "Malware payload (AgentTesla)", "value": "4fc4eccb4f51e43c42fcaca2a9ff589e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167872, "uuid": "96334a40-94fb-4dad-aa80-5ec5fd93d1d2", "comment": "Malware payload (AgentTesla)", "value": "11bffec4963424aa002f8ede541d0254bae40ece2144ab76ee83e3a43a78f025", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167872, "uuid": "2024994b-2ced-4a2a-9c91-f45fa5592d61", "comment": "Malware payload (AgentTesla)", "value": "a82fa64a9b5650e7ce6545affb54f0b7da58b604", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167872, "uuid": "11b97e1c-bc5d-4cbf-aff3-41adaa88cdc4", "comment": "Malware payload (AgentTesla)", "value": "5de1c48aa5bd95a03b739190557eb7162b5f580529efd41ca2ebe63cb013aff2a8ca3395940382d5f0ef44c3c1ec1ae0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167872, "uuid": "5d80d062-6acd-4e70-959d-cd3ce626ae0a", "value": "T1801512A6272D6B72FC2D93F850938993A7B0AC361550E5153CEEB9F309B1303484B96F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167872, "uuid": "d92250c2-5783-4b70-8b4b-cb79a4dd35fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167872, "uuid": "48533fc6-a3ee-450b-b472-ae0feeef18ec", "value": "12288:C+1VYQvjOJ53a4HWUPYM3Dt9KWZ7XfZhrl7a7XKw8nFhqlEU70GUwsk:C+1jOJ84HWUP39nZ7rrlIKR7Wl70GDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691167872, "uuid": "4288928f-1931-4aeb-a89f-a348c44d305a", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691167872, "uuid": "18f6f06d-1c27-4a43-8fde-d3660aa98217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167872, "uuid": "3da92b4d-ccdb-4233-828e-1e84b5ac3a65", "value": "00020870518_August_2023_IN.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bac2e2c-32a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1691141426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141426, "uuid": "4c8cb7bd-5d57-4291-ad11-28db4caa2f8a", "comment": "Malware payload (SystemBC)", "value": "48514490face0a58cd5ea063e7de28e0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141426, "uuid": "4352703a-e62a-4935-9911-288a4da534a7", "comment": "Malware payload (SystemBC)", "value": "11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141426, "uuid": "fc93ffbd-3c35-425d-83c9-6892e45fbd5e", "comment": "Malware payload (SystemBC)", "value": "ca52f90d5d6995f68bde1daf3900b3854431a3dd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141426, "uuid": "e10f02a3-ee94-4e0d-a97e-f98ed770f422", "comment": "Malware payload (SystemBC)", "value": "39b2b7c18dfe468a4541a47cfa34c33fc2217b6e0c07107b6635b8df20d60a588cd7e8b91dad32e4213add168fd61230", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141426, "uuid": "da97a85e-1851-4f65-a5ab-196c1bdf3c53", "value": "T1C36623EE6158335CC01AC4385433FD05B2B1561E06F9D9EE76EFBBC07BAA820D946B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141426, "uuid": "3a205b8c-7e9e-4ba0-bb2a-6344bf8485f2", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141426, "uuid": "3f6e6a3a-d173-48a5-9b65-5b2f9177e8bc", "value": "196608:NZwmQb62Pk1t+w69MCaSuxu70XSUAFTNknuFkJ:TW62Pk1t+JJuI70CbHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691141426, "uuid": "81016c6c-24a0-4876-8ced-f80c96cea83a", "value": 6677504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691141426, "uuid": "31876b93-c5e1-450e-ac28-aa6b567be356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141426, "uuid": "f1cc2077-501f-4949-8284-baca732dc55f", "value": "48514490face0a58cd5ea063e7de28e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96257b95-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178381, "uuid": "f3ea8f8e-7772-4f14-a639-32dc754b135f", "comment": "Malware payload (RedLineStealer)", "value": "ce3b7f091032ed9f2e3bf0567e08d3a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178381, "uuid": "24b7a982-41ba-4a8f-9d24-a368266fa270", "comment": "Malware payload (RedLineStealer)", "value": "1460f49909968eb55a6703571da63a0563ddc1987d6730cb7687573de1466f4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178381, "uuid": "beecf36c-8d91-4b08-9a02-7d91db24bd97", "comment": "Malware payload (RedLineStealer)", "value": "f7963ac7afb618dbbb1a50efb450f730067dceb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178381, "uuid": "459e7727-87b6-4667-b02c-6d30c1d38dea", "comment": "Malware payload (RedLineStealer)", "value": "4ea02d92c66f706397032825934a716393508fbcfffcd0a0a6b79e7dd1685c9a9bb0e36d5e870626731d3f1d45ca6e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178381, "uuid": "67dd77a7-7dcb-492b-8586-04e7b1367137", "value": "T11BC41212E7D89533E9B523700CF603C30A7A7C645EB847AE2745E99A0C72AC4697737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178381, "uuid": "a83d747a-1554-4470-9e48-8edb8767836a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178381, "uuid": "586e6955-108b-415b-a0b7-3383897ae0c9", "value": "12288:YMrky90Tt3NWzOdQBDgfApdrUQ5MkkZ1vufVZKeN2M2K1:MyEdWCKBDgYTrVMkkZNueeNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178381, "uuid": "3cf5a93d-34cc-4e0b-b748-79e5e4efcf64", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178381, "uuid": "04f9d078-67db-4ea5-9407-0debe41f30c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178381, "uuid": "dc2f8c53-963a-46d1-8022-984d08529901", "value": "1460f49909968eb55a6703571da63a0563ddc1987d673.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45b8d44-328e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130006, "uuid": "33ecf828-d60d-4f65-9098-fa3cd2b4680b", "comment": "Malware payload (AgentTesla)", "value": "050b54351539fe668efd7934efe7fa57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130006, "uuid": "4757d6f2-4d4f-4b89-a16d-9aec642088eb", "comment": "Malware payload (AgentTesla)", "value": "14640bf8b63e9247d9a4eaddea9b09d74151b78a14d6d00ef142cbb1c13ed850", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130006, "uuid": "616d407b-ff93-4472-93d7-6927923d1b59", "comment": "Malware payload (AgentTesla)", "value": "ea7405ea489c68bdcd3a864b42d08fee9c0b3af6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130006, "uuid": "25fc9248-ad8f-48f4-ab83-a045a7b2160d", "comment": "Malware payload (AgentTesla)", "value": "9b82a6542c55d17153cafe28dfc0ec0eb53f6109c5f1ebb2cfd599cf12b7bd567cc9c57f953fbbbecc62f66349f4fb0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130006, "uuid": "42a8304c-0872-4948-b8d8-f35dc6d5c7d9", "value": "T13C353364D72DDC0D22B8C9169CC724E7EA44698A7CDFFBB7409EDE28379315806E8C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130006, "uuid": "464dec8c-40e7-4853-93bc-93a1ae93e3be", "value": "24576:+I5E4MQc10GDb50M4Kt7XSVbboeCUAcpG2iI0RvJf9fqfDQ/tez:xEh02t4Nx0eCJcpG2QRvvfsU/tez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130006, "uuid": "f89de9d2-bd1c-4e7b-b67b-dcae52fc0193", "value": 1142096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130006, "uuid": "904b9105-69b5-4c27-9ac1-f3019d40c83e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130006, "uuid": "7dfec2cf-0882-40c6-a74c-a3514eef9f10", "value": "QUOTATION_AUG7FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ca3edd-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173246, "uuid": "91e402eb-a937-45ad-8268-5cb41c39cff0", "comment": "Malware payload (Amadey)", "value": "b72b9fd69eb86747553ae9197543313c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173246, "uuid": "d8b7a922-a8f8-4242-a811-243118d86523", "comment": "Malware payload (Amadey)", "value": "14e26cbc34808259239b69abbcb74714672d8e3564b109eba0b09ae8c27f63eb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173246, "uuid": "d59890eb-8379-40fe-9dd0-e1c324a9f0b5", "comment": "Malware payload (Amadey)", "value": "0fbcbcc3553f0bc2fd3646853101241d5ec81e4c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173246, "uuid": "77a0e8ea-a66c-46af-93ad-e068e29e1e00", "comment": "Malware payload (Amadey)", "value": "6a2161d8cd619a273a79fb32c3ee50c5146d154cf25919e9080ef9e1239a32c252a195c4afa7e83298e0c6f056b17b48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173246, "uuid": "6d246168-6665-4d41-bd07-74b8dcdb6b66", "value": "T17CC41253B6C98473D9F147B02DF602931F367CB25D34536B3784AA1A1CB2A88A835B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173246, "uuid": "8aa09fff-30ab-40dc-8d97-d17191948bd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173246, "uuid": "cfce2bdd-2ad0-4523-9e5a-e81c773c887f", "value": "6144:KFy+bnr+6p0yN90QE572lQkyFzVfssULNp4CfRzXkqG2Jm9p80qPK6X7MfTUsCZT:vMrGy90IQ9Fx6Zd5Q/yY3xidvpIoNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173246, "uuid": "74bdc5c8-d222-4485-89cb-f43c237d38a2", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173246, "uuid": "03a3b6e0-8c5c-4a41-b73a-91b0d4e1f9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173246, "uuid": "e7587940-2f10-4b50-aa32-567cb81d1bba", "value": "b72b9fd69eb86747553ae9197543313c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974d83ba-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178383, "uuid": "52081a53-6f2a-4618-b598-ae61c11c26a5", "comment": "Malware payload (RedLineStealer)", "value": "7c708f2a1ab5788fa071979d88d41b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178383, "uuid": "f1280444-116f-4d38-bbd2-41cc35f1e5ae", "comment": "Malware payload (RedLineStealer)", "value": "15b9f61580bdbbd4e02f31a1d90698c67b82bf2d9df4decda44736367854859e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178383, "uuid": "9dc5e8f7-be74-42ad-bdcc-59a7705006b2", "comment": "Malware payload (RedLineStealer)", "value": "bfe1b5fdb84b3a690f763c986e6c30a2f8b3c29a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178383, "uuid": "56d9441a-715f-4754-a422-e4ccf93ed32d", "comment": "Malware payload (RedLineStealer)", "value": "1bdbf69a8e8765d1edcafff881568c5406f001b38ef0d0a3ae7a7b68e3ef6af463618c8cb96516e753fbe3bc8b9f2eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178383, "uuid": "a4ffbb6b-d8d0-4102-90eb-5b195dae40fb", "value": "T1D8C41203ABD89037EAB52BB068F303830F36BDA18E754A6B2395D95B4CB31909575737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178383, "uuid": "8c8c3c1d-3528-4866-9c7a-62e2abb0aee1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178383, "uuid": "e4e8201f-d342-49d1-a984-49cb713dd145", "value": "12288:vMrWy90Bqf3XapvYwlMK7N1kN6bkT7Wa/RijURNF:1yg83LgjN1KT/DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178383, "uuid": "d50a5148-cd25-4d63-bf3f-9f256a34e69b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178383, "uuid": "1d762bfb-f757-4441-bd75-9bca86951ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178383, "uuid": "fb939be4-d05c-42e9-93c6-7cecb779f736", "value": "15b9f61580bdbbd4e02f31a1d90698c67b82bf2d9df4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7d4302-32c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691153722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153722, "uuid": "356252bc-c54a-4619-b359-5f311e75cf2c", "comment": "Malware payload (AgentTesla)", "value": "87e4e76d8e2df4e2ef4311fb94a6ab5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153722, "uuid": "c9e1b1e8-83b1-4062-8262-19043e5ae916", "comment": "Malware payload (AgentTesla)", "value": "16bac81cbed6b7de8ceb6634ea6c5777d2e2f5b255c781a68c47398bb7025ae0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153722, "uuid": "ff803b7f-db67-400a-a67e-c25ca57561a9", "comment": "Malware payload (AgentTesla)", "value": "1c8e4db718e20d4beaca8693b3035b31f512e67b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153722, "uuid": "1af740dc-b144-44eb-809f-ecb553454d2e", "comment": "Malware payload (AgentTesla)", "value": "fdd3f28626f25d9f54f757351d16724c18d55830b3cb79e6f6c59716c5ffda16ba5f0a4ab476a2d38fd00c8404c28a83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153722, "uuid": "fa625136-270c-42f7-8fc7-4e0dd61cddee", "value": "T166A52913B9479AA2E14557B7C2F715244368EBA13323EE0B754B23A70D433AB4B48F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153722, "uuid": "0abcbfad-5836-4328-ab87-4fdbc21bdd78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153722, "uuid": "a1cec432-3941-4207-812f-0c76fc4610cb", "value": "49152:12IaSCoAu/ZjhTtnBGl8qCkvoPqPxE34b:fCoAsheskvoSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153722, "uuid": "b4f2c105-e6ba-4465-ae48-29c67953089b", "value": 2069912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153722, "uuid": "14f14e5a-2b12-430a-b96a-f3b78e9557d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153722, "uuid": "1c739a30-cf57-4243-84e1-8f04e9cd7376", "value": "IMG-02873009pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79dd59d-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173256, "uuid": "66a98d92-9ffc-4dc2-a82c-5806c13045f1", "comment": "Malware payload (Amadey)", "value": "a4e050af20afd31aead2dda52a89a017", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173256, "uuid": "a1459049-778c-49e5-84da-c95e64112410", "comment": "Malware payload (Amadey)", "value": "17a8b76324176415e603c25291d32db11098bc4f8b5d4e323f79b60bbae5533a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173256, "uuid": "17f13658-fab2-4427-bde8-c5c01a158860", "comment": "Malware payload (Amadey)", "value": "7331c59e5da58ccf5bbff3d3bc72f1b67bdc52d0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173256, "uuid": "6cace544-5cfd-4a95-a064-f13fe6cb10b0", "comment": "Malware payload (Amadey)", "value": "b5998f23a23bcf321d52aa53f10ff79b7c397ab2a11304d2a38bc0b59de8d2ed51521b9f97d778170aec60098948ca6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173256, "uuid": "7e31ee3c-1620-4ea1-a709-101abb9904d4", "value": "T1B2C40262EBD88132E9F513B028FA02D30F397D919D3493AB1785A86F0C736D5A43576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173256, "uuid": "f8480138-330f-42da-96ea-e4902612630f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173256, "uuid": "aa5b42eb-50f6-4c75-a426-d19d8a84d24b", "value": "12288:BMr+y90Ig5mwayEzwnjkZQUReBkBVpZtDVeUgCBEkNyf89:TyDkmNp8gQURakBV9wULZ4f89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173256, "uuid": "af0fffe7-2c9f-4e01-9a02-34996b7c0d2b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173256, "uuid": "37a0d9d2-4319-47d9-82a0-208436f736f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173256, "uuid": "3822ff4b-3f66-4247-9e1e-d5d687a7cdee", "value": "17a8b76324176415e603c25291d32db11098bc4f8b5d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a867450-327b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691121641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121641, "uuid": "445b06b1-d081-49fa-b93f-d704ecb67d5e", "comment": "Malware payload (Formbook)", "value": "d1c67a8d11b99696527984f91ce9571f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121641, "uuid": "dfa238be-3219-4727-999f-b0afd8313368", "comment": "Malware payload (Formbook)", "value": "17da5b241a7c1a77d644c46063b11af84dbf96b2986e4c4c0b9b56c1689ae524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121641, "uuid": "317a8c77-b06d-43bc-9baa-d0e5aee1e6e7", "comment": "Malware payload (Formbook)", "value": "2b4d18bbc6fc916926b12d7c94a573bc88a8709a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121641, "uuid": "421c348c-b03a-4435-89e1-7f177c5802b5", "comment": "Malware payload (Formbook)", "value": "05447510b951548879337de26793d48e90f2f4f30af2ab1b3ba5fd16aa1e69007211eebbfadedae5f757d8a22e7f71d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121641, "uuid": "68fb5c9c-1ba5-4913-9903-f1c33e95689e", "value": "T19AD4121D25E5AF2AF83E87FD68E2FC710BF96C295822E718ADE951E12463F480150F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121641, "uuid": "1d247190-e9e3-4ad6-8a64-1cf43258d9f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121641, "uuid": "c196473c-8d86-4391-b12b-e378eab742aa", "value": "12288:Q+1vYQvjOXjjpjADB11g/3EBBx8h8aGl1p/7veXuVwZK7FTNic:Q+11OXdUBU3Thelr/bjVwZKac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121641, "uuid": "f66e0877-1f96-440a-9a6c-4967dbc7affd", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121641, "uuid": "d475c834-41c7-4f1a-94bf-af4ade0bab0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121641, "uuid": "b3820aa6-c121-4a9a-8aaf-15f742294adc", "value": "d1c67a8d11b99696527984f91ce9571f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53957e3e-3275-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691118998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118998, "uuid": "cea0e0a4-9137-4266-bd98-3601b5cb896d", "comment": "Malware payload (Amadey)", "value": "9040edbe1476a9ac539cc00e93fc4cf0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118998, "uuid": "23f92ed0-ec27-47c0-a4d6-e130c50e3d88", "comment": "Malware payload (Amadey)", "value": "17ea80309215e413b8f48d0eb4845e15b32bb796e42ea98551a100079727e5bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118998, "uuid": "6582720d-31af-4ce8-b900-ee596ae13ba2", "comment": "Malware payload (Amadey)", "value": "918fd1a4f5c7fadd6208d9652ac7c782d3e57bd4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118998, "uuid": "68261b5c-82db-49be-b611-c86d3c042677", "comment": "Malware payload (Amadey)", "value": "2b830ce7aa27630f222d91900880aeb89219eac46efee25252ac54365fffaeb3b0ac336075228eaa46ba42f2b812b0ea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118998, "uuid": "663953f9-7108-4799-bde6-a2c64f74773f", "value": "T1A0B41213ABEC50B3D8B52B7058FB02430A367DA14D38D77A27469A4F1CB2690BE71736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118998, "uuid": "3e06ae76-cb27-4ae3-ae12-1ae0b1a782b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118998, "uuid": "f8e57a02-e14f-4c15-9a12-8af557e72902", "value": "12288:6Mrvy90dX4niEvRLWpccR6vJbNfA1gBYCm+ESlGA4Q:FyOo35LWpPR6vxNfAuzlE6Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691118998, "uuid": "bbcc2627-a5a6-4d44-8c83-0017332b7a08", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691118998, "uuid": "9bd53558-75c9-411c-809f-bf1e4dede2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118998, "uuid": "171f1bca-0085-422d-bc3f-a7d12763ff46", "value": "9040edbe1476a9ac539cc00e93fc4cf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98a230b-32ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691157395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157395, "uuid": "152760f7-dd05-45a2-9bac-14ee47330539", "comment": "Malware payload", "value": "70e41787a9a80f18bc52643a6b002558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157395, "uuid": "59c6e2a8-5a90-42f1-89ad-d7ba7265c527", "comment": "Malware payload", "value": "188eced85124122e1465031e6536377b4283f00d24fa28626f71138a4dc06cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157395, "uuid": "4bec4705-eb5a-4cdf-b443-c0b019b65c7f", "comment": "Malware payload", "value": "0f817708613038396716235108bc87e02ee97587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157395, "uuid": "ecf96394-d791-4941-a997-9cd2359cae90", "comment": "Malware payload", "value": "65afb7a4ef9fd94941423bf1e9ef1b92f235d7aed2c3a15258ac6442e5087265a1a032329c5250c26e01911f314782a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157395, "uuid": "5a07b630-5efc-4f19-aa0e-4c85011b56fb", "value": "T1DC04110C6A7AC535C1AAF539AB23B15745FD5DFDD18EC8BE0899B1E73231360D223192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157395, "uuid": "636c5e41-8bb0-4fac-84f5-3473426ab651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157395, "uuid": "4bc680eb-be7f-489a-8256-232dea993ca0", "value": "1536:nUZGcx5NVCMoPMVWe9VdQuDI6H1bf/ivbsQzc/uYJcAwju5EoVclN:nU8cx5zHoPMVWe9VdQsH1bfQwQZVjyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691157395, "uuid": "739f2642-5828-4849-b4f2-a76ab4986245", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691157395, "uuid": "d7ed45ff-2406-4a35-843c-e54f53f170d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157395, "uuid": "80c6d5bd-e9b7-44f9-be53-b46b2ebbbfc5", "value": "vt_188eced85124122e1465031e6536377b4283f00d24fa28626f71138a4dc06cfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2559cfd9-3321-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691192794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192794, "uuid": "ef9f4b92-b26a-4ecd-a41c-0dbc731a9d98", "comment": "Malware payload (Amadey)", "value": "757606d8b070ac94462da9ff692b81ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192794, "uuid": "739f2c37-9178-4f62-a247-928d4e06f0c9", "comment": "Malware payload (Amadey)", "value": "189973cb68eecdc34c2ddef088f461f696713a21dfe37ee3b5c1a9e19e36276d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192794, "uuid": "80985182-8545-4c47-af4c-3c53ac5301a0", "comment": "Malware payload (Amadey)", "value": "7fcb692d4c75f2d1baf41eab52d72aa4361b7850", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192794, "uuid": "ec8210cd-6a8f-4fbf-80ed-27f47808c2fe", "comment": "Malware payload (Amadey)", "value": "df0cace63790f7ecd226ee63ec2682f92b22703269cdaa32e45526dc60deac1e5d0cd50845b35f205b61f8103634121d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192794, "uuid": "0aebe817-c6ca-40a2-bd9a-bcf11e727702", "value": "T132C41243A7E94032D8B593B05DF716C70B35BC925938836F339698991CB22E4B97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192794, "uuid": "f6685643-047c-46f3-8535-c6debd8fd257", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192794, "uuid": "0630f5c2-fc65-4f15-bda2-98849c27be50", "value": "12288:ZMrYy90oQLW/Xvmx8zeDu8gt4YTyK6Fp3XBgBYCeOr9pPUI5kpRs5:pydXOxVRgtnmKChKzNDPRmRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691192794, "uuid": "eaa173aa-a970-4bcb-978d-96cbd1963b4e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691192794, "uuid": "81f17988-1b2f-47be-937f-e2e6b1791515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192794, "uuid": "d5ef8fa6-10d2-4fd0-800e-d25e065dfc6e", "value": "757606d8b070ac94462da9ff692b81ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c8729b-32f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691175449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175449, "uuid": "2940ada8-f2ac-407c-bac9-8d1306f3093a", "comment": "Malware payload (Gafgyt)", "value": "576f05a580bcb002e81e9065a999ace7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175449, "uuid": "1adcc02c-63ff-46ba-8292-7b5c1cdf0323", "comment": "Malware payload (Gafgyt)", "value": "18c58f83cf1e51d23eff699bec82fdef08f8a6585f51610bce162c9de25bc549", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175449, "uuid": "1407fe22-3330-4812-ac51-ce4ef48390c0", "comment": "Malware payload (Gafgyt)", "value": "43bb38c1ff1c2d5d260ad6a8c9e0f983e6dc316a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175449, "uuid": "dfd2225f-6cbe-4b32-aeea-9996b3c4377c", "comment": "Malware payload (Gafgyt)", "value": "5466051e5783bcfe9e886faeb003aa9fa095de7ffd34b8a76e5a2e9560456612ba08fdcc262d9e19a5d0b315542a08b5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175449, "uuid": "501eba7d-8b41-41ff-a3bf-f5193dd46aaf", "value": "T1829349275691C67FC48793F62BDBC6A59523B43D0B37620A73D4BDAD2F168C82D98302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175449, "uuid": "bfd84ce5-530d-4b4e-94fb-26f29e3804f9", "value": "1536:E7aIPFobybZnHvyjZlf1hD6AdWZG87Hyr3u5bDWmSolWHrIeMXshl:KabybZnPyj71hD6A2G87HyDu5bDWmZl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175449, "uuid": "8ab7c71e-e0bd-4d20-9e08-2b744b792804", "value": 96080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175449, "uuid": "dea251c8-144d-4b36-b57c-aa5d1d3b7046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175449, "uuid": "4d870d05-df6e-4d5e-b076-c5368f1d979c", "value": "576f05a580bcb002e81e9065a999ace7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63c7804-3261-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691110547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110547, "uuid": "e2f53052-ef9b-4b3a-97e3-32e6e98eaae1", "comment": "Malware payload (Amadey)", "value": "3acc1ec22633ddaee29fa9c9d1cde011", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110547, "uuid": "b160ab01-8a56-4459-9fac-51f2b8b218a9", "comment": "Malware payload (Amadey)", "value": "194e41280579bc938a65581dbe21b858482dbbfbee3822ae7004217561f5f444", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110547, "uuid": "c5820410-875f-42fd-83c9-5e773277bef9", "comment": "Malware payload (Amadey)", "value": "ed1c3a4901204f9ba9cb2664c89cc00bee4ce5d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110547, "uuid": "90b37728-7b22-4022-b53d-b01bf6fa780d", "comment": "Malware payload (Amadey)", "value": "3fc540894c1bcbf2799b204f6f8a659d8a7f7d70436de0bbf3f3cc7e7b866856874fbd98d0d5758954a896fe445a368d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110547, "uuid": "11daee4b-69ce-475b-b31e-ce075f2919c3", "value": "T188C40253E9E850B3D9B1177068F607D30B3ABCB2AC74D61B2A85A98A0C736C4753573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110547, "uuid": "6bfadd1f-f212-4aee-b3f9-30ff034853e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110547, "uuid": "12534884-49a3-420f-83a3-54ca38231e70", "value": "12288:pMrsy90bEu09B8S+Bq/nEyvXCiQZ1YJuCWGO:VyFBQB2nEyPCjGJGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691110547, "uuid": "9e5936f5-2200-4964-bb8d-17ae64ed94f8", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691110547, "uuid": "5f31b99a-5af3-4882-a25c-6e6a23c6fb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110547, "uuid": "8ade428c-eafb-407c-9727-41e1cb4a62f0", "value": "3acc1ec22633ddaee29fa9c9d1cde011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725fbd56-32d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691158564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158564, "uuid": "03d49976-04a3-421c-b002-7c4b5a9d654b", "comment": "Malware payload (Amadey)", "value": "4fc900b33c96e3e3311eae38ecc0044f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158564, "uuid": "3f1c9f73-a962-4990-be42-05abd2720435", "comment": "Malware payload (Amadey)", "value": "1a17a225e94aff284ca39503e1e92c67ffd6964765e6a8cd7925a669e614f584", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158564, "uuid": "7f86f932-5c44-48dc-a777-93b7a38acf4f", "comment": "Malware payload (Amadey)", "value": "034387354c58d065f22527799b63b7b7a1ef77ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158564, "uuid": "c39cc4b9-c213-43fa-b47f-3e6928e259dc", "comment": "Malware payload (Amadey)", "value": "0bec69caec9513e7ab67f1e74a7fec8309c9e7bcd2c06175462489b5730906ddd9fdb4342a7e07bd6f3b4031efa9e51d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158564, "uuid": "98ff011a-55ee-4785-a37d-ddadde2e0d84", "value": "T18603F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158564, "uuid": "80148074-83fe-4942-a85a-c1ba0526e6d3", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691158564, "uuid": "f4ee4d7a-ab2e-444e-9d2a-fe8cd7d643a9", "value": 40242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691158564, "uuid": "65ccec9a-57df-41de-9a8f-3b1b51e08baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158564, "uuid": "e8b873c8-6e74-4e9e-a34c-ccbe07c083d7", "value": "4fc900b33c96e3e3311eae38ecc0044f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d88847-32fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691176558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176558, "uuid": "6ca5b4e4-563a-4f34-8fae-f5370470c8e5", "comment": "Malware payload (Amadey)", "value": "0b580207cbc5216acaee25f65e2ac034", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176558, "uuid": "3012499a-6f04-426c-82ae-2b4831f22c45", "comment": "Malware payload (Amadey)", "value": "1af50d4b11ff6dcf0da9e11831f0d9860bd7b37c89019efd5fe5fa11b426e097", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176558, "uuid": "1de82c5b-3fa5-4ac9-918a-91845269db14", "comment": "Malware payload (Amadey)", "value": "21cba3b37b1b321fece199f5e41ef2a8c217a076", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176558, "uuid": "1059814a-4372-450c-917d-a8448e09d766", "comment": "Malware payload (Amadey)", "value": "990230bd2eae3fbb90956078f839a560684d98e1e58bae65a2d74e625dd7df616e0bef5ab08c4831f130037891a8e23c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176558, "uuid": "aea165aa-da5b-4817-adec-42416c591674", "value": "T100C41241FBE89137DDA1777068F606830F323DA259B852AB17835D4A1C732A0A97773B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176558, "uuid": "a83e087b-1e3c-4c2f-b051-f1ee9f71bfc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176558, "uuid": "1797ba8f-b59c-42f2-945b-bff957016f89", "value": "12288:yMrZy90RclSQlaKfg8Pkw7kX7ZfbySaUASK5cayGDlm6Qee/FxK:vyg+nB71SKmGDlFmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691176558, "uuid": "bf8083ed-1292-4d9b-b785-68e406f54bac", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691176558, "uuid": "c4d52516-117a-455e-8955-25ce1a6fc56a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176558, "uuid": "3eeae2d9-3360-43cf-883e-9142a52d6519", "value": "0b580207cbc5216acaee25f65e2ac034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce364223-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124358, "uuid": "fa8b39c3-4d2f-4fec-883c-2fdbdb98b731", "comment": "Malware payload", "value": "7cb3a6395da258ab05d382b44ec9f05d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124358, "uuid": "d8c7f90f-08d8-40d3-b85c-5290036ceaf1", "comment": "Malware payload", "value": "1b20073ae526d5684b2d517cbc6e3156cce83a7aefa65c6503411ad3d411bae2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124358, "uuid": "f9cdb639-24cd-46d3-9a91-df9ddf663f0f", "comment": "Malware payload", "value": "ce4be6ba9c0848f4808dd11b06dd278a91042e0e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124358, "uuid": "26a16af7-4ec2-412a-851e-8a5e153d7cc9", "comment": "Malware payload", "value": "bfe1078f93b416723ac59ab631adcb134ac82a6b66949466952645eb5e1def297e51306ca1dd5e5e0ac998d6c7cc8c8d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124358, "uuid": "32b3beb5-b803-4a98-9a50-08dc67f7db1a", "value": "T1E3E4232807C6D38778552F736A98E575CD3B628C814BCAC5382EBDD44CE2A9FF1B4588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124358, "uuid": "a729abde-1364-410c-a86b-988a9512a9e8", "value": "12288:SwnW9XCNQWG9+guY8p6yECfv/NECTtYTQ7hGzliV1f3DNUP/6f01UXUvS1E:5uWGQT6yEuoTQ7hGsVJ3Dxf0EUvS1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124358, "uuid": "2261b955-3cec-4fc4-8ac1-f169e5e973a8", "value": 706877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124358, "uuid": "494972e1-9c7f-4092-a763-bbd2cc6a9190", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124358, "uuid": "3d8588dc-eac5-4bd1-a6c8-e5ddae7dc169", "value": "CJSG677286-SGT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1de6871-32fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691176253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176253, "uuid": "00c1ecbe-8eb2-4152-ac65-7784fe202ed6", "comment": "Malware payload (Amadey)", "value": "3f2974cee5e8c950ba61592caf8bc07d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176253, "uuid": "70163eb4-12a0-45c9-94f9-ed5d9b3067fb", "comment": "Malware payload (Amadey)", "value": "1b6cb56208b7b8c6f0858372ee036219e6b0ecd3e6332846240ec4c48b54e7b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176253, "uuid": "9acfbedb-5b9c-4eec-844d-a1adfcc26ee9", "comment": "Malware payload (Amadey)", "value": "720fb85e4830520b668099cedec16ab23b1d575f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176253, "uuid": "622b8c3d-3a0f-4d3f-88cb-b485eb775b96", "comment": "Malware payload (Amadey)", "value": "44de704b89f5af1e58863b9c8daabb731070ab7dd827b02ee30a3abe7e52245d914cc6e29b01e56c7de7f4da6f7ec078", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176253, "uuid": "31d7a9df-5d76-4363-baed-3dfddfdf12dc", "value": "T190C40223B9D890B3C9F61B7058FA03931F35BD618D70872B2755D95E1CB2AC4A93272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176253, "uuid": "986845db-0937-47a2-ac55-cd3be2d9c577", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176253, "uuid": "01f0a305-5008-4deb-a4c9-e482733f9bc7", "value": "12288:3Mrsy90+NL4Du/QfG4dj2V45qy2h4i7iBIW/jkO:vydNEDuWByVZy+4GErIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691176253, "uuid": "db8c9747-73d7-47ce-9baf-de37004568d2", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691176253, "uuid": "40318d3b-546e-4019-be7f-698dc5b91147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176253, "uuid": "d6373e77-b1b0-4d9f-bade-233a9a81a0e2", "value": "3f2974cee5e8c950ba61592caf8bc07d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232ab96e-32e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691168739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168739, "uuid": "e084df30-b08f-453f-906d-3c63756756f3", "comment": "Malware payload (RedLineStealer)", "value": "031915542a4d3f8d524d6f2b5cd9de5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168739, "uuid": "7e3a8156-b1dd-4e21-b038-7d91777157f2", "comment": "Malware payload (RedLineStealer)", "value": "1bceb1eaa4211ed8b85e9bc68e8191dd3523cfd87b488926b19f3c06b94a8c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168739, "uuid": "7ada74b5-ae04-4484-9d6c-ef00a1497a6c", "comment": "Malware payload (RedLineStealer)", "value": "346626e60e7f2024fa9c83af6ee21d9f4271aeee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168739, "uuid": "86cc5f7c-e564-4af0-9352-01b0416796db", "comment": "Malware payload (RedLineStealer)", "value": "878db6cafffca655e333bbc9e4daf58770126981d677b742b04235faa01a3b5df3b098d8d13ade9f6cc522a5c302bf0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168739, "uuid": "7224d0fa-04f4-4f78-be20-c54df7268b36", "value": "T1A903F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168739, "uuid": "eefdbeb1-bdad-4db5-9d74-940f75f38452", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691168739, "uuid": "6202216e-93b7-4971-9eeb-a7f1697c9345", "value": 40186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691168739, "uuid": "41e1e958-51b2-4ac8-b798-1d9675e32b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168739, "uuid": "32262f99-6d13-4920-83c2-16bbeaf752b8", "value": "031915542a4d3f8d524d6f2b5cd9de5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5d0072-3275-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691118991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118991, "uuid": "d95d8854-7f04-4c82-82a7-eaefd3e10a38", "comment": "Malware payload (RedLineStealer)", "value": "e52c5f3fdc5364a935cdcca4c48f700c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118991, "uuid": "38904c0f-b45a-45c8-b939-5567574ab845", "comment": "Malware payload (RedLineStealer)", "value": "1c02d1fa317abf38fc0a886b1624d090f0608a08f7fa316ceea462cb7f33cb4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118991, "uuid": "1ff3ea57-bbd5-41cc-a6f4-da2a135d6018", "comment": "Malware payload (RedLineStealer)", "value": "f08b8d90c354b7b9fbedf1d641924aaab42e8f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118991, "uuid": "3d792f50-a964-43fd-9cae-e07451f516e8", "comment": "Malware payload (RedLineStealer)", "value": "5d27142f8074950a3a21728cc8e870d563a321c407ec8c69dd58f41ff599ad86531bfde4b9738c95433fd84b4ccf62cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118991, "uuid": "4060cca3-7ef7-438b-bbd9-4f513f6fef96", "value": "T1D0B4125293E990B3D8B5577018FA22C31F3A3DA19D6543AB2345AD4F0EB36D0987237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118991, "uuid": "601db766-9aab-4c2e-88b2-fb6660ffb412", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118991, "uuid": "824131b2-0e85-469a-b1b3-f77535b42005", "value": "12288:9Mr7y90oNZ6sdx5+ku+ZiD4sCqOfOJVMA:yyZvV5G+ZTkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691118991, "uuid": "e4748cdd-81f4-4059-90ed-34cd402b7b1f", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691118991, "uuid": "19a39728-3f6b-4994-9800-8c6000097d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118991, "uuid": "f5c12a74-f7ca-4d1e-8743-6f3ea3075d26", "value": "e52c5f3fdc5364a935cdcca4c48f700c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ee06c2-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184685, "uuid": "27a3f8ca-24dd-4c25-8f8c-c1978b1279b9", "comment": "Malware payload (RedLineStealer)", "value": "9885970c453a3d1462e4771060e651a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184685, "uuid": "b3bfad8a-06e6-4e15-9388-8c356eb7fb4b", "comment": "Malware payload (RedLineStealer)", "value": "1cf5dbab6b47fea77b84d650141fe08462c9876b7db454b7e94451dde5aa0d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184685, "uuid": "fd0589ea-52c7-4513-abca-083b068414fd", "comment": "Malware payload (RedLineStealer)", "value": "652b35e7a5d899e735026016e377588fdb9b4b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184685, "uuid": "7e39733a-c5fa-47f7-a098-e0f529e98c43", "comment": "Malware payload (RedLineStealer)", "value": "7893e04d522744f30c16a557ff4754216ffabcb0278d5453ad87d6795addea970de575de40dc562f3278c8af82a17308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184685, "uuid": "3419c6cc-f4e3-41d9-82f1-4e43d5e22132", "value": "T1E8C412529BD4A132DCF4277068F206831B3A3DF06DB8D76B7306AD4A4C736859536B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184685, "uuid": "afe22de4-6a0b-4f9d-a37f-61beb73ecc0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184685, "uuid": "1f78cd7b-42c9-4554-8188-4f22f8191b6a", "value": "12288:VMr0y907JvHy4xpZ/ALMGB1fzlAudNdIKjbTHLijVU3z2r6+WMO:Zyp4xOMKzSKNdL/i4Dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184685, "uuid": "b5b03d6e-ca9b-43b7-a97c-244d8f980168", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184685, "uuid": "1f9cac79-91e4-41c9-a9f6-4ad1b18e8c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184685, "uuid": "9be9fbc2-92d3-47c3-bb10-b31bbfc402e6", "value": "9885970c453a3d1462e4771060e651a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1dd51e-32d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160375, "uuid": "6b366cf7-e3c9-481b-8663-946ba50ac59f", "comment": "Malware payload (Amadey)", "value": "3ad29a5ce82f43a3fde494b156e7b631", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160375, "uuid": "abf7ba32-e052-4d01-b99d-de1788ecbbf5", "comment": "Malware payload (Amadey)", "value": "1d7defe9fe7f0b2b61aa9d7dac0761b0456e9a73163832a4b42c994fd26b53d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160375, "uuid": "c63021d6-e6c3-4e7e-9ba3-e1785ee631f8", "comment": "Malware payload (Amadey)", "value": "0a4a6b54bdcc45c264fc4b522cca5308e717bd15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160375, "uuid": "75cbd403-dc85-4d1e-ab76-8a5bfc467d3e", "comment": "Malware payload (Amadey)", "value": "f2220889dcbce919863883db2e07fad829783cbef8ef1d62a7b865e2650d5e0f53d48791ec59e12b4b7f9485f5ff2bab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160375, "uuid": "e1e4c76f-2ab3-4148-8b8f-9d0e6ccdae97", "value": "T195C41216ABD98137E8B1277448F707870A3ABDE19A38C33B57006C5E4CB2AC49976777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160375, "uuid": "1f1c2f29-8047-4c94-a77d-c9ec3f93bd76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160375, "uuid": "bb3cabf0-bd01-4bbe-9ca7-c03707dbc2d6", "value": "12288:WMrjy90T8erxe/Hjv6C6zgCYCg0LnZq+E9v:hyH/azgYpLnZzE9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160375, "uuid": "28828b18-06ad-42d1-90fc-4729e1d5b888", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160375, "uuid": "0aede77a-28ca-4706-bbbc-21c173a4f45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160375, "uuid": "468d094a-c8c9-4ab6-844a-7199a26e1550", "value": "3ad29a5ce82f43a3fde494b156e7b631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799fd429-32f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691172749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172749, "uuid": "c4dd6f2d-cc63-44d6-ae4a-82e87e0e4b07", "comment": "Malware payload (RedLineStealer)", "value": "5543e97536bfb749cca30b8ba3300fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172749, "uuid": "716ee2ca-9667-4d2f-bd2b-f3b2b43d9bc5", "comment": "Malware payload (RedLineStealer)", "value": "1e7a9cae451b9173a5b50857f76fb1e6b63947bb69bc6f3489caa9ffd8f2fcd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172749, "uuid": "834a2c16-466d-490f-8c83-6180dd8c820f", "comment": "Malware payload (RedLineStealer)", "value": "524c95f5ca7961f57c62251cd77a938206526142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172749, "uuid": "ca2b9abf-d7a5-450a-83b9-08caf7720f1c", "comment": "Malware payload (RedLineStealer)", "value": "88c2eb6731eea5a1683b85a0e91cb673e7d62b862177d9a6932a3b1370378d45e9cca6b229759effda5659c6812a2cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172749, "uuid": "5a35312e-fe48-4cae-9248-9342d0abd8de", "value": "T10CE41266F7E4C163C9F557B16CFA02D30A363CE15938C26B328A64590CF2794AA3573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172749, "uuid": "23732047-f142-4dc6-9b25-ba4ecccf8b46", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172749, "uuid": "3f63c6de-fc46-44ab-87da-f4a488a8abca", "value": "12288:VMrsy90KuQ0oEOp88dsCOeSGfa1wYAFVGOAvYOHL5AHmRYrcQiWj46AML:tyUJM63C/HfmwYG0vY+amRYrcTTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691172749, "uuid": "f2834448-71fb-4ff2-9275-31f442b2bcdd", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691172749, "uuid": "c1aed80e-0092-4d52-b2b8-83b797c38f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172749, "uuid": "0653413d-fd66-4886-bf4f-7fe539fed655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e2bdca-32ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691142792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142792, "uuid": "517f21ae-8730-404a-a8b3-222bc06aa4c0", "comment": "Malware payload", "value": "97a875c03572f8867bdf66a1c426a0ba", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142792, "uuid": "9f8af810-3769-458b-93d6-5f050d65a3f3", "comment": "Malware payload", "value": "20b824fa495cc2807972323b50f51588c361e8e0ec3e92acd6669aaad99960ee", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142792, "uuid": "24b63695-3d15-4d1c-8aee-c70b721ac3b1", "comment": "Malware payload", "value": "572c276c8c7692d7142ef34942bd0e7c499e8290", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142792, "uuid": "7a839978-a519-450f-b364-45c0dfcf16ad", "comment": "Malware payload", "value": "76b9d4ed675f7863331bec7bd4ff242297a31590b688e0ea1d8368987211edaa2a5bb91e4d5c82e2149b61af81d3c378", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142792, "uuid": "07da85f7-eaea-427b-8610-49329669e24d", "value": "T1EE639381AD55B121E353D029A4E2B023771E7907766C3434BAFC86945F56B38C2FCEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142792, "uuid": "ab895701-1aaf-485b-a3f7-d77c687c52e1", "value": "768:7p1XA0V1/eJr7L+SCIYB7/EzfRe1zzlMeUbi8xoz/X2VMHzkNxO:7rXA0Vc+NIYB7dzFTdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691142792, "uuid": "19884b4f-111f-43e0-8bac-cb64991039ad", "value": 73186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691142792, "uuid": "707152ae-f019-4cf8-ab66-0d9712e6de33", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142792, "uuid": "7255d88d-5006-4b67-90eb-afd5c2ad04a7", "value": "download.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8a9a83-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173075, "uuid": "15b6e08b-6c05-40b7-8e8d-324ea11d5185", "comment": "Malware payload (RedLineStealer)", "value": "642e42035de9d6209fbe3a7955bd6404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173075, "uuid": "79d2791b-c204-4dcb-b547-40c4e507f863", "comment": "Malware payload (RedLineStealer)", "value": "20d38ca1e259dcb59d03a18fcfe09627a29452805a9e75fffa0c2d973ca099fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173075, "uuid": "197f3890-075e-4fe4-833e-4154800d9de6", "comment": "Malware payload (RedLineStealer)", "value": "501eb9814ed5361d2164c96b6233a62afb9b2163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173075, "uuid": "b1d9c688-8115-4008-b2c5-497e328c1223", "comment": "Malware payload (RedLineStealer)", "value": "63aa603b1a42f8d70730d1859efcce3cc2f97340e2e0e7c6e0b01d77285bf1e5c8108ff67fb83dcf52b578c06b6cbd70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173075, "uuid": "725650d7-6890-418f-9078-16532ccdd7fa", "value": "T192A4BF0352E17C50E5364B369E2EC6E4261EFD91CF55BFAB2218FE2F09B11A1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173075, "uuid": "7c1d8bd0-a86e-43bb-883f-b82e6b22f320", "value": "e9d58d04128ce66edda6debd8a6afcde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173075, "uuid": "600a9a5a-19ae-4608-bb54-a9147f9e72a8", "value": "6144:FsUFI6zQATC9UJyV0hYk526qoTA8DAXmXZVAngsIaviIi3nhiNzyL2M:FskI6zQ5z2hXTTKOZjsIaKIi3nh6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173075, "uuid": "ae725e46-4faa-41cd-8737-2f49a1227c7f", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173075, "uuid": "f6e59554-13eb-4835-a10e-1d209402f507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173075, "uuid": "0fa4abcd-b37f-4aa4-91f1-57c27a7644ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a101f883-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124712, "uuid": "1a5512ff-30de-4fc6-b378-4a02ffc83aeb", "comment": "Malware payload", "value": "9baaf9ce29d4a8705480e07654de6dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124712, "uuid": "b625919d-9b45-4046-b795-b5a5e4992daf", "comment": "Malware payload", "value": "22181c3078de3df406f094899b2032b946d1472a40d3d0349757d9c759d29ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124712, "uuid": "be05de14-8d44-4da3-abbe-707c764300af", "comment": "Malware payload", "value": "a49162258cc8914658acc063791d200e8045e91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124712, "uuid": "d83529ce-e6c4-4e3f-baaa-853b9e51ac90", "comment": "Malware payload", "value": "70bc1e5c2eb364ae347e74e39f7e47e6792594ff09fb4ca9a7ad964692c18c04670e9e8903ca1295f21d45252d972bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124712, "uuid": "da409c73-ed3b-481c-a943-c8b1fdc85621", "value": "T17A251224727C8927E5691AF588F1EA6807B3258B2DAAF5DC5CC134CE51FBF880601B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124712, "uuid": "0db3c81d-8d3b-4a01-869a-1d6a511d2b5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124712, "uuid": "7a2f4b98-ec88-4cbd-a7b7-450932cd7e90", "value": "24576:fjOMxVhSBEY/VPyn1RLp1+ONydmNWoqeW6tJO6:nCEY/Ad1+RmWCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124712, "uuid": "4c84ac0d-784c-4adf-bfa2-a021c457193b", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124712, "uuid": "7c1c90ed-248e-4f7b-98e9-39e9f891333c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124712, "uuid": "ce3dd6d0-ff65-4cbd-aaa7-69624b7db967", "value": "9baaf9ce29d4a8705480e07654de6dbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d914de-32c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691155239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155239, "uuid": "72e1286c-414b-47ee-b425-f608453e6e3c", "comment": "Malware payload (Amadey)", "value": "21ca23bc09ca8cd3a78b02625331c8d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155239, "uuid": "bf990d8d-77a3-49c4-9eec-40957841251f", "comment": "Malware payload (Amadey)", "value": "225cbd5b7dcf6c054a75547e897185fbd3288343d9184d18a515359220abc1f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155239, "uuid": "1724663c-60f3-4bc8-9551-a448a5850eed", "comment": "Malware payload (Amadey)", "value": "507f3fef5ef6cf483a2e79c7b29343ef7f919ffd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155239, "uuid": "1c7da50d-de97-4bac-946f-378f6f4cd08a", "comment": "Malware payload (Amadey)", "value": "66a0537a57ecf2fd84e561ee5e115ef1370429db06b2461db3fbf20d340361fe2af2ee6a6ac53a9db593731e425a2203", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155239, "uuid": "618fbb27-2d16-40ca-8825-670cd17a4290", "value": "T11534D012E7E88072E9B517B058FA13C30B3ABCA19E74436B2755594E0CB36D0E97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155239, "uuid": "1fe47bd5-375b-499c-a721-e89a299d0481", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155239, "uuid": "585d049f-f57a-4e1d-907b-aea04ccbe52c", "value": "3072:KVy+bnr+O1h5GWp1icKAArDZz4N9GhbkrNEk1S6D5dMOt7WQqmuXIsjjoc:KVy+bnr+ep0yN90QE3zDQqmS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155239, "uuid": "beea174e-c31b-47de-9e4a-ecbba9d13774", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155239, "uuid": "862083f9-a114-428e-a24d-d5abde3a7f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155239, "uuid": "cafc2e2c-4a0c-44b6-8651-9d6841ba85a2", "value": "225cbd5b7dcf6c054a75547e897185fbd3288343d9184d18a515359220abc1f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5b7e82-326c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691115037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115037, "uuid": "93206b85-e506-40a5-87ea-309c60a805b1", "comment": "Malware payload (RedLineStealer)", "value": "f83db5369185112e91e731c163b11768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115037, "uuid": "24486d9d-2de1-4862-b32c-5b2811a71c42", "comment": "Malware payload (RedLineStealer)", "value": "235057f65d5148d99ba63bb2d4d4bab4834124d8d6677c69bcda2b7817fe93c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115037, "uuid": "798e9319-d005-4236-a39e-becd48419de8", "comment": "Malware payload (RedLineStealer)", "value": "8a24f7225f1fc0e230ed46a0984e87d6d1250e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115037, "uuid": "4e03b725-bed2-4178-8844-5ef853a79f5e", "comment": "Malware payload (RedLineStealer)", "value": "f7e9c1cc81a62089d88d14c436fe13c5c8d47eaa4926427d795c5653d1c346ea87117cc8aad11b107e42889cd2a1a23b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115037, "uuid": "0dfbda7b-b780-4b9d-8015-f4396f32d10d", "value": "T190C41217A6E980B3C8F637B018FA02E30B35BDA19DB8438B1759595E1C727C4A57237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115037, "uuid": "1ffc7ecb-e3bd-42f6-8c2e-960aeece2a57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115037, "uuid": "2cdb3787-c68d-45a0-9a01-40b6c295523f", "value": "12288:3MrKy90CfgkkOZKImVtRqOdaYgyZHxiQhYf:Ry/4JyzmPRFyyBxhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691115037, "uuid": "52c2685f-7af1-4694-b16c-3589f4e22484", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691115037, "uuid": "35db4458-55f6-48c2-9a74-4ae8d8600882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115037, "uuid": "e1e42b9b-bfe4-4bc7-8b70-bc63c28d9820", "value": "f83db5369185112e91e731c163b11768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f599315-32f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691171712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171712, "uuid": "7f802a0e-1520-4531-b605-823ccc426449", "comment": "Malware payload (RedLineStealer)", "value": "73f6aab3ac44197983d1744638262aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171712, "uuid": "75d68460-71e9-4202-ba3a-ff21204d30dd", "comment": "Malware payload (RedLineStealer)", "value": "23fbee8f0fc05dc38f50f341c80cd5f5f40e9d546b8f7a3e3ddf3608322f78b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171712, "uuid": "30fac688-b81f-4f28-ac6c-7d64fac7cb2a", "comment": "Malware payload (RedLineStealer)", "value": "e393c0efad3facaccf78cd3dfea8c850d1fcabc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171712, "uuid": "b2138ed5-26f2-460b-926d-cbd67ca76b13", "comment": "Malware payload (RedLineStealer)", "value": "029bd67706ec03ddb44ba2149038d1e1e7e48e7e266b8698daeacfebc0d17650c34d622b6fa3c43af4b0cb17ea9cf5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171712, "uuid": "66288a1f-7811-489f-8780-b9c317c2f987", "value": "T12BC56C607884C06EDEA310B642EDB52557DD50B00F2F12CBD684DBEB96A47E1EB3358E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171712, "uuid": "b3de08c1-d08d-441e-b167-ef567e2c075a", "value": "fbb54f2c5d938313a3b7f029c06d43f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171712, "uuid": "531a6a17-456a-47d7-8d87-0e23c73be03b", "value": "24576:zvfDdstXT4e+MXrgWlDg8MnmBJyQVvDEH:z2XT4e+OdrLBBxEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171712, "uuid": "868a12e3-7b49-4a0e-9d5a-d3c1d779b733", "value": 2627072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171712, "uuid": "22db8010-f956-4713-b689-0c4ebcbdf69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171712, "uuid": "c1fd3970-0120-4a9c-95c9-b0e77eb4bf3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35fa293-328e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691129977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129977, "uuid": "f98f759e-f872-4436-b58e-bd04cea71457", "comment": "Malware payload (DarkCloud)", "value": "111bce96e6d1c518b83b38cc7e8fb034", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129977, "uuid": "d2dbb14f-2e9f-4f08-8afa-f3324f1c3d17", "comment": "Malware payload (DarkCloud)", "value": "2463754f8220c862d72b3c3dd5033a2637daad457ab9c8b54a40214c08278e05", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129977, "uuid": "46378ad4-c090-48a6-b524-d791f837c987", "comment": "Malware payload (DarkCloud)", "value": "d017982dc8f363907e104fc67dccc9a59b664ce3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129977, "uuid": "b2741006-4be2-4826-b4f4-5def5b03ae83", "comment": "Malware payload (DarkCloud)", "value": "f7a868f07d1d19e03121293860fbc5aa3654df72de70b522d96f7635cb2b3bdb5c23ccdfb17ae48d0899b9e9df2da1aa", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129977, "uuid": "0fea3a52-840c-4e6b-b974-67198e98fdf9", "value": "T182555B5BAD28FF73D19E19771841D4460BBA3DA203897AB23BC47B3611F5B54823BB84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129977, "uuid": "b423ac1e-e9eb-43ed-afca-e56d2f01f0d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129977, "uuid": "47336377-71db-4c16-88aa-d45f435ea108", "value": "24576:ItROIiWCU3bQlp2H17CLEI70gCap08xxHDsHHG:ZMs617W1K8PjsHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691129977, "uuid": "b84725bc-18cc-4f40-ac51-e771a2719fbb", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691129977, "uuid": "3c7cb810-8050-46e7-a7f9-d3b734124dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129977, "uuid": "87506160-243a-4f2b-9e5c-203936c8a92e", "value": "PO-11059021022021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6d1742-327b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691121647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121647, "uuid": "4425f750-e2db-473d-9927-cffb32d921d0", "comment": "Malware payload (Amadey)", "value": "341e2e0fbcc88e262ed896ee11c06532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121647, "uuid": "cddbcef8-11d7-4b86-b35b-f2b361e800dc", "comment": "Malware payload (Amadey)", "value": "250b10e7a4025f8845c9287d86eb1101f18f23e2dd3c50df642cbc40756afa97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121647, "uuid": "7b004c05-6158-4862-9ed1-3f919591f3bd", "comment": "Malware payload (Amadey)", "value": "60cd85254f5faeb3ba526650daf85b773b458b90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121647, "uuid": "bf3023fd-0c2a-4858-9a2b-4c9d2e1800d3", "comment": "Malware payload (Amadey)", "value": "d53cf84e6593054cdda8bf1c27cca84ff94d9413696e353c5d622e07f6d069c8094041cd119b2f0fa22af3408c132502", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121647, "uuid": "f57aee45-4af2-4377-a539-cbae760124bb", "value": "T157363A92E74A557BC08A19B0E3C3950EA32E1EE573145846CCEFB53FE5E3E912D86309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121647, "uuid": "be62164c-7be9-4257-8bce-79624b04dd8f", "value": "04be0a3dc5e03774dce6206823c91be3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121647, "uuid": "8dbd9d44-7db1-4623-bb12-dfb2b359242e", "value": "49152:rOjkgSYGuvkNaJ/b0GYmsmf/sAa8hdCQB2xrajUVNY36pMK6CrOIvYApvSzZQljF:rXuvPZwAcQBVjUzgiMC02Xv+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121647, "uuid": "f8cde867-1322-42c8-8145-b3eb067caf1c", "value": 4873744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121647, "uuid": "548148dd-b034-4f87-81fa-d1ab6eb0d72a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121647, "uuid": "c3f5fcd6-8b34-4bd6-8c12-f754137e48a8", "value": "341e2e0fbcc88e262ed896ee11c06532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae4b32c-3275-11ee-a6f9-42010a9c0055", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1691118984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118984, "uuid": "997d911f-586d-4bf8-8b33-bf42a47aadcd", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "c6d11d6a8208bfe32721f12e84c7e41e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118984, "uuid": "1ff1e24b-d810-43de-af00-387ac6424d12", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "255b82974ad95efe69514f060e7fcd2e47f807cd41c6b8b9294bcc404050d221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118984, "uuid": "27df1868-1bae-465b-a168-7e51dfb6cc2d", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "70a036194c39326d9a2a13cdb008f09b3546bc7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118984, "uuid": "d3a77a0c-7e59-4768-aa7c-16bff69ec277", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "48bf7058dc790991c1d5c5094b3f946ed42267efeef4e75e6afa599d4c2b7b2c9dbbc738d4eaad1374facbbbe1200587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118984, "uuid": "22852d39-bbc7-49ab-96ff-1cd23cdfb70d", "value": "T128C4010276C1D972DA2546728D1BCAF46A3EF4708F1AABD77B445B2F09312E2DA73314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118984, "uuid": "09106c20-8e01-4110-94ce-bad0f627d5cd", "value": "724ad9571755841c2e0f4aa3cd09706a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118984, "uuid": "bd42182f-e0e2-489a-9cc7-484e80032d68", "value": "12288:Nc29Y9o7uhMklxWJ097bGTawN16NpPHUZjcsDVfk/M2Q:CwXMMk7W3ThiNBHUiEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691118984, "uuid": "c46f3ec4-9172-4d0c-9fb5-e297be8bf1af", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691118984, "uuid": "9ff1d76f-ebf3-4a13-a41f-6a767ec9ba97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118984, "uuid": "c7bd0973-5492-445a-a278-eb64c05e4b1e", "value": "c6d11d6a8208bfe32721f12e84c7e41e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b627a9-32fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691176556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176556, "uuid": "99903b1b-5d8a-43d9-bf06-9e30e603122e", "comment": "Malware payload (RedLineStealer)", "value": "10e1b3ebe87e9fa774323e7681418867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176556, "uuid": "3c73d3b6-4f3f-43f2-b2ee-42254590b6d7", "comment": "Malware payload (RedLineStealer)", "value": "26173e0b3deb41b824f2bbb3557d8cac2b8c8c92b23e41cb9d9c12f8a347372c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176556, "uuid": "111e915e-5a40-48f6-b4d6-7d40c97f5877", "comment": "Malware payload (RedLineStealer)", "value": "118044980900a4a83f72f9ff80bc80b4ebfa93a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176556, "uuid": "39e9fa3f-aeb5-4b1a-80ba-4645f057840f", "comment": "Malware payload (RedLineStealer)", "value": "418694294dda5b7e983180a5883e09025fac2c4d7ee8bd577a38119c832c90b3cf6a05a08bef878c3006d00380dc0453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176556, "uuid": "c64cdedb-3662-4038-806f-b0092ee237d9", "value": "T11EC4125267E95532DDB127B048F203C32A3A7D814E74532F2782AD6E1CB2BD098B6737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176556, "uuid": "bae4e227-13ef-4fbd-a993-13c458979fa5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176556, "uuid": "8aef4bca-0317-425f-8517-3fa47d8a3518", "value": "12288:0Mrpy90G/LnMzTuSwWLGqblF0P58aoA9L99/BUs+:FyRXSXbYhlVxTN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691176556, "uuid": "a571a9b8-1f7b-431c-a124-05f8908cfd5b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691176556, "uuid": "3081d1ef-d437-4b50-a6b3-4f605b9f670b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176556, "uuid": "2ba36033-716f-4d87-ba7c-5f59c7b9e510", "value": "26173e0b3deb41b824f2bbb3557d8cac2b8c8c92b23e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d757f39a-3321-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691193093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193093, "uuid": "e05a4d21-c96c-4fc0-94a4-910e428aca25", "comment": "Malware payload (Amadey)", "value": "4173080c4ee5f1935da265a327f91d1f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193093, "uuid": "7d07124e-3f1f-4f26-a303-6f55626c693f", "comment": "Malware payload (Amadey)", "value": "26229c7bea3c400f326d457afc101d3ebccab405a838f7cf80236ced95c51199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193093, "uuid": "c8f5e48e-d0ff-4e82-ad35-f2d434d7f5c0", "comment": "Malware payload (Amadey)", "value": "539702262feafd150f2aad05fe54d68d32d021c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193093, "uuid": "6e153986-02f8-4163-a0db-0a5670be01f8", "comment": "Malware payload (Amadey)", "value": "95c58716a6ccd6957315c1c89005524ff00f0c0d264cb818056d439995eb2e03371d563e0b84806a5a08ef7114bbda66", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193093, "uuid": "76fdf631-644d-4f32-b3b0-23976fd79c5d", "value": "T178E41202BBE49431D8F56B7158FB0BC31A3A3CA0897D529F1786694F09F36D0697272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193093, "uuid": "8f618c97-c283-44f8-bd58-74240fdc93e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193093, "uuid": "523357bc-5f5e-4f8b-90b9-2a6942b2ff0b", "value": "12288:QMrsy90ucwisoHs21Mc5+iY1zH9rcRO9Hqneuh4j3MiS:syuwuseM/iYZZMeuhg3/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691193093, "uuid": "8cd9417a-318d-4c48-87c1-7e98c24267aa", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691193093, "uuid": "84ca6dcd-e312-4e3e-82e3-acafadc8b31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193093, "uuid": "69a771bf-5cf0-478f-9b0e-31ab7ddb76ff", "value": "4173080c4ee5f1935da265a327f91d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cecca3f-32db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691162769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162769, "uuid": "4dbc3d57-c54d-42ba-bd0b-4402cf7f5e1a", "comment": "Malware payload (Amadey)", "value": "97be2f02da3cf0e4def69ffaf762b41e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162769, "uuid": "7ba9a8f1-61df-40c9-a66d-5e54650fe715", "comment": "Malware payload (Amadey)", "value": "264a3763b4421dddf196d6a8cda4f139bbcf4a55ded06c8cb714878e1e0477ae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162769, "uuid": "7cb19c7c-d0b8-4537-8223-a8fe6b64399b", "comment": "Malware payload (Amadey)", "value": "890ead2c768ab3d757db2d04dbfb91ee7acc0934", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162769, "uuid": "db358fc6-9f0a-46b5-8a37-515bea64340b", "comment": "Malware payload (Amadey)", "value": "7125b8675837ec34ca85e9e17111bee9623c1d959bc16563580399f2c7656cdef8c59941dfdde840b9c52aced18e242a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162769, "uuid": "9e178a52-f643-4a93-8c12-ce13139468f1", "value": "T14FE4120266E45222F8F4177068F707C30A39BC616EFDD36B3796A90E09B3A946532777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162769, "uuid": "bd56c86f-e9f1-4a01-9876-826c4ab0e02f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162769, "uuid": "92cd9394-3e42-4fd0-bf3d-4c11851cfc06", "value": "12288:8Mrwy90sUoM80d16fOcqvmItL2h3w5bBe4HKc9LnNSay4ao7:sytUgy6mzvm42h3w5Ve0zNSfJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691162769, "uuid": "77e7707d-7194-4e56-bddb-eb7967072c1a", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691162769, "uuid": "3805b8f5-b2d6-45b6-a551-ddc8c9239c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162769, "uuid": "a83b6a06-fdcd-46c3-9e5d-f6bf976079f7", "value": "97be2f02da3cf0e4def69ffaf762b41e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f546f77a-3315-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691187989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187989, "uuid": "e5324b93-52bf-4f30-8f9f-3b631508cc36", "comment": "Malware payload (Amadey)", "value": "4033e04652afbb58233298c8c7dfc95d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187989, "uuid": "a5d5968c-ef7a-4f27-a24d-0be5ef1e230a", "comment": "Malware payload (Amadey)", "value": "271ae3d2910af96b5e89f2195e92be02c9e46b79820a31f69c59f35d3330d3dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187989, "uuid": "29697f9e-7666-4f30-a4d5-3eeccef9dd0f", "comment": "Malware payload (Amadey)", "value": "c3f024a5f5c86f932c1b435e61de30cdef46005a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187989, "uuid": "bd32f69e-e05f-4d96-99f1-e7781e18d762", "comment": "Malware payload (Amadey)", "value": "95069e0248ef8ce3c051f43dcba4504ae84159eec633e85bef7ddf16cd7e01a1e9e0ec8b98a3d770dfc1ec1e9dd7f9af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187989, "uuid": "25178a5e-0ea7-435a-9104-785712877983", "value": "T1FEC41256BBE94531E87617B028F602831A367CB05A74836F7749BA0F0CB36C4D97276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187989, "uuid": "c8930419-d188-4911-a4ad-07add4389ef1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187989, "uuid": "0c10dfc5-912d-4af9-8604-37a80fa59dd5", "value": "12288:mMrCy90HpunJ+NFnsb7zjbQ+d+xc3VH/NKBhw4JN:YyepucNSbj3cxc3VH/NKjw4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691187989, "uuid": "b4688801-b04f-4459-a50e-caa85295a2f3", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691187989, "uuid": "e3ab1ff6-7855-4049-b4c6-0f892c1e6e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187989, "uuid": "17faba34-6a2c-4c3c-8e32-d598ee729d48", "value": "271ae3d2910af96b5e89f2195e92be02c9e46b79820a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31cdf7b-32fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691176255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176255, "uuid": "7254db80-96ac-4e27-b1cd-8cbad4c1d9e0", "comment": "Malware payload (Amadey)", "value": "3797fb6a8e7bd83196c137afa9bc4c08", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176255, "uuid": "f6d41b9f-b047-43c3-bfba-93ef05941a93", "comment": "Malware payload (Amadey)", "value": "275d4b94d7b6b683a88ebebfe5f171adb1bb8c7e759a019a6394e205661ac24b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176255, "uuid": "ae34f354-344a-4c1c-bfa9-6dc2c2a07aa9", "comment": "Malware payload (Amadey)", "value": "c3155941d264192af89891e606b786312a6e6ae4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176255, "uuid": "a5ae3924-cc35-465d-b8bb-5624b6e30888", "comment": "Malware payload (Amadey)", "value": "750f771817e386998aeb1609362f67e284000020897a43505d3175f91e8995b37901210d22dc11a88cc23a59a4e6d4c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176255, "uuid": "7e3940a5-b6fc-4adf-a713-f3a813b5a458", "value": "T138C41262E7D90433E8FA23B049F602931A3A7D629E74835B27C5D58E4C727E4643277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176255, "uuid": "ecf08aca-056c-41f7-9ace-05dcb6807c40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176255, "uuid": "995afa74-f8bb-4010-805b-d5c60a612f31", "value": "12288:DMrCy90UCsy+jJsf4BZ2JlevNgBYCqTlDbLzNMoCKvZBGM:9y/CzEy4MoGz6nXKyZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691176255, "uuid": "827abdcf-e860-423b-9d2a-df054ed6b4ea", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691176255, "uuid": "a63d1755-0935-4cec-927e-12f998ce17d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176255, "uuid": "7c533476-5354-4688-bbdc-007331babcfc", "value": "275d4b94d7b6b683a88ebebfe5f171adb1bb8c7e759a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c7ee98-328d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691129438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129438, "uuid": "929fb7bf-6e3f-4f6b-82b2-3bf888a79ac7", "comment": "Malware payload (RedLineStealer)", "value": "8cc2d4575163a5e3dc7a56face3644e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129438, "uuid": "604703f6-0fbe-497d-84f6-78f6979bd902", "comment": "Malware payload (RedLineStealer)", "value": "2925709178aa6668084b7a01935d08f19846b4df628e2f95e94f8afea67a82f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129438, "uuid": "d317de2f-5f27-41e8-8db1-d2fad2609170", "comment": "Malware payload (RedLineStealer)", "value": "07750c57af053bcdaf757626f3a8a0979b30124e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129438, "uuid": "234e65f7-1346-465b-af6e-3b1dae2ba3c9", "comment": "Malware payload (RedLineStealer)", "value": "f50160e6ca1251e676c2a16b45acece8b2db2fe4a985ebb8addcd7130ca786f086e4e00dc010de1e01efa4688754d320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129438, "uuid": "995fb75a-296a-43a9-9e6a-e88629c204a7", "value": "T1DDC41223E6E88163D9B217B04CF702931F393DB25974831B6B42685E1E72BC4B57672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129438, "uuid": "e7a6657e-3dd4-498d-9b56-97cfa232e0fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129438, "uuid": "f01ba88c-e40b-4055-a594-908fd31c4109", "value": "12288:bMrZy90NzxvxyQaWvuo2uuISS7yP/OVLeL/BiFLB1EHdcN:eyaDyQD2DuXSuyPmVLe7Biqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691129438, "uuid": "b136f3e6-7c06-410e-be64-d9ff774ac090", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691129438, "uuid": "9aa8abe8-a719-4031-95ad-e17731d5010e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129438, "uuid": "f7e4d5e3-5b52-469e-a7fc-c1fde546f624", "value": "8cc2d4575163a5e3dc7a56face3644e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77e1f51-32fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178061, "uuid": "aedbfc35-30b0-4750-936a-2ee8caa88110", "comment": "Malware payload (RedLineStealer)", "value": "24e8ed1b18928d21d299275ce8124af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178061, "uuid": "bad6cc16-4ca4-4d2f-8976-d3e4500ff7ea", "comment": "Malware payload (RedLineStealer)", "value": "298939384bfd648e43fe25a5387e26b20939379642af5e9b33d05a1f8b1fb291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178061, "uuid": "d761bae1-a6cc-45f2-956a-47a064805876", "comment": "Malware payload (RedLineStealer)", "value": "4c1123e2ff76e926f20601d8829043f8d3f46274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178061, "uuid": "88817c85-bd82-4bbe-85e5-8b542613feec", "comment": "Malware payload (RedLineStealer)", "value": "5a57928746cdb3e0fd67d9619e56fef2e9c8add3e95d47d7fad25fca857fac2b768479565008f5691ae73d73a5ec8ea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178061, "uuid": "7ae36ac9-5e88-4735-b1d3-60ba31184251", "value": "T170C41247F7D890B6D87507B029F306931B36BD52683CD36A3756A88F1DB2289A03177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178061, "uuid": "380d6963-8072-407c-91b1-baca3bd5bd12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178061, "uuid": "ef940445-d901-4af9-b7f0-f3f55aa61873", "value": "12288:UMray90SOUQcwS5gdRYlEgQ2w6xR1gBYC0S1hsb7vbIi:WyAUMLCl/QR6PuzhhY7vbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178061, "uuid": "198e4787-c0ef-4c2e-9bf6-1351e3115ba8", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178061, "uuid": "6cd3f955-26f2-47ef-ac3a-30114a4f6add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178061, "uuid": "5752f277-8d95-488a-9219-2a9fc6db8fbd", "value": "24e8ed1b18928d21d299275ce8124af4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683c39a0-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691114738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114738, "uuid": "e48aa92b-2daf-4d8d-8409-63bc35c6d453", "comment": "Malware payload (RedLineStealer)", "value": "71a7aa6c0c755d1524855c51bc04e7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114738, "uuid": "5826317f-b964-45ec-9019-e7e9868915bf", "comment": "Malware payload (RedLineStealer)", "value": "29afd3dc6e6477396048b999bcd803922c1b1ee4dc065920d95eb87f73fa223b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114738, "uuid": "9055deec-3268-4b8c-8dd1-39927a43572e", "comment": "Malware payload (RedLineStealer)", "value": "59e8b803ab7de005e47724d2128bf11eb5bf0c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114738, "uuid": "89b36332-054d-445a-ac9d-04fbb21a9303", "comment": "Malware payload (RedLineStealer)", "value": "26fe887e6fcc1c5e09d1d3baf4dc76f441bb49b6bcb7ec500522950f2579f30d3d174a9e28275a4a23e1ba797eef9aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114738, "uuid": "65c4e8da-c400-4be6-a3dd-c60baa6a123a", "value": "T143C41253E2D550B3C9B157B01CFB03E32A36BDA19D24522B2791995F0CF3AC9A87137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114738, "uuid": "d5a07e19-cbf8-4a3c-b51d-eee7a1e7abd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114738, "uuid": "6eb0ac33-2be3-47fb-8ded-7b776979736a", "value": "12288:2Mrsy90LU4rZjAwSAvG1nu7vblZRyLA+iVBTpPIjKm2:GyGTJeAvG1uzbbRyE+cTtkKm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114738, "uuid": "95bab932-bb17-40a1-a808-e87930a0e156", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114738, "uuid": "df4454e3-f0c5-45b4-a98b-35fca3a3b0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114738, "uuid": "017eb7b5-0f21-46c1-af13-3df97bd2b3e7", "value": "71a7aa6c0c755d1524855c51bc04e7c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b7cdce-330c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184071, "uuid": "ef089938-19ed-449c-ac3b-d1212fe23e37", "comment": "Malware payload (Amadey)", "value": "1a9e24cad66acb1d00c78b794bc40a57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184071, "uuid": "cc050db3-dfb1-4e2e-9634-f738b17512b7", "comment": "Malware payload (Amadey)", "value": "2a5a5117af884a426d2735837932ec5e377908f777c1e0c30bebf4eebf831c4c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184071, "uuid": "8963ec7b-2f00-4b76-b091-a0c5817553bd", "comment": "Malware payload (Amadey)", "value": "c32353fbe3f1a637791bd284d22d4f4d07695bad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184071, "uuid": "94a5efb2-22d3-469e-9d77-3725803ba091", "comment": "Malware payload (Amadey)", "value": "b61d227d142dec14413b004b41d0440e885957f3ee5cc015c83b24df50957e68c27772befc584328f69b0c3f6d22ce38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184071, "uuid": "bc45ea75-234c-430d-9672-9cd71df21090", "value": "T17BC41252B6E84033E8B513B058FB02930A317DA27DB4936B2786ED4E5DB27D4763172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184071, "uuid": "5849cbc1-1d27-471c-aa5e-33f596ebb89c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184071, "uuid": "34ad8f55-e49e-436a-9e59-337b00a9e676", "value": "12288:eMrry90CynXttlfKc7eRr0fgBYCpSxjydBidg:hyFydLzUZzYwUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184071, "uuid": "173a6126-eef0-4c7b-a252-56ba21185fdc", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184071, "uuid": "7ede4165-1ec9-47b2-af66-5b97c17c5652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184071, "uuid": "6cf9765e-2d75-43a6-a1d7-39efc0c6cce6", "value": "2a5a5117af884a426d2735837932ec5e377908f777c1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7cfd80-3316-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691188273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188273, "uuid": "44b96d75-7bc8-4f49-8ad2-3f9bc7f6022d", "comment": "Malware payload", "value": "4976bc4e4e554820c081735255c594df", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188273, "uuid": "9302a4ac-9ff6-464a-b46c-4157d9602943", "comment": "Malware payload", "value": "2a9c9203c7290ddb535505a802702ed3c44b43e2d9a5cf4b66591c08581f6f05", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188273, "uuid": "575c38bb-5ebe-4d52-a4e5-f8d7d79fb8fd", "comment": "Malware payload", "value": "255024256b84eab9f321efec867bafce1c6d4187", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188273, "uuid": "de01fdfa-21cb-4ade-b279-0918db7f6810", "comment": "Malware payload", "value": "78d6f950750b186b836a54b0e8add7d08ca195083f638743ea7f5c81666bcf357ad1d56c41fcae05373828eb83e1b77d", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188273, "uuid": "84e4ef37-527e-4973-a658-972ec6f1c8e0", "value": "T1F531713322B9031CC2B15A3B58B5BA139636B80DD91B8B8D32505A78185859CE925F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188273, "uuid": "282f91e3-2834-45e6-bc76-0f58d983bf85", "value": "24:8NaZsxqFs699N7oKh9aghW87A+WmG+/CWFyV86rKyMBl7pEQeyTppTpZab/2XT:8qq69dEjDvqlV7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691188273, "uuid": "3ccf1a74-450d-4006-8df7-92d943d47aa2", "value": 1585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691188273, "uuid": "9bd6f0ef-0f6f-450f-9def-a1fbad99dc2d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188273, "uuid": "effb1421-8257-458b-97b0-ad4dcc893c8c", "value": "build-official(105).lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7123d13f-3320-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691192492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192492, "uuid": "900efb48-0b13-4093-8aee-3cf25da71447", "comment": "Malware payload (RedLineStealer)", "value": "e3b2c8b09555ed0394d27b8a0c2fa03f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192492, "uuid": "217e986b-6ffd-4ad2-a6c1-3f1114ced5e7", "comment": "Malware payload (RedLineStealer)", "value": "2b2786e84b6b67dea98cee7b487d38788930be8342e20a7a310243d6a24e284a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192492, "uuid": "32457599-48ad-4062-8456-8d3f45e1d967", "comment": "Malware payload (RedLineStealer)", "value": "fdbf34e0046abba5d5fd8b471adda93f20060984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192492, "uuid": "bffb35bd-fdfa-427d-9322-20a1bfd0b84b", "comment": "Malware payload (RedLineStealer)", "value": "dc679b0bae1a0edadde7f7790d623032e6e28950d3a5295b4da530dea78a49446fc88c99b2eaeba25473622ad03b52a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192492, "uuid": "60c713d2-35c7-495c-adc6-8b35b98be4f7", "value": "T1ABC41243A3D85233D9B8177148FB03C31A36BD919D7893A62384A54E1CB26D4F572BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192492, "uuid": "5a4873a0-50c5-4eee-8c4f-b449922e4cf0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192492, "uuid": "56b2b299-ca7f-4bcd-9205-7ee4eaea2424", "value": "12288:KMrGy90Ilum5fObzm3FQvH+W/cYXXdLm1SQAK5E1Rm:oyFl/B3FJW/cYXt2SPD1Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691192492, "uuid": "ca522048-66a8-4871-bca0-8e1cf3559875", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691192492, "uuid": "a587b013-1252-42be-886e-f78cc8a8b81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192492, "uuid": "e8b9ab62-cc2f-4d06-b001-4aa24dd79201", "value": "2b2786e84b6b67dea98cee7b487d38788930be8342e20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a5d1d2-32c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691155185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155185, "uuid": "f8210ec6-5fb1-4169-8390-14ba01254bdc", "comment": "Malware payload", "value": "673419240926b6e1b64b0e23512277e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155185, "uuid": "b19f3974-3302-4e49-b1cc-1043dc315fe1", "comment": "Malware payload", "value": "2c4dac19f1cbdf5ae1f608e6c5b312c107327de5ea79165cefb5baccafb5ae54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155185, "uuid": "edf5d978-de0f-44d7-be9f-9b4b66ed6ce6", "comment": "Malware payload", "value": "1f6afbab9cec9df87be50f9bb85fd06f9d7aabb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155185, "uuid": "69059747-9e05-44a4-b4c3-240144879465", "comment": "Malware payload", "value": "4b72529f8facea875e54fb17b84273bceca20d4c8bc10f4a396b2f0788cb4cba499407ce9647bc4739ae5e81b9dceb62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155185, "uuid": "56669784-24a5-4573-ae5a-d5f345d46dbb", "value": "T13334E057E7E89072DAB5277018FB03C30A327CA15D78932B3786A85A5C736D4A87533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155185, "uuid": "938506a8-17a9-4b25-b09a-45bbac1ecc60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155185, "uuid": "2d12189c-3a0c-439f-ab19-4cd8c7a42f6a", "value": "6144:Kly+bnr+yp0yN90QEUWkTnrhjB6gBZ+t47D1:TMrWy90qJXhjB6gBYC7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155185, "uuid": "a05868b1-d4d3-4b46-94dd-f71430af3d87", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155185, "uuid": "20fd8795-b030-4c5d-b082-df1c4d01c580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155185, "uuid": "4b1fcd3e-b581-4049-aa0b-0da038c62927", "value": "2c4dac19f1cbdf5ae1f608e6c5b312c107327de5ea79165cefb5baccafb5ae54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501870ad-32ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691170103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170103, "uuid": "ee947fa7-38cb-49bb-a0cf-22672b6f5bc2", "comment": "Malware payload (RedLineStealer)", "value": "9bc7e1244b18640069f2a2b7ebdc80d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170103, "uuid": "833f24c0-6459-408e-82fc-43a58b13e41a", "comment": "Malware payload (RedLineStealer)", "value": "2caeda0d4db1d749030beaeb046e6701dba2983899f00887d1ecd67f1e65baec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170103, "uuid": "226aa3ef-29a5-4494-8b21-c4e43ad2143c", "comment": "Malware payload (RedLineStealer)", "value": "b896b032cba16396b8dce6888d7a1af1b6963a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170103, "uuid": "cadc799e-963b-4b75-a110-f7aab7ef21c6", "comment": "Malware payload (RedLineStealer)", "value": "92fdb439648d908224c94ed2432aa095fdd864ed84adb791b333ce2ac338c2511a4c34f369243465c26a73326f762f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170103, "uuid": "1ab533e5-ab39-42bc-aca3-98ee1624bf0e", "value": "T111A4AE0252E17C55E5369E369E2EC6E8271EF951CF14AFAB2318FE2F05B11B1C672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170103, "uuid": "edac352a-ae48-4e42-8b45-6996b5e7c789", "value": "e9d58d04128ce66edda6debd8a6afcde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170103, "uuid": "f709f207-786a-4de2-96f1-1d6bbdd7d6c0", "value": "6144:G/E7HxHEAeRLKqLcJqcacgm2rLKRlwSSVL8RSqdSpapBbN:G/GHxHE+1q/mmeSVL8RR68B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691170103, "uuid": "1348a394-b160-4122-bb99-b1c49766a349", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691170103, "uuid": "3437b82c-097e-4d4f-b8ba-9e9ee3b0c688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170103, "uuid": "d175fb2d-2377-427a-b41e-cf6faf7ed723", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25316b8-3307-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691181971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181971, "uuid": "a37b08ba-ccdf-43f1-a1da-603f63dc0081", "comment": "Malware payload (Amadey)", "value": "a0214d3025752969d0ad9af36c53244a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181971, "uuid": "078470c4-ea32-4921-b387-3286ee8185d4", "comment": "Malware payload (Amadey)", "value": "2cd63c7cc4ac2a4a1472980d8ff8ce9850b121f21ee5b28ccc0d83aff17bcf4e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181971, "uuid": "60b0706a-dbb6-4d03-ab4c-df78767da039", "comment": "Malware payload (Amadey)", "value": "4b3f8cf14173f59a29eed12389342bce54fc1059", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181971, "uuid": "1d112618-352c-44a3-aa6f-4adc6b51923c", "comment": "Malware payload (Amadey)", "value": "553e72af3ace41d07c9e0cdaeeea351b58f3092cf1af079f5f21f4ea499582466fe29a5b9da39fead2eed491a431c823", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181971, "uuid": "4cf679b7-40a1-4158-9ac0-87462a0618bc", "value": "T1C603F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181971, "uuid": "87f6491e-75de-43a8-8ca2-f477bc7ffdb3", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691181971, "uuid": "507b7b35-d80c-40bb-ba8c-bbb6e8c532d0", "value": 39726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691181971, "uuid": "d6deab4d-9d0a-4db5-8864-db935a692d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181971, "uuid": "d33029b4-7b40-43c8-93f0-4b0c7bcba7ca", "value": "a0214d3025752969d0ad9af36c53244a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477f18a0-3275-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1691118978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118978, "uuid": "1d49e24d-919f-42f1-9978-42e06e25e6c5", "comment": "Malware payload (RustyStealer)", "value": "f3056f7c883b09abd5869b6100bbb4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118978, "uuid": "83c2e3f6-fe22-44ba-ba2e-2b99d8bf5fe0", "comment": "Malware payload (RustyStealer)", "value": "2d0ba244129acf79a52dd023790e434c58e6446f8e6e36324c2f2c73fcc95985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118978, "uuid": "104bf586-5698-47d2-b1bd-5dd489407fb8", "comment": "Malware payload (RustyStealer)", "value": "65edd988a0d7dae29979a4c868f8879695827798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118978, "uuid": "966907bf-7094-4293-93fa-3b7b375d6b7d", "comment": "Malware payload (RustyStealer)", "value": "93346c7e67f367c008dbd0ee280992a59c8bfa5f053fdddbc58e755a2a0f43d729d6268b699158a0a2d9dc79a6a5d2be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118978, "uuid": "41586ab4-ad52-4c2e-aa21-e8ddf5399e25", "value": "T192F55A09BC455D2AC47AB67019FFE334CA254EAD15035617CF8FAE60BB1F3502E9D28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118978, "uuid": "ef06ff91-17d0-4a25-bd59-83cc0d120ad4", "value": "d5b132be82bf8793ee9b71765075437f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118978, "uuid": "bb6c7297-4e8f-4422-b880-d0527cbe1b8c", "value": "49152:gmot1esLr/3s4tNzwMtxywfaEdxkJLz/8Nmzb+SXugSimU5rhVQTDnMRCQnAG:UesLrLjxN2+mzySXu65wD0AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691118978, "uuid": "ef02f02b-3c89-4590-9037-72699f7b2d38", "value": 3583488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691118978, "uuid": "f284a15b-9732-420e-b9cb-4db29e3871ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118978, "uuid": "617c8b88-a4ce-4cf2-adfa-65f43db4865c", "value": "f3056f7c883b09abd5869b6100bbb4fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d749db06-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691124803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124803, "uuid": "eb091a19-594c-4698-9d3f-891edcfe889d", "comment": "Malware payload (Formbook)", "value": "6e7113e47f407f98a8683186130a52f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124803, "uuid": "1f4e0169-4d16-4cd6-a97c-1efab9932496", "comment": "Malware payload (Formbook)", "value": "2e2f7d2ee122957844312161a09f0506d601b0ca7ebb31be40d7057d03627595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124803, "uuid": "cae02757-0df5-44e4-949b-d7b542c3da3f", "comment": "Malware payload (Formbook)", "value": "fa10a9a007e18af75427da0ba68633438a5853ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124803, "uuid": "25d4604a-c580-4b9a-9708-f1378d631e11", "comment": "Malware payload (Formbook)", "value": "12606ffafb10fcfbfd943d4ecfe7946c46f418fd8dcc0228a53d4e781d4470b59b656982e51d5062fc186ed16ef1e5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124803, "uuid": "423e9608-f3fa-424c-9023-6eef0390f308", "value": "T1A8D4125969A4AB76F86883FA48E2E63117F0DD19A810D309ADEF52F36572F460680F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124803, "uuid": "a0c41d3f-a7ae-4460-8079-f9174f86e8b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124803, "uuid": "d99288b6-b87d-4343-8e55-9e0af4e66dad", "value": "12288:G+1FYQvjOA8rs/6nho+Mrj2en8IidTlhsFWRDY8MClSGCtczE:G+1zO5fiRn8nvhsFW57SGGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124803, "uuid": "55cb24cf-dbf1-4f5d-9859-23846f5a2180", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124803, "uuid": "e79cee83-e540-4ec3-94a0-806f50dd5d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124803, "uuid": "887143eb-7c43-42c6-98c3-8360203920f6", "value": "6e7113e47f407f98a8683186130a52f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82879fa0-327b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691121654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121654, "uuid": "21acb70a-bb6c-407a-aaf6-34c13c75fd69", "comment": "Malware payload (Loki)", "value": "1ccbff84cc57f3c7afaa21e68306d4c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121654, "uuid": "3b2a42a8-fd1b-49fd-9f44-5956d200961f", "comment": "Malware payload (Loki)", "value": "2ecfb73a27fb0ec529964d63bddd28e7b9bc11ece506f2b2d83e3fa79691853d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121654, "uuid": "a0027713-e1a7-49fa-b6d7-5a4d94917701", "comment": "Malware payload (Loki)", "value": "90ee0b104feb4aaa20378b6170901fc20de0ac32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121654, "uuid": "10e94cfe-f1a0-447b-8ea9-84e71d76cd2a", "comment": "Malware payload (Loki)", "value": "417c7d6351ca578ffe217d8a247b23b5a4fae2605ef6c2454861170eba054a4d89fff5b42ac41040d22e589a2e4318b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121654, "uuid": "05c0d790-2068-4589-87cc-b03f90f48f9a", "value": "T1A8C4D06BF1CBCEA2C2D93D32C4030B2813B97549EEA3FB1960851A96EB5F3D264155C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121654, "uuid": "9579a702-71fc-47d8-8f7b-64312be0669c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121654, "uuid": "ea4562c6-52da-4543-8b2a-3289b2153d3b", "value": "12288:NPt++GIkVeTj43VE/ERV3g8SXcDN2Ompplse2m9:NMR5D3sEngRqkZx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121654, "uuid": "7c18506f-63a4-4721-9b53-d7f4e8959edf", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121654, "uuid": "c9df1679-0a8c-43f1-ac99-f15b7d18aeca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121654, "uuid": "23ea3ef0-a90e-4dab-b0e4-806bea681c12", "value": "1ccbff84cc57f3c7afaa21e68306d4c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f82e328-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173242, "uuid": "ab0cf4cd-2f88-4ca9-ad27-11d7ad1ab0e9", "comment": "Malware payload (Amadey)", "value": "987db709ecb3c896e5e79a7ede70b3d6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173242, "uuid": "67950b99-46e6-4cb4-b1fa-0ea0ba66d7e6", "comment": "Malware payload (Amadey)", "value": "2f0b3c3ba0ad7c3ca407924a014bab4bb6f7be867941992fa16cb351a5d9e514", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173242, "uuid": "5cb268eb-8919-4067-8cc2-b83b941d7464", "comment": "Malware payload (Amadey)", "value": "3eedac5bd43ffffee76c9e94242792e63cadd692", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173242, "uuid": "6eb42c9e-7932-4ead-ae95-ade826b2d5a4", "comment": "Malware payload (Amadey)", "value": "2ae1a31f266be26f5b10d43765d4b3b8fd74a8d5b83f951a5df930412fdf7aa4bed8708f64501ce2130d0f0da19b0d5f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173242, "uuid": "73da0325-d89f-4d96-841a-f1eb6f54f4cb", "value": "T1A3C41247A7E85133D8A52BB028F70783063BBDA1DD74922A7249ED5D18723C4E67173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173242, "uuid": "f9af2862-1a96-4f2e-ae78-0af54c9b9f58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173242, "uuid": "d5109c37-5238-466b-a66f-75a8678e7088", "value": "12288:PMrSy90BAYXFQIaDa7bdCnVPVUuZo5cKmNIJ68k:Zy22IdhCnVPVUuZo5+N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173242, "uuid": "bb316f0a-1444-4307-8629-080629d39b09", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173242, "uuid": "d84a95ca-2205-451c-9249-acb9cf3c5e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173242, "uuid": "b499c898-7433-4537-8f37-cabfcbfa0e25", "value": "987db709ecb3c896e5e79a7ede70b3d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0f1b70-32c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691153691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153691, "uuid": "00ed2405-6006-413f-9831-4b5375240ba1", "comment": "Malware payload", "value": "2eba4840428e1ed26f9178e313ac41ba", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153691, "uuid": "12d03e8c-1395-4adb-ba64-fe6f70e07d81", "comment": "Malware payload", "value": "2f853c03b141422300dcbf4b9711ad9ba908882b2592d06c58f3114d8d98fdaa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153691, "uuid": "b88f1a71-ea88-4f7c-bacf-bd2462173160", "comment": "Malware payload", "value": "e74e26a6a0f5ad8c649295d1208992555af01cda", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153691, "uuid": "8b136a81-3d42-4b36-898a-192e7caea1a1", "comment": "Malware payload", "value": "613eed2d7162fd593694862d07f61bc20058b3bed0d745386bb7a7d7e85a3eb3ae1c7a9e7710e7d61997c9df572516d1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153691, "uuid": "d60677bc-254b-42d4-ab94-4df04bb3eab9", "value": "T147514CB46A8A5796E88783BBC87FFCAC3735312742C9501C1038BEC9093B269DC47C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153691, "uuid": "923b88c4-3946-481c-9258-359fb8481e40", "value": "48:PG1nW9ASnA1WqZ1YDkBTGrtG1XLUt0xD3HA/xwnxP+vgkaylFNQBalFfMkKVGQCO:OgKShyYDkBTUMK2xD3HASnxPUTlFNQE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153691, "uuid": "a717f76d-a0d4-4e93-9f2a-2ccc7c5a686a", "value": 2867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153691, "uuid": "d852404d-32df-4073-8f03-aa485d0f2a98", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153691, "uuid": "1dcd6dfd-4651-4228-a540-03cd35b3df23", "value": "POXN8070622.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63995310-32c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691152097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152097, "uuid": "b8c9ff7f-f198-41d5-9597-266e6ed7c926", "comment": "Malware payload", "value": "086f03fd9ac1c3c8cfb239ae987e3bd5", "object_relation": "md5", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152097, "uuid": "98ea48ac-10d6-473e-af03-c7bc57d8bccf", "comment": "Malware payload", "value": "3086ac8861aaccdf3dc45f3b1380b6cd70169c7d9fc16f098f5a1d08736fed61", "object_relation": "sha256", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152097, "uuid": "9993331c-59a1-422e-a5a1-1566a2d7bfac", "comment": "Malware payload", "value": "323dabde263a57375691affc787d2504ce74062e", "object_relation": "sha1", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152097, "uuid": "c1843fcf-46d5-4151-b6f1-648ef9d7b043", "comment": "Malware payload", "value": "a9150eea5cc27277dd7706c9e5767f6fb055ef691dfb0f6ebe3bcd0c127ec5de42d35b0c4f8be82b9311b1803cb54dfe", "object_relation": "sha3-384", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152097, "uuid": "2c52b87e-246f-46c1-b190-accc77b86897", "value": "T13C01654522EF82ECC0E7033B12195C4AF26DC718C194F620886C2C720C07A1E1FAE2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152097, "uuid": "f59c2ab7-7834-4a3d-823b-e8d7070cf919", "value": "12:5jmiEPsZ2UNU2fpejpUGbuSaDnLblMSjyafXtl6fuwqLMkTJyEGaQ:9hx2U/xqaDnldfP7Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691152097, "uuid": "23596b42-7d67-4a34-8d70-cbc672f929b8", "value": 760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691152097, "uuid": "457635e3-f38d-4a77-aa7c-991c2dd6d5f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152097, "uuid": "a8839501-1591-466f-868a-6278393fc32e", "value": "PRODUCT DESIGN AND SPECIFICATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14bf07e-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691114941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114941, "uuid": "cdd3f1ff-6660-4d72-9204-7b56933e2d94", "comment": "Malware payload", "value": "32f306f4c1f7df8d7886502638f38a92", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114941, "uuid": "482a23e2-8bed-4d7b-9269-a8264dcf7611", "comment": "Malware payload", "value": "32ccefd8812516ef1f0fbd7f0da4a558272b537f2c1e26fbb53230135532e620", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114941, "uuid": "098c16a9-7b3e-465c-81c9-616fa0d17b34", "comment": "Malware payload", "value": "f0012bbc56d2849c19f80e38bece8a60a3662fda", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114941, "uuid": "4892a6e5-83bb-4a04-93f4-22fdf9d8fd20", "comment": "Malware payload", "value": "f01fad6e855e695ccaabb70d7897d6c3b204c17cfa04bdf0e98968892c8881827c76e5c086b5f445f343341285c88db9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114941, "uuid": "4cdefed6-c55e-4e07-a7f6-3de88e7504fd", "value": "T19753A649BF650FB7DC6FCD3709A91B0624CD650762A57B367934C828F60F24B49E38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114941, "uuid": "de9bd7d3-7295-4a16-903b-b730820890af", "value": "768:4ESOE8ADyz89Q79h86AmUQBTCBuRtMBBDF5gP83DNWet+elStX4qd03dSZ4v7XiS:4fRQkrmhZMXF083DMo+rN+AZ4vNVTT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114941, "uuid": "3c07e0b7-a2c1-4f72-9a37-357c6f3dc9e8", "value": 64708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114941, "uuid": "0c8b94dd-6017-45e5-a9ee-3eaea8edcc57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114941, "uuid": "1bbcc4b2-ed43-4218-8d70-f23506dc50f5", "value": "mipsel-20230804-0209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451591da-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184687, "uuid": "f3db6c6f-6d24-4dcf-b2de-87b67d7775a0", "comment": "Malware payload (Amadey)", "value": "b22740908c6020733b3dba4b914f1ba0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184687, "uuid": "ace72c0b-c5ec-4eec-b0d0-0f3b35f0a3ea", "comment": "Malware payload (Amadey)", "value": "331fc4845d0173423d39ef5faece1f6a4a62cb660effcefa15bd44d1d3b704f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184687, "uuid": "9698f0ab-3674-48b0-a82f-fbb1f3092456", "comment": "Malware payload (Amadey)", "value": "32b7b7f5e479e120bae9206366c39d3eeead9486", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184687, "uuid": "da872100-ba59-471a-8fb8-a26b3ad77930", "comment": "Malware payload (Amadey)", "value": "7300f470bf681c571fdcb4106af6e5cda1f6d66be378e8e1e157e9f3505dc58616f293a5306590c1ee801e6a340c5181", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184687, "uuid": "147e278d-678f-46a2-96bb-3e7ebf7d3d1b", "value": "T1DDC41223A7D8C0B2DCB65BB05CF513830B36BCD09E78822B1745AD5A4CB26C4A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184687, "uuid": "38fa501c-1756-4aa9-b826-8606c9b769a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184687, "uuid": "086c8f26-338e-409e-9a95-8f145ee8f45f", "value": "12288:oMrUy90JIjZN7bQy/RrCPz0SteQ6Hze3+OY8U1NMoCD2:8yoe7ky/8pen4G1NH22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184687, "uuid": "c6c8316b-a0ae-4b28-895e-21a2f2794819", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184687, "uuid": "39c52521-1e8e-4d8e-8465-365942dc711b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184687, "uuid": "f60ac5fe-0d03-4886-b42b-60eb90cdbb6b", "value": "b22740908c6020733b3dba4b914f1ba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ea8755-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1691124636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124636, "uuid": "7272282d-4e20-4ab1-a551-302d32b60264", "comment": "Malware payload (DarkTortilla)", "value": "ff943b3fd9613b5658296ebde28a4d54", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124636, "uuid": "3f526edd-7c5c-4153-b228-02a58e45eb7e", "comment": "Malware payload (DarkTortilla)", "value": "3594486ee2019ce81554baa4f01ecbbef8d0d392dbf2d4866ac340b3b0623c5c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124636, "uuid": "dfa38546-31ba-4d9e-8a8b-3ba0968f0fb9", "comment": "Malware payload (DarkTortilla)", "value": "713baaf9bf30de1427adb59e6697bd3b1f293ec0", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124636, "uuid": "1f156806-058b-4234-a935-738582f0cbfb", "comment": "Malware payload (DarkTortilla)", "value": "5281531fe895b869096d4707a2fdecd1cd0e0c3d28dbf0ee734a85d8bce01f9a3ba19b07767cea682cce74187501afec", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124636, "uuid": "f395b1b0-68a8-4cb4-9dff-bcd9ac258998", "value": "T1A265E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124636, "uuid": "424a36a3-4479-4195-a662-58f936c79dea", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124636, "uuid": "acc0b4fb-a7c3-4d7d-a3c6-e7339c8b5e41", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124636, "uuid": "25f7804f-c392-49b3-9777-8a44ccb330f1", "value": 1439286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124636, "uuid": "49611da1-e78d-4c01-bd15-a2ce8d6fa602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124636, "uuid": "a4405755-fd3d-4a6a-8838-3a086743f6ac", "value": "ff943b3fd9613b5658296ebde28a4d54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911cabd6-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184385, "uuid": "e0a1ee69-d6d5-446b-b371-6b0708a27855", "comment": "Malware payload (Amadey)", "value": "356571ec897221d0f2f99f7181e89f6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184385, "uuid": "58ca9649-b318-4162-991b-fb2163fa7657", "comment": "Malware payload (Amadey)", "value": "359645969d8ff4b3a27efdbb1a30193558a19f3a6ab15d4cea6b594fe52f2c95", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184385, "uuid": "89d7eb79-cc07-4ce0-bb30-f6450577916b", "comment": "Malware payload (Amadey)", "value": "8c07d8be8b356270077e131f555e686d1e4cfcc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184385, "uuid": "326a79d5-6438-4f58-942d-20d8a2f40e46", "comment": "Malware payload (Amadey)", "value": "180dde4249e7ebb0740fa376c37bdf47453f2b169e96fb3fa518e4d5d7f112a5c7e42b506256c08ba36982f0659a802f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184385, "uuid": "fd379039-2a3a-49e7-8959-ca64cbe925d4", "value": "T199C41213ABE98077D4B52B7018FA03830B307C729A78236B7795999F0872BC4A57577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184385, "uuid": "8d4a4300-094c-4b2c-9e87-ce1945e33e8c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184385, "uuid": "7a9945a7-be07-47ea-83dd-6739c6524819", "value": "12288:mMrgy90Gbo4h3WlfBsmKSCyiidiXspQy:iy5RhoK5yldrQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184385, "uuid": "1703ed9a-6ac2-4ec8-93f4-8545126c5dcb", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184385, "uuid": "2d071e5f-5f79-44b5-888f-2d8110f6a11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184385, "uuid": "8b95985a-b0f9-4957-9bb8-369128d72c8d", "value": "356571ec897221d0f2f99f7181e89f6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6e1036-32e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691166932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166932, "uuid": "b6a8158c-dc2c-4361-9260-09184e4da77a", "comment": "Malware payload (Amadey)", "value": "27c66bfe5c21935c8f064c0aab0dbe89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166932, "uuid": "d7dbf33f-68e3-47ea-aad9-adf8a494f7eb", "comment": "Malware payload (Amadey)", "value": "35cd1f3535cb47234d274c528cbb7eae6f4aee5d2a573c0f25fbe867817c1294", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166932, "uuid": "618e6867-8c17-4e30-9cbd-d4b77dd33b83", "comment": "Malware payload (Amadey)", "value": "4b8b42d1044ce0567f27c26de26691d2e80883ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166932, "uuid": "cf4a3812-ced2-45c2-b88c-dbb39b95fcb6", "comment": "Malware payload (Amadey)", "value": "0e4caa8bd53dbcfec50e47294d44088d87ffeb8fe9170b5f46dd8a80d004a9021af0448b64785a60437eb1ea7a88b2bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166932, "uuid": "31288fd9-53b3-4f73-92d3-03b647bcdaa8", "value": "T1B2E42313BBE85032DCB91B700CF643D31F3A7DA19974436A178A688B1DF3A54A676327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166932, "uuid": "5d733c1d-94bf-4733-94f4-28e4f4e6d74d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166932, "uuid": "bc24e70d-6b19-4fa5-8aeb-3e84e08b7bde", "value": "12288:FMrPy90/h+o3OUSnhzdRQZzf832+4xRSpSY/WMrH/Kd5v8hPXB2ht:myxRzdiZg2+4x0g8CYRQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691166932, "uuid": "454f4d8c-3288-41c0-9f24-a8aab7873a01", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691166932, "uuid": "5916cf5a-de69-45d9-9f8b-9d10ce180e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166932, "uuid": "dc291485-02db-4176-b422-4e794188b926", "value": "27c66bfe5c21935c8f064c0aab0dbe89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c29005-32aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691142041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142041, "uuid": "d4546e6b-0d8e-46df-b585-a265c1ab9592", "comment": "Malware payload (Amadey)", "value": "eeb0142086e917848fc77ad278960280", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142041, "uuid": "0bf33c9d-d91b-45ed-83ee-92132734b948", "comment": "Malware payload (Amadey)", "value": "367cae94f078052ba0f3b19c5ef9f78d8792694c68688f45b929acb426744f7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142041, "uuid": "7a5badf7-0536-4ca5-b284-0edbd07f83d2", "comment": "Malware payload (Amadey)", "value": "4ba2ad81844afab6fcd5a3ccd0d39e0e37a08942", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691142041, "uuid": "ae576a5d-c1ff-4ba6-9333-6d0f12faeb8a", "comment": "Malware payload (Amadey)", "value": "5d721b88f5bd2296c905ea7b23e1fe52d58f0a20b79fd8285db0b86a4e40252ce184991a5104bcf1b4aecaac4908195d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142041, "uuid": "c31d84e9-fd79-4548-bcfc-e27b6808d188", "value": "T145C41267EBD95073D8F207B15CF603D70B31BDA28974531B2B929A1E0C73684A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142041, "uuid": "fa69f68b-4c55-4a96-8680-c88308ed57e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142041, "uuid": "da42ee0b-e563-413f-be25-709494634046", "value": "12288:OMroy90BvAri5847PdJAD7068+/bCi/qGfX7xAiAOf5gz:aySAW247VJAD70j+jCrGfKEiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691142041, "uuid": "590663ef-407f-4487-8aec-33153e38218c", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691142041, "uuid": "47e23885-f077-4f2e-af53-7534f2b513d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691142041, "uuid": "b2d7b669-1c7c-4176-92e7-efde5b0449ee", "value": "eeb0142086e917848fc77ad278960280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a42c902-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130123, "uuid": "1396fc57-ce8b-469a-b21c-e17e1a2d272f", "comment": "Malware payload (AgentTesla)", "value": "c6829954a623c82190fe31e445edd756", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130123, "uuid": "a7dd7932-7bdc-4dfe-8570-55cac51dd6a1", "comment": "Malware payload (AgentTesla)", "value": "36c15da245c3b9a2bc01bf408f5d9ee73f484d9a010a41a09a8ddf552eed7dc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130123, "uuid": "6ca8db2d-f9dd-4e78-951c-263347d2d50e", "comment": "Malware payload (AgentTesla)", "value": "1e9269cd2682575c01a9108d8d314eadedde6b17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130123, "uuid": "de66c2c5-863e-4857-a596-01f882032f8c", "comment": "Malware payload (AgentTesla)", "value": "c7b840181f14aa5ba419627c81c2a282b014755c12a29c7b373992bd1eda160fb8661fcf512d6e0a6171e90e419adb6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130123, "uuid": "ba1ae3c0-d1cc-49d7-aa85-b7d1ed9660f9", "value": "T1F8E4135875E6E733F03AC7F998E1E4312BB85D26A031D704BCE957E46A32F860542E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130123, "uuid": "160d1e79-95e9-4354-82ac-40aa9f87b999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130123, "uuid": "a95c7ec8-6fed-4b70-8500-ab489455e1b1", "value": "12288:2+1YYQvjOru9OR0GowmB2zPDJqOWbTg4LRm85YFDEnQY:2+1eOzm/abJdWbTBL48GenQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130123, "uuid": "4ab9ef9a-5f01-41fa-8b27-abf930adcc84", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130123, "uuid": "e829c46d-06f3-401e-ac3a-81f2a6f1114d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130123, "uuid": "f01c5383-9901-4b7b-b814-d2b364ceaacf", "value": "scan20230717_16422889(1)pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed1df78-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130104, "uuid": "84af035d-788f-4af3-a0b9-4869cac1f219", "comment": "Malware payload (AgentTesla)", "value": "0d54939452f92d7a7dc17f43cdd2fd12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130104, "uuid": "9c136f93-59f4-4762-a483-e3ba2bbb3e91", "comment": "Malware payload (AgentTesla)", "value": "372293f19446ed57ca833445d5d1efd66a6e4fc56ce5fd3164de5077845f2e87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130104, "uuid": "256d9cc1-4597-4372-9b04-0d8157d4aca8", "comment": "Malware payload (AgentTesla)", "value": "be05ff059c601776f08d2630c1a16dab4c84505d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130104, "uuid": "3f5064c1-8d83-4238-aa0a-8f0dd090611e", "comment": "Malware payload (AgentTesla)", "value": "dbf8b06414a2898c5a5556293e746754bd362c86a0c30d0a90a529334530cef98a9e062f00c0acf6b7eec11110baf2ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130104, "uuid": "d9b3d70d-cd2e-44bf-af8a-dc5075944a6b", "value": "T186E4224921F96F6AF12ECBFE58E4E4345779E96D3D20D389ACF656E359307800890E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130104, "uuid": "14dd0087-95d9-49c1-b66e-d8a4c23a5f06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130104, "uuid": "bce6fd88-3f6d-4794-afa2-2d8819e843d2", "value": "12288:F+1pYQvjO4BJ/+PMfYM9muT+rQxEN0LxtpGanZIEcX:F+1nOW/+PyY0muarGLrUaneX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130104, "uuid": "a4bd5c20-d040-47ea-9070-f393f1af1f31", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130104, "uuid": "0c8f83f8-fb8b-4cb8-b1f7-78697186f0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130104, "uuid": "0dbb4f95-529f-4106-9306-2fafa6834285", "value": "AWB#102935516763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7cd876-32c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691153459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153459, "uuid": "e151855c-4204-434c-ad24-c00653a4b290", "comment": "Malware payload (Amadey)", "value": "2c3f4753a74db8673017f906362266ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153459, "uuid": "8cc5b0a6-7075-4e77-9ce0-2b076b233079", "comment": "Malware payload (Amadey)", "value": "37781d9a4f7d71a056702768ddeef49eee25f1ab630345d88f0a0b167a986b47", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153459, "uuid": "769d969f-6f72-4fc7-aeea-086a99b05239", "comment": "Malware payload (Amadey)", "value": "d787909836a62e91408d4160ebb5bb7d27e4eaa0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153459, "uuid": "5add7b3d-626a-407e-8dc7-c134c9407c7e", "comment": "Malware payload (Amadey)", "value": "9c630c7c8140c9e29228ee7604b0b4150a462ddaf87979948bf0f08f1e59e0479bcb1be61c7b5e34fdd938b704ed9566", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153459, "uuid": "e0282796-ddf4-41b2-9435-f5683a03ff86", "value": "T15974F153F6D88432EAB61BB098FB03C31A357CA1A978836B3285595F0D73294E53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153459, "uuid": "330621e9-9079-467a-9122-cf59731174ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153459, "uuid": "a58a97d4-2238-4cf1-9d63-e3928cb367db", "value": "6144:Key+bnr+3p0yN90QE0rwVIKY8bcdGDykp42vvzblahUtPHX0aEiRDhZu:+Mr/y90qrmYMcdGWkptvvlahgHEGzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153459, "uuid": "8c880835-92c7-4386-93e3-fb023697de4f", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153459, "uuid": "2c4c2ee8-9b09-490e-beb3-36a0f97ecd37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153459, "uuid": "c0f7bdc9-710a-4d44-a4ec-c75f933032d7", "value": "2c3f4753a74db8673017f906362266ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fd9712-32f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691172936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172936, "uuid": "a2a92df2-ad7b-4470-b082-6a892ca43de5", "comment": "Malware payload (Amadey)", "value": "03c24512027f5346815f285a941fa6ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172936, "uuid": "7ca33869-045a-44ef-901a-dac3131e021d", "comment": "Malware payload (Amadey)", "value": "37b31ab19be0ca1c07ef516a9ffd013c1344f3d421011f09ab5d14cb9b6d7f93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172936, "uuid": "eb76c2d2-53fb-44eb-8cde-69ff71a13513", "comment": "Malware payload (Amadey)", "value": "bc450037366ccaba36fca04b5f8ac28030a7db0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172936, "uuid": "dfe1ef4c-4fa8-4016-989e-f4de7aed42b8", "comment": "Malware payload (Amadey)", "value": "dc885bb63a2a9f866920118d6508a0b780768bca4607f628fc3744627ca856852bb442beda03002b23cf33b6cf16fdd4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172936, "uuid": "be0cec6d-f863-46cc-b672-3c61b3f019e4", "value": "T12EC41203A6E88073DC7113F098FA07970E3A7C769878875A23469D5F2CB3A94957277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172936, "uuid": "2b080c17-c417-4911-a056-2b287728d0e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172936, "uuid": "40413ed1-e3cf-46a8-989b-02ba1f97af8c", "value": "12288:dMrAy90CFwHjaiszQRr9n2gBYCSiTEV5mXihEe:JyK2isW9VzSV5mXFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691172936, "uuid": "dbafde12-cc74-4526-bcdb-6189628ba59d", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691172936, "uuid": "3f0259e3-3919-4d39-a4db-51737c4fb150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172936, "uuid": "9d9bf78c-ae30-4848-b701-51d7642b5021", "value": "03c24512027f5346815f285a941fa6ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf3f953-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691130235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130235, "uuid": "dbd2f952-bcde-4af9-ab06-7e276cac805e", "comment": "Malware payload", "value": "2897393cd2869de31bd091636dd9c98f", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130235, "uuid": "3a6a9dd0-de42-47be-a336-d1dd9baef7af", "comment": "Malware payload", "value": "37e8212679a5294cdb553acf9f21711d769b99418b76841f81787de7778b58bc", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130235, "uuid": "425214be-8d35-4e50-955a-4f0915cb0bbe", "comment": "Malware payload", "value": "b871ee46780b57e2757c631354750acd111dbbb7", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130235, "uuid": "ec4ccf10-95dd-4966-81e4-c5333940ad8a", "comment": "Malware payload", "value": "5b21057c76df356c930b222da2c12d03dd1fadcd04fe34314db14f612dc6f212bd73d4e8cf6ba331085cf8e04fd3d5fe", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130235, "uuid": "b7824c8e-11d7-465d-be1a-7fbe5c9c2130", "value": "T128D42364C504B037A19A2F3D3D17430A11A97635A3CB1F782BA537A793F36AF2948D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130235, "uuid": "ff6bd722-520e-49da-af65-b14dc16f1b80", "value": "12288:ZvgsdZlOJu/9Cs38ql9Zx/wJj8qGYSFELJSnSYrg9v1GWH:ZosbB78ql9ZqJj8qG5nShMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130235, "uuid": "1459ede6-003d-4cb2-968b-6e22495595f9", "value": 646670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130235, "uuid": "47cfc239-36e9-4934-b75d-7c804657601a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130235, "uuid": "aa6f1298-446e-4732-bfe7-0a1e9da1e67d", "value": "factura.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb4085e-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691124112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124112, "uuid": "d6c44219-c664-412e-90d7-dce9e3230fb7", "comment": "Malware payload (SnakeKeylogger)", "value": "bedf47c525e99bcb13c49c344328a043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124112, "uuid": "e406b617-0b18-4189-bc14-4f00d7aa88d4", "comment": "Malware payload (SnakeKeylogger)", "value": "3afb5c492e8e260ee632c4250d6e15b1dc09b4b2dea750bbb8a5dae28d3163cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124112, "uuid": "5ce7e9e7-1276-454e-bdc0-ba6bc0918cbf", "comment": "Malware payload (SnakeKeylogger)", "value": "6b0d6a389fb5712d3a2119bdbc8e12814c0630fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124112, "uuid": "6ddf5ccb-290a-4169-bf97-d947221ed87b", "comment": "Malware payload (SnakeKeylogger)", "value": "2fe91455671a7fef50f6353a08bbc6bde1e07abf28c07df136a2452076aeba843bbea2d97f275a912f9f62de78029f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124112, "uuid": "889f66be-e4b8-4c50-9c38-e3147400a26e", "value": "T10BE4122921D8EF3AF97D83FA40A5D5315378B9251911CB98ACF9B6F2163378148C2F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124112, "uuid": "a7d61829-a6bc-4331-aacc-1ab11383b0dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124112, "uuid": "2e88c6b2-6c95-4835-a99d-6e3ec2f55ff3", "value": "12288:s+1kYQvjO2/glk6kUsrEQL3814B0+VNm2VVP6g8EroFvqN/IzhhUZ:s+1aO+4berEQxBpVE2VVP6pEroFyyzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124112, "uuid": "40b3b866-f298-42fe-a466-415a5eddc430", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124112, "uuid": "7bc9ab59-d7e7-4021-b9f8-ffa735b207b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124112, "uuid": "321a8fca-f631-49db-b28b-1397c36622e8", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cadc7ec-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691114746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114746, "uuid": "8b0015bb-8891-43b6-9fa4-6d4caa184385", "comment": "Malware payload (Loki)", "value": "bf12d52e040eaa94d009a8b8f52de415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114746, "uuid": "361b3161-ba92-4469-8cac-2f38ec18c1b6", "comment": "Malware payload (Loki)", "value": "3d02cc73d3e7fee96d1dd2f1ddb296fa2d1c7325283dc064495c57d3b07ce30a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114746, "uuid": "1b6a3f95-dd02-4963-b924-93194825fb2f", "comment": "Malware payload (Loki)", "value": "e99adc63a1cf9762237446b0e58ccb35ec3e25f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114746, "uuid": "4f31a82c-3bf9-4ae9-89ab-9907509637bf", "comment": "Malware payload (Loki)", "value": "869dbdd7dc52b51978051ed11c7833f560cf784ecfdcd17dfd7a6209452464f43e88ca12645b06262dca103b48e0a384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114746, "uuid": "46782ac2-d5c3-4cb6-88f3-df13e067e5a8", "value": "T10405122B67500145E51D81702BB7ABA5BAA52CB78C604906FB8EFC0C7B7DA47F4E510F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114746, "uuid": "6466fee5-b939-4a66-8306-c8058526586f", "value": "6fdb4baf9fe5d2968b207d4d6b7dfa34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114746, "uuid": "01482a6c-1fc6-4c60-bd18-6d3f94d1bdc4", "value": "24576:6PskXqS0jFC6LkpzxU2fudPFcSA/Jd4nS6PS:6JXUJC6LkpzxUtdPDA/j0Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114746, "uuid": "aa34100c-ec7b-42b6-8553-5c03e87360ff", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114746, "uuid": "5ecf97a5-db4c-42eb-afde-d5ba4854ca8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114746, "uuid": "04d1b22a-4d04-4805-bd07-8261a74dac13", "value": "PO&DESIGNS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee01ee4-3310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691185589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185589, "uuid": "f9f7c73f-0a4f-4585-a1e1-fef76bd3e00d", "comment": "Malware payload (Amadey)", "value": "59860566aff07974265fa1a2f51719e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185589, "uuid": "04f1e779-cb87-4bb3-921c-7649cfd20d17", "comment": "Malware payload (Amadey)", "value": "3f59b60fd2eab250b14a465cd1151ad17c265e8c7997fa7de807e68537c689ba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185589, "uuid": "8b99105a-714a-47f4-8a1f-afdb90472552", "comment": "Malware payload (Amadey)", "value": "fd3984dda606e039efb0cbbeb1134639d3f17454", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185589, "uuid": "0ffb7c1b-9967-42fb-93d6-48b932b2efd4", "comment": "Malware payload (Amadey)", "value": "43821fa21260bf22eeeef607d5360e041596db332f19e12284834f576934abc21f4afe0a4dc37f798937bbbc74396a7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185589, "uuid": "a4604960-8cb7-4254-9a23-6d4c3a46160b", "value": "T13AC40203EBDC9072D9B467B058F212930E35FC629DBD826A63959E5A0C336E5B970337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185589, "uuid": "ea6de41f-be9d-4e4e-afbe-d7b31257ae0a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185589, "uuid": "2c5162b2-9d1c-4ce8-aa6e-1838ef9bae60", "value": "12288:wMr6y90AC/z3Ux0ZxhKSx0QK4Q1jbJgBYCQzdLkn7pxU:ayebU8hzxZKfbSzx9xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691185589, "uuid": "61f560f8-8131-4b22-935d-b588b713a1fa", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691185589, "uuid": "93ada756-d99c-488b-90e7-2a0c5a54cc8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185589, "uuid": "d81666f3-9ed6-49c9-b736-32eeaee9f90c", "value": "59860566aff07974265fa1a2f51719e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b17ce46-32f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691175195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175195, "uuid": "9d4cdcc4-9332-4957-8b96-3c2c4d06a18b", "comment": "Malware payload", "value": "8b001b5380ecf7edd60d827b9b2b5c24", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175195, "uuid": "bba02866-0930-4d7d-85a8-54a3038c575a", "comment": "Malware payload", "value": "3f7c851d9c81b6a213b33c3db9a098d71deb661075347a7b6889f61fb105c62d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175195, "uuid": "62cdb261-5379-4578-94ed-8a183a81731f", "comment": "Malware payload", "value": "67979d5abf0319e5172c4a73ce1377be800160ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175195, "uuid": "96e0ef2a-948b-4f20-8d99-38127edf4f0c", "comment": "Malware payload", "value": "f33dc3e31588eaa1191c9ba8910453d29eddc3ec0c94452180fff1c5e87af4ea2162138ced719ab2a7cc3f8155f96051", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175195, "uuid": "ccfa959a-9051-436b-81b5-5a5742df1d0c", "value": "T1D0B3BD9FD8D783E0C3B1DAF3A32A4E87CC5E5494F32A54E17CA4CB2489931671A4D26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175195, "uuid": "20631302-5462-4ed4-b43d-bde1f27acdfe", "value": "768:ojqVF0u0Nhwx/kSEdya7aGhfR6o4eU5cKnChe+i0BVqbUiZqS15pgWJJ6Q:Uu0NhwxrAv9/YnAGqSJgWX6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175195, "uuid": "aa0a24cc-49d6-4cdd-9641-689a6480ccf4", "value": 111779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175195, "uuid": "910a116a-cdad-4a80-a1f3-b6f2c9647874", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175195, "uuid": "d1b5121a-739a-4645-8fda-c2f1a536669d", "value": "F.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59735c3e-3302-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691179567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179567, "uuid": "887f8187-2e81-4765-af91-8df5aa97b343", "comment": "Malware payload (RedLineStealer)", "value": "0b8dd039210eac3c39e707d78f7c2962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179567, "uuid": "636c87de-b4f9-4cfd-9f45-77aacc38ae67", "comment": "Malware payload (RedLineStealer)", "value": "3fc72715790474b66a427381b35fdc23dee51c62303071d7130e57d8aeee8797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179567, "uuid": "52d3b443-3dc2-4595-bc04-517dc134e83e", "comment": "Malware payload (RedLineStealer)", "value": "415a6881721c698dc9f9ba1167900a5040ca4dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179567, "uuid": "eecd3457-4f19-4a90-a80b-57ba3ec8012b", "comment": "Malware payload (RedLineStealer)", "value": "c3246dbc3e661ce8e173f9450c1d25f6934b70008292497779e1e85e89a8581cc376e0ab2a216b8e982afaf3024f38da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179567, "uuid": "ae19bf7f-4687-4b15-97e1-7811ae62ea92", "value": "T1C1C41212E7FDD073ECB62BB04CFA06831A377C6159B593AA234A994A4C72284F531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179567, "uuid": "070ff0e9-82c0-447b-887d-3dadbf9f94eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179567, "uuid": "5490ebec-4ffe-42cf-a672-549076041b33", "value": "12288:4MrUy90Z0fmcH8vTRdXnEIEgLns6eelvd1aFi:8ys0fRWT4YFNvrgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691179567, "uuid": "0ee5a178-e090-4e8e-82a8-043a5b724da1", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691179567, "uuid": "835203a6-be9b-4d25-89e4-dcf569f62125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179567, "uuid": "e4a1d28f-1710-466d-ba38-d6bf3be7a8c8", "value": "3fc72715790474b66a427381b35fdc23dee51c6230307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b33de9-32f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691173409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173409, "uuid": "d300a4fd-70d8-4b4d-800d-31e1d1977dd0", "comment": "Malware payload", "value": "6d674909700b2f8a4ad958b30b1c6471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173409, "uuid": "369a7373-43c0-455c-b23c-6ea19219bde7", "comment": "Malware payload", "value": "416f7209e9e97a77e2c70237cbda1709890eedec436f67fb3b4d09135128241a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173409, "uuid": "8ba565e8-6db1-4c9c-8533-1e28d02459dc", "comment": "Malware payload", "value": "77a918cf6f628d9fb9fe21af0afd509575cea6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173409, "uuid": "bfeb7107-a14e-49fa-8cbd-ed3a1640ced2", "comment": "Malware payload", "value": "850d918b3e61f0e6c8e8d83bb1deaf12b6c2d5f61ba8c9e4e2893e0397ea60a6575f0d5a468889816dd24109d993e3b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173409, "uuid": "4a9be4ec-0b29-43ab-a60c-98c1c70265b4", "value": "T101643B0362A17C55E5224B369E2EC6E8375EFD91CF187F9A1318FE2F19B11A1C672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173409, "uuid": "ce40214e-d6ed-4b9f-9841-3ce93992a5fd", "value": "e9d58d04128ce66edda6debd8a6afcde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173409, "uuid": "6a270798-2a48-40d6-902d-c95771e8fc9d", "value": "3072:O3Xoii3MN6a7mENprEOD+4UfcHU9wAb4yv+mjg06shA7xOzk:Oo8jyEzEODC0U9wY4yv+oT65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173409, "uuid": "db220d7e-f9ef-4e99-83d8-0f04b5b2c2a3", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173409, "uuid": "b84f8caa-0ec8-4a7d-ad55-26d56de3640a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173409, "uuid": "d633e6be-a71b-4b90-a314-3476e2247199", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb1515e-32fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691177155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177155, "uuid": "66a7df22-e445-4ae1-b959-92ae134523af", "comment": "Malware payload (RedLineStealer)", "value": "a821091c5f6d7b5bacad73604939b1db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177155, "uuid": "884c6f88-f60d-437d-8971-06a28905d191", "comment": "Malware payload (RedLineStealer)", "value": "425896a367d4ae3d8e6485689c3bdc2d18c46821219960bb31ae1011ee86beb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177155, "uuid": "88481c36-3234-4af4-98af-c8ce7af30644", "comment": "Malware payload (RedLineStealer)", "value": "33850edd2d48e900491cf5ee9e9072b123809d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177155, "uuid": "a6e52d3b-1d15-455f-a2ca-e9c2e571fc9e", "comment": "Malware payload (RedLineStealer)", "value": "eff00c8c4213040aa095e57923a4eb419f6c3212622d27e63e38dc4317c41bf55be72ea18d15afccda0e38c8ed108f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177155, "uuid": "c273f541-8912-4542-9025-ac05862e8d8f", "value": "T1BB03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177155, "uuid": "2c5fabee-2d04-4a7b-b43c-739427a3d736", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691177155, "uuid": "a2040aec-0919-4236-b764-3562940e8c44", "value": 40400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691177155, "uuid": "a91c0c90-7643-4161-9d86-69c54e3c5f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177155, "uuid": "6a4ae709-2ff0-469a-97bf-7d7e416f9ca1", "value": "a821091c5f6d7b5bacad73604939b1db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e36291-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173260, "uuid": "7e36e093-425c-4d04-938a-27c9d2890227", "comment": "Malware payload (Amadey)", "value": "5c7d8ea2f779883d875724cb2f6de02e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173260, "uuid": "384a03ed-e0e5-4061-8eec-39c7f9c2a0e6", "comment": "Malware payload (Amadey)", "value": "43f4293d0f7ea3ec8b2f24085a42125066c6afb02fdfff5cbeae5e2ca536ff25", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173260, "uuid": "efb1f062-49a5-4bdc-aaef-1d881e2c0f09", "comment": "Malware payload (Amadey)", "value": "e73cac62175b91c36957f0939b7ffc688fa2af05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173260, "uuid": "c7b3c19a-8014-47e0-991e-f1a7ba8a05dc", "comment": "Malware payload (Amadey)", "value": "89a605001b03e987ea811f5d24f4f15c580110592064aba0e3a899b4d35467f870b38a33c723b336fc54461ffcb00eb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173260, "uuid": "333e5efa-a04c-41be-9444-55ce9cc70f5e", "value": "T137C41252A6D85072DDB42B3044F713C32E32BC615C39832B2B869D8B5DB36D0A9757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173260, "uuid": "59e41876-1ec1-441b-96ed-d65f46b40238", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173260, "uuid": "9733b1d4-4adf-4579-98f0-bcd0047fee56", "value": "12288:wMrQy90PtdvH1QKE5k2GoGEpDkUOFLrfDP:wyED9QKE5kHoGEOxz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173260, "uuid": "9f2f51de-7f4a-4bd9-8c15-8031f256a958", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173260, "uuid": "06d27ed9-b16e-4416-94b2-38adcf64710f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173260, "uuid": "bd558947-6361-4a2b-9ad8-2af372d4cd44", "value": "43f4293d0f7ea3ec8b2f24085a42125066c6afb02fdff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da5c26e-3318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691188889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188889, "uuid": "b6561594-bef1-49a6-a6f3-be5c2426db7a", "comment": "Malware payload (RedLineStealer)", "value": "d56cb939c6bbd423fc1c9666de630612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188889, "uuid": "2efd8d9d-ab2b-4a53-b290-9f0698378c4e", "comment": "Malware payload (RedLineStealer)", "value": "45f696a1b9a18e4f0ad119667cc91192c96837f096f505a342e34bbdbd681a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188889, "uuid": "7647b5fc-5040-4fce-8a27-4b3d79cc1907", "comment": "Malware payload (RedLineStealer)", "value": "a93e7ae6617c8550752528fb7228fae5d410b805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188889, "uuid": "fb84e28c-8c93-467f-ae99-faca64a02eb1", "comment": "Malware payload (RedLineStealer)", "value": "8b3572bad3bd1a3fb52685151f076ed7320986e4ea18f8a9edc52418366ab24acb228ce3eb9ebf34008a6233c84926a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188889, "uuid": "ac003a5e-271a-4677-8351-b27d3c49d330", "value": "T142E41223ABE89572DCB92B7018F642D71B35BC944834531B2F99A84B1CF32C8D87675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188889, "uuid": "8b6a7076-3316-45ce-9a09-baa4c44538d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188889, "uuid": "31a31d34-349e-4fac-b909-aff707c48de0", "value": "12288:DMr4y90fRO4X9Eh1GKJ9xysupVaSQSQ/N4HUtgT0tVM8OdE:3yCRl9gGeusupVWD0sgq2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691188889, "uuid": "1bd18ba6-5f68-4262-9b86-a85cbc41fb91", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691188889, "uuid": "0b52004a-2594-4d3f-a1b5-90e8f4548b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188889, "uuid": "ea6efa5c-9be8-4dac-b051-20b02aa01a58", "value": "d56cb939c6bbd423fc1c9666de630612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf1d20c-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124410, "uuid": "17aa56a5-dedd-4905-b110-0ad759960b19", "comment": "Malware payload (Mirai)", "value": "cc64d7b9eac459431850bd5919f5ed83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124410, "uuid": "26c6f845-1a85-4b43-9746-4ba4be3a05ab", "comment": "Malware payload (Mirai)", "value": "46713493b69d62324233a55ab31ecdca7ff01286a0845f44b916caf8ac28b046", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124410, "uuid": "1ba99178-902c-469f-ad9c-67be9559ea4a", "comment": "Malware payload (Mirai)", "value": "1597b1e3140e288773e18978660455634a2bde8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124410, "uuid": "0ae45abd-217c-4d3a-9b83-ed87988277b5", "comment": "Malware payload (Mirai)", "value": "8a43a6bcfa3bb0a1bae0baae615603d0799551d95e0ada09740b04975def5aeb941fd469bb1b289f92ae4b6215b26cfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124410, "uuid": "eac77610-ddcc-4242-a842-8d6f1ced927e", "value": "T1C0C2E130A7D2E02296101DB9FFEB1304135E06A9F947103ECE499264BDE338766F59A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124410, "uuid": "6939b5cb-4797-4ea1-a120-5af6981b7478", "value": "768:WhH8K4pmX0uey+r0gYvQoD8O2wTMuE223UcA:W9A8/Dh8mTMuEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124410, "uuid": "0fbec5ba-ff04-481a-a3d6-beb5894259a8", "value": 27864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124410, "uuid": "bf50e0af-e1d9-487f-a820-bab3a8ba4737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124410, "uuid": "c5ceb01c-9ce2-42b1-bad2-c4da7a078f7e", "value": "cc64d7b9eac459431850bd5919f5ed83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e670d682-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124399, "uuid": "a0d72649-ac47-459b-9df7-6c40df5ee592", "comment": "Malware payload (AgentTesla)", "value": "0cd1d677dfbe225c32920d6868bafbad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124399, "uuid": "07593529-6ca4-4434-9938-fda64ecaec76", "comment": "Malware payload (AgentTesla)", "value": "470416e54c0748d4bf1b81d87d165314068e518f441935a839234be285254fb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124399, "uuid": "f3625369-e2ce-4e15-b4d9-9e98014ed4a3", "comment": "Malware payload (AgentTesla)", "value": "866c94e542ed8aa31385f1a5b9b911b9dc7d0fca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124399, "uuid": "3b81e40c-4012-4591-9bc5-1d8188377c1d", "comment": "Malware payload (AgentTesla)", "value": "547d79425da65a11e2a03a9dc05e795fcce7193d1034a078778e098fa85160d054f9676a1143b8c69757d1b01a20caae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124399, "uuid": "84d1684c-02f5-4f9f-88c3-26837c20445e", "value": "T18C150826417B60B3EF497BBC5A13C87A359C6B40A0F6E298A32B34D3C5C61125D3A7F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124399, "uuid": "6f8767b1-a396-4746-aeaf-5eeef8c1218d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124399, "uuid": "5a915b5e-3415-4999-8cda-9e6e13faa1fc", "value": "24576:iY9vceD2Bzr4ojpppNpppppoOQpppNpppppoO0uayAeUgUzbuFBdH:QSO7O0AAeAuFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124399, "uuid": "1fc3ff41-2667-4c12-989a-02c04c116286", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124399, "uuid": "596f1515-c539-4611-8285-d48139c580b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124399, "uuid": "dfa6208e-be03-4f1f-8b31-d7156f6f64d0", "value": "PO (0011 - 072801) 30PCS.pdf(151KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05800b8-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124764, "uuid": "ce768d9f-3dd9-4d61-963b-dc69e7288357", "comment": "Malware payload", "value": "eeab7deb438bca3a5a212e9d7dfb0d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124764, "uuid": "b1440e0f-57d3-4192-99b6-1a12a9a99ea6", "comment": "Malware payload", "value": "47d2765b9781d1c725fd482914269fd7c663f9fd8e975320996fe67a16b1eac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124764, "uuid": "5751612c-8d59-409d-a9eb-7bd24da1c149", "comment": "Malware payload", "value": "d128e7b36e410e7df77194d8a955c91a44917a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124764, "uuid": "44c4a24c-c206-4380-acd1-5c47e55e2b19", "comment": "Malware payload", "value": "43c245af1ad1cd4689b0fa65f8c03a348f4ce788d85a6d37b48ea6c983398aef52ea2fbce23ada20e6c9f087c0f2f369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124764, "uuid": "17a30932-73ae-4da8-abca-7080b069b407", "value": "T17B44D013A7E89072DDBA27B018F603D31A35BCA15D78935B17926C5E0CB3681E97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124764, "uuid": "df286b20-351d-4ec5-b45c-3660797d766e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124764, "uuid": "a3eec9c8-8130-4de4-9ca2-f325657eeb2d", "value": "6144:KPy+bnr+Qp0yN90QE1jDILpGU80IgtGtJx9Z:VMrsy90bs8gG17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124764, "uuid": "ed68ae50-1fc8-4a21-9465-a2f827b4cfdb", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124764, "uuid": "c875197b-128c-4b92-9eac-bf4f147991b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124764, "uuid": "572346c5-2d02-4187-9e7b-013338dfb345", "value": "eeab7deb438bca3a5a212e9d7dfb0d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c695d4b2-32c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691152263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152263, "uuid": "32a82ec7-f597-42c1-b8f6-1f7748402b13", "comment": "Malware payload (Amadey)", "value": "1c82726c547eabfbcdd66286028ef19b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152263, "uuid": "34b4255c-5d96-4b43-9240-0da30aeb3702", "comment": "Malware payload (Amadey)", "value": "47f368ed98eba15c08b788efddaa8208e0b813bd3c985686a051ce77aad1840e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152263, "uuid": "bba85ce4-dd4e-4e40-add1-7955bcea4118", "comment": "Malware payload (Amadey)", "value": "24b53b7fff8ae364119e89fb24de24d2b918ecb1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152263, "uuid": "4a19ccff-8b86-4daf-9f6e-809df154a9e8", "comment": "Malware payload (Amadey)", "value": "dcc9be8073396932348299a62ee838e64947d61c71792a678847985e0644d34839548e274183d1304cc86914a24f7a02", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152263, "uuid": "09585a41-ec5f-4578-a56d-9f13140f0535", "value": "T1C603F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152263, "uuid": "0db9fb0a-1249-405a-92d7-140896cedc47", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691152263, "uuid": "6061d12e-075c-4efa-93d9-daefbd1e73ae", "value": 40361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691152263, "uuid": "f8841a63-b0e0-4f8a-b9a2-b4c76d6da69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152263, "uuid": "412a326f-a748-42ec-8ced-94236e43ae4a", "value": "1c82726c547eabfbcdd66286028ef19b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19342783-32a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Merlin)", "timestamp": 1691139516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691139516, "uuid": "9a05c2f6-f1cb-45ac-96dd-f9c0719d42ed", "comment": "Malware payload (Merlin)", "value": "27822be7809142a1c359312b6f5ab6a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691139516, "uuid": "d28f53c2-803d-4a51-afd4-3b68e0cb1ae6", "comment": "Malware payload (Merlin)", "value": "48a70bd18a23fce3208195f4ad2e92fce78d37eeaa672f83af782656a4b2d07f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691139516, "uuid": "98b2cc33-316a-402a-98c9-7c77a3d5cae8", "comment": "Malware payload (Merlin)", "value": "81af90eed795025c48bca6c8b0b278361f0d977b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691139516, "uuid": "f436fcd3-1878-47ed-9cfb-539ae3d8e028", "comment": "Malware payload (Merlin)", "value": "7dc8b8b5d83a89ddb8307916ff7d00aa7fb957cc30a07bb709c1286e4243f6a1560644642b36c118b2e35bae14f64797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691139516, "uuid": "32d858fb-2b6c-42f3-bd78-e6e7cbd7884d", "value": "T19E076C47F89245E6C6FEE03486929322BE713C65C73077D35FA0AA6A1A75FD4A93D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691139516, "uuid": "f409ad18-29a6-432a-ae88-cfcd45de75ed", "value": "196608:ejMmHhL8yKXmt4ITM0//StQo0BJoxPxF4DOkIvEb09PGuiGpyR38:ejMcKX2tQ0gQ5wx80xGu038", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691139516, "uuid": "2eb929c7-34e7-47ae-8273-054e6bc792fd", "value": 17760788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691139516, "uuid": "04649c7e-618f-40d5-92bd-bda102d8a982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691139516, "uuid": "010f583c-1767-41a5-b4bf-536a59e13a02", "value": "27822be7809142a1c359312b6f5ab6a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6e31dc-32e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691166073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166073, "uuid": "70a3bc69-6470-4e05-adf5-31162445b948", "comment": "Malware payload (RedLineStealer)", "value": "06d94972641f0a594740357d26d5f2b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166073, "uuid": "cc38f609-cfe8-49e0-9145-e12f57795da2", "comment": "Malware payload (RedLineStealer)", "value": "48f653dcf2b85779b5e1ea24ec7f1ce49541a660c79d54da329efdd963750941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166073, "uuid": "f1df748d-585c-4392-9b39-42854ed92f08", "comment": "Malware payload (RedLineStealer)", "value": "11ca7bf2caf9d59d9fa48403464df0aebbcde939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166073, "uuid": "0d452258-fdfb-4351-af03-ba0baab4ff74", "comment": "Malware payload (RedLineStealer)", "value": "1b17421b519c633300c7c1a1cd375142c6770befd2d35e83f43c04e68b361d06c9b82a9a996e5be99c5350854853f068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166073, "uuid": "b4b8c0d0-dff1-4e33-9373-7c1e304e1e4a", "value": "T16374F103E7E89172D9B527B058FA03C31F3ABCA1A97453272746584E1DB36C4A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166073, "uuid": "deff9405-0ab4-437b-9ffe-190d74aa7e14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166073, "uuid": "85e555d7-ba09-4887-abdf-dc6102540b33", "value": "6144:KGy+bnr+cp0yN90QEEPHqSOOUJGzANUXxz9Z1yvmHx8W3+qvD64OQHX06ID:mMrIy90JSORszAmBz9yuKW3+qvuQHEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691166073, "uuid": "aa0082a2-1099-493c-9287-9eacfe652de6", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691166073, "uuid": "c540aebf-22dd-4b10-89f8-76b9c75058dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166073, "uuid": "da0b4aa6-f362-44ec-ab61-41955d0bc603", "value": "06d94972641f0a594740357d26d5f2b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef978615-32e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691166934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166934, "uuid": "1292eb5a-d5ae-451d-b938-a7bc93234c7b", "comment": "Malware payload (RedLineStealer)", "value": "174e4395b74e373f3f655682a662825c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166934, "uuid": "79c58d0e-d16c-4748-80f9-b0b452e6c3be", "comment": "Malware payload (RedLineStealer)", "value": "494375e330a4b284770bab1ed8b38fea62aa98d1c6e1ea9625566a201cdae90e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166934, "uuid": "eb6e1967-69e7-44ae-a645-3dfafe3b676f", "comment": "Malware payload (RedLineStealer)", "value": "2f551e87a6f6814af55fc9bb71feaea0aede9bd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166934, "uuid": "f1537cbd-5913-49ba-985c-d4531dcf50d6", "comment": "Malware payload (RedLineStealer)", "value": "95add0b85c5749cf8d4b2f471e534bd2bb828d0dba1ddbf553002aed4f674fd25ebd1707ab4dc0ee7b239f75fe5cc7c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166934, "uuid": "01cad4c7-0e6f-4805-841f-f996fed76975", "value": "T17E74F122B7E85532E8B527705CF303831A36BDA15D79936F3B48A91E0CB2684B53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166934, "uuid": "c97695d2-bc27-4c31-b845-3895e6044407", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166934, "uuid": "6a16805d-91ad-46ff-b6fe-3310a5b92faf", "value": "6144:Kuy+bnr+qp0yN90QE4fop1qi9dFTFH2YiVUzF1A2jUHfNpdMAN9bFjwN79HMcnQ:SMrWy90ifov9dFp2BSbA2MNpTljwN79W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691166934, "uuid": "a00c8e22-e4e9-4a6e-a0f3-f6ebd5c09fb3", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691166934, "uuid": "29542736-ebd4-4429-a0b5-f5be270bc434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166934, "uuid": "cd5b8aff-a18b-4992-be5a-e6395950f5b8", "value": "174e4395b74e373f3f655682a662825c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cae8159-32e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691166634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166634, "uuid": "649480c2-dc93-454d-a39b-abe904c73be5", "comment": "Malware payload (Amadey)", "value": "21c09dbf8953a3bfb385ad55344b17d3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166634, "uuid": "dbed29f5-4625-49e3-9c54-60a07ba07558", "comment": "Malware payload (Amadey)", "value": "4bc811aec7d4ff2020b2ea2ab3c2bdc5033473ee2972e4b7b98f9cbc87fb8c44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166634, "uuid": "147fc306-12e2-4b38-815c-ac3a90a60542", "comment": "Malware payload (Amadey)", "value": "4a7592598d2355cfe8935f5c58a40a33a196dd03", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691166634, "uuid": "95eb4d6f-fc18-417f-816f-aaa2a6303ec5", "comment": "Malware payload (Amadey)", "value": "4d8c55391f77899e45b561ef830ab826be12ef5377117dc1ac6e8d0d9966372450638ded75e88facf77de0ef8c106768", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166634, "uuid": "1eac423e-ed31-43be-93a2-3c80495dd99f", "value": "T19503F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166634, "uuid": "9dbda80a-b45c-4b95-9538-b9b66cb3474f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691166634, "uuid": "4821ed6c-2433-437a-b1b5-6bf6748d7566", "value": 40318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691166634, "uuid": "3cba1181-d28a-4b98-831c-1400af7d0ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691166634, "uuid": "dbefb8fc-e87b-439c-94f0-35c1c0cc7924", "value": "21c09dbf8953a3bfb385ad55344b17d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87c132f-3321-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691193095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193095, "uuid": "bdec5a63-9b4d-4a0b-b2fb-4cd37485e683", "comment": "Malware payload (Amadey)", "value": "f7af93c9f1c52291b95cd2dd568ef2ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193095, "uuid": "d70715e4-9dcf-436c-9382-d5ac171fcaec", "comment": "Malware payload (Amadey)", "value": "4bcb42c8764870be71ee3b87738fb29f1a9e96e64ebe596268d1f1ed00f730ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193095, "uuid": "f55d215e-d21d-4de9-bd4b-270fa8ac7f52", "comment": "Malware payload (Amadey)", "value": "867fe32a4556c333421cf06a54a73557de7f88e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193095, "uuid": "5664d95f-eb04-4a22-b036-86f8965d69ad", "comment": "Malware payload (Amadey)", "value": "266217d9a7294bad35151de8145b3f53ab13e8fe0990ee6eb5abadca977749188b501f37683a5c965c322cae2d775c73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193095, "uuid": "c154bd6f-f9c8-4288-9a03-5f3ddbe0b3a2", "value": "T13CC41297A6E58071D9B263B028F302970B367CA65D38537B37C55C8F0DB3680A6B6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193095, "uuid": "ee6d39b1-8aa1-44d1-83b8-3678340dde26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193095, "uuid": "844e3b19-1167-4876-b8c5-565e1cd43bb1", "value": "12288:4Mrsy90EbgjHbA4aATklrMh1DFmqWyaKxSyEFT:kyZbYqg0rMbYqW6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691193095, "uuid": "984234a0-47bf-4053-8d3a-8943f0aadc01", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691193095, "uuid": "30dca436-7024-4b6e-ace2-3b402260c89e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193095, "uuid": "e45c9d32-f05f-4073-b5ab-9328f7f6f169", "value": "4bcb42c8764870be71ee3b87738fb29f1a9e96e64ebe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287fb111-32ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mekotio)", "timestamp": 1691170036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170036, "uuid": "6347314c-8203-4ea1-8bae-89b52b5abff2", "comment": "Malware payload (Mekotio)", "value": "81e0452f2fb4a84d3d43fc68f528add1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "second stage", "colour": "#89286B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170036, "uuid": "c33d8b4b-00ff-4399-9392-95327636754b", "comment": "Malware payload (Mekotio)", "value": "4bec5fc719231c1bf3906e6e22035b22459a9606d2d0b9b7ef2105b13a65b3ae", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "second stage", "colour": "#89286B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170036, "uuid": "fb027af2-2d08-42d8-8e73-d18dbbda8757", "comment": "Malware payload (Mekotio)", "value": "429a3c4546ced68477c57ae757ca67103f151956", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "second stage", "colour": "#89286B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170036, "uuid": "ac326cc6-8eaf-4365-94ed-407acc3e79f3", "comment": "Malware payload (Mekotio)", "value": "bd5c93b04ee49d768fabb99728f5279d3ff98e4f61497285a5cac824fd434270bc5adcadd6dd8a8f5e784accf848c642", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "second stage", "colour": "#89286B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170036, "uuid": "df6d3d41-e67a-4e12-8d7d-6aa06016b9dd", "value": "T14B1733B16D833A61DDA8D2182F087DD7592AFE02FB2D504347AC0CB6C9ED64F86325D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170036, "uuid": "69c20a1b-e1be-49c0-b3b0-ab8055359bd4", "value": "393216:MKT8cK0fdIktLmjyGWoSDhI18NM9JF/RO3tE7U:HT8cFFIktLMFWZE9Fg67U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691170036, "uuid": "8df2ef44-8caa-4991-b7a9-27c50127a4bf", "value": 18603843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691170036, "uuid": "07a79a4f-a253-4c1a-935d-a422a17510bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170036, "uuid": "8ee81cf8-eb60-44b3-9264-f65f3f37a29a", "value": "game2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4fa73b-327a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691121345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121345, "uuid": "f9a045d8-bc3c-4194-a2a3-4ca98eddf852", "comment": "Malware payload (RedLineStealer)", "value": "f94a7fb16fa08b8d1134b990a8676f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121345, "uuid": "1d52ea0e-9430-4e7e-9c50-9bf1fe38d788", "comment": "Malware payload (RedLineStealer)", "value": "4de11dbb2fef57e1c458f9e64870790ed0564f847a9bb0c390b139c0c87f5cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121345, "uuid": "0bff7d7f-4057-46d0-a81d-1f6eba710ca7", "comment": "Malware payload (RedLineStealer)", "value": "95096b41906c3a7e0b11fab8b99ca09651f94272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121345, "uuid": "65774b0a-5b07-48d6-8b03-6d3bf86bf7db", "comment": "Malware payload (RedLineStealer)", "value": "3670b50606aaee64b7ad7540fe16b427552202af7427d253a3900ef9eb2598fc2d6ccfed674828754a46d7d246cffdb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121345, "uuid": "7926b1f3-d630-49ab-be37-ad04044c88d0", "value": "T1AE05D73804780A12C135D2AD9AD4F613B7904F96761CCD9686C14FCA0AD6E2F2DDBDEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121345, "uuid": "a66567e2-dac8-4b34-82bc-7e11eddca954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121345, "uuid": "0343901c-d0f0-4628-ba1b-45290dfd79fb", "value": "12288:fEKaJ6QFc3SByxjmb8E2SLQAQR9g3JGxoHA/j:rQe6b8Exj3JG+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121345, "uuid": "6a5ad774-a7ba-49a1-80cb-09050bb5c7fc", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121345, "uuid": "7fe9f4fc-dfc5-4349-a0c6-9ece9d58ce45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121345, "uuid": "ef85f6fb-d675-4d93-b737-e73a174a7986", "value": "f94a7fb16fa08b8d1134b990a8676f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b104c81-3272-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691117723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691117723, "uuid": "b06966dc-efdd-4879-a486-ef145f0bcf59", "comment": "Malware payload (Mirai)", "value": "ebc646323ff24ceaeed462a93f1fb3f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691117723, "uuid": "056ce584-fc8e-441b-98e1-8883df6cbaf2", "comment": "Malware payload (Mirai)", "value": "4ef2684392363bcb755e192d0de50e4dffe71812848cfe2337df437f50bde56c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691117723, "uuid": "c8e90153-613b-4ede-9aca-9d00ebdcb398", "comment": "Malware payload (Mirai)", "value": "ede23807ac25dddc31299f2b49cdea7133183414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691117723, "uuid": "2dd59a77-a75b-4024-959d-7cb5b28cebcf", "comment": "Malware payload (Mirai)", "value": "e0470e95326320c31c36752f615dae86790e2cff483b3a036700de66b6f4db25846af8b4d6f1c46214b534f2b6ab8abf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691117723, "uuid": "d9005fce-3b51-4af4-b31d-4704e6711d9c", "value": "T105434AC4B183FAF1DC05017C307AEB326E37F0B6613AED9BD7E455B36855206960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691117723, "uuid": "c16cd369-2ea9-4515-9282-d6fe987b43df", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbEoPRdQZl7dDFfG:xzuXndFq4ZthB/VUfOW4oPnQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691117723, "uuid": "38c07574-445c-4515-adda-7dba35f3d0b3", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691117723, "uuid": "7e932e81-ac60-48a7-ad95-8eb38648e5c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691117723, "uuid": "48e5155f-b3d5-4621-92c3-8d4b3495a33e", "value": "8cad93dac4260d4294bd45146ed1935c78542734a03e76b80265dfb2cf542a68.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9282bf-3311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691185884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185884, "uuid": "b9a9912f-5edb-48f6-94ec-1a8a31762fe7", "comment": "Malware payload (Amadey)", "value": "b9812663e08c063e590173b2a48e15f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185884, "uuid": "63d135e9-16ea-4e75-9455-38c7300cd4ce", "comment": "Malware payload (Amadey)", "value": "4f75a979e23558f68cdaa2de44dcba1b1b8d619338e3542f6249e396ad727878", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185884, "uuid": "f466de53-2513-47c0-94e7-d117ffead379", "comment": "Malware payload (Amadey)", "value": "5a170a0a7f9199124811c7d0b3973f7095e560b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185884, "uuid": "18b3420a-af77-479d-870d-06a8d3496f63", "comment": "Malware payload (Amadey)", "value": "5e90921e71b8b2c1bcbe75fd297a65a926fb98828742576a42c0ebf6c1b869ebcbf25d3bae68a2ba015a0028277c4e19", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185884, "uuid": "215edec2-5107-4ed3-beab-98cfafab5dfa", "value": "T16EC41241BBEC8077E9B6177018FA16832F327C96A975829F2385594B1CF3AD0A57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185884, "uuid": "d6340a87-3f28-4dbb-a24d-56c22c562695", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185884, "uuid": "ce4fe3d5-c194-42d6-80f0-9763d3dd260e", "value": "12288:lMrwy90eEPbybh1RZAJOQywA82jeCv4DGrLXX7fyK/T:JylE2F1YFA826Dy7KKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691185884, "uuid": "6d7fc2d6-9ea6-49f3-8665-8157fceb24c5", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691185884, "uuid": "6c8c33ea-ff39-42dd-859f-211f2ec51fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185884, "uuid": "be134611-4470-4336-b56a-d2cbce73215b", "value": "b9812663e08c063e590173b2a48e15f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3557630a-32aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691141711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141711, "uuid": "0e48b4eb-edbf-4b2a-93a4-155f652ced67", "comment": "Malware payload (Arechclient2)", "value": "f290ed868caae994bbfae1b63aca1d28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141711, "uuid": "851d32c7-afaa-4681-96cb-e77d8772432b", "comment": "Malware payload (Arechclient2)", "value": "501444c9d25c15ca62bafe062b6bb8a3b3f69f0ca13aff057e3b8b1a0595f3a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141711, "uuid": "dbff1e3e-a3fa-4701-8c9f-2f070fa0559f", "comment": "Malware payload (Arechclient2)", "value": "5ac7b60e56281dc0c72f7c1125b165867df56ed9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691141711, "uuid": "3fb4c5d8-2361-443e-b9d8-a78890bd8453", "comment": "Malware payload (Arechclient2)", "value": "0982413f2185cecbb971b9ef22348d7e5053059631bf3e54e4a9847d37d37d11b03ae3b9e3673326cfa101419607fe18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141711, "uuid": "2370dac6-50f8-4135-8c4c-e94fac3ff925", "value": "T162D5335931675A4FCC7D6E348C83C086E6A6AE217DD49A4AB184F32FDD20941CBB3BC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141711, "uuid": "7999a376-c1da-400a-be04-ce3053261a5f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141711, "uuid": "5d47fe4a-0d30-4683-8325-1f80047e6e06", "value": "49152:wGWR1Nr9QTV+jfVItISk9iojj2wLs47a8rHW60EANyBO83mpO+E/tfl:wGWR1NWTVw3Aka8C60FNT83m9EV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691141711, "uuid": "00248fee-76a0-4ea2-93c2-81d58bb120e5", "value": 2963456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691141711, "uuid": "20472160-9cc4-4567-9282-597c98ed3957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691141711, "uuid": "d03677d8-f863-4b36-af10-1bab199599ab", "value": "f290ed868caae994bbfae1b63aca1d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f368ec5b-331c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691190993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190993, "uuid": "dda06099-53d8-4e26-bfc1-e7ce6eac7679", "comment": "Malware payload (Amadey)", "value": "502292f5177e6b4099c04d2830e8f826", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190993, "uuid": "222216ff-fc23-46a0-8aac-b15e2ac644bf", "comment": "Malware payload (Amadey)", "value": "50db2f84592af7ad3887360c4a2a91103583dcfdd4fd93e992e80186d9f5bcba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190993, "uuid": "69d59cc1-5d4f-4caa-992c-32761bb4692e", "comment": "Malware payload (Amadey)", "value": "0ddffb890717207a1be0c2b07c518bde57e9f723", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190993, "uuid": "2cf80f9a-618b-491a-9b93-d921476a4d83", "comment": "Malware payload (Amadey)", "value": "1424356a678350f907bd38afa5a9d41af8dedc3739b234f407c3489c5f8eada2c340ff363222e4b9fe3d0b1a502b2afb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190993, "uuid": "39bb4615-7989-40ef-ae4d-0c531c6ba563", "value": "T11FC41243B7E98477D4B4277018FA02D30A38BDA29C64635B67859D4F0CF2184EA7A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190993, "uuid": "bfd72db1-6833-48d0-bd32-4cfae35cbfb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190993, "uuid": "de141654-8a1f-42d0-9793-4898576dbe0f", "value": "12288:4MrMy90/dscCsSqa+qnT9JSx6TGhulnoT:0y+NSB+A/fpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691190993, "uuid": "e407553a-3520-45a7-86b2-14f4866bd8c7", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691190993, "uuid": "1c97a04c-708c-4a61-9fc3-2d9da1463437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190993, "uuid": "e459a5a6-db5b-4b1c-93aa-841df0b75234", "value": "502292f5177e6b4099c04d2830e8f826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e07c4f6-32d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691161590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161590, "uuid": "57b30589-c449-4161-87bb-3dbee06dfb4c", "comment": "Malware payload (AgentTesla)", "value": "e4d92f23953d3c634c9efc301033b83b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161590, "uuid": "7ef416ec-6bf8-4ef5-acf7-dce999cf3b82", "comment": "Malware payload (AgentTesla)", "value": "5167b917426b8435d81522f885966f00cbf7f5b896e2a6b18696bb0f1194756c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161590, "uuid": "7408e422-65d1-4fd0-bb29-166e7563d73f", "comment": "Malware payload (AgentTesla)", "value": "180d4ea1495b33f514476974477f419fd04faea4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161590, "uuid": "cff6aa88-e10d-40a1-bb59-12adaa2c69b3", "comment": "Malware payload (AgentTesla)", "value": "a08001cc04918b46043c9a6629d9a04029abe1b2bc6219e7682b6f977ae4469ab735cf1001ad2a222916da1186dd1e4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161590, "uuid": "e0a664bb-99ac-4b5a-972d-ab9a7a08864c", "value": "T10D059E2072A98F5BF23EA7F75680E00843FA59AA717ED6590DD261DB26B1F085F00F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161590, "uuid": "81d96953-b7b3-4504-82a7-a7609c54f8b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161590, "uuid": "1b26dd23-2ba5-46c7-8bfa-8687683783a8", "value": "12288:EQdOXTsrQjO/skYs2EuKuuZnSXNm5/rHVRunibFlMjaoJVeDfxkVEuGCIsO:GYeOb1JtqmLVRuibCape7DIsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691161590, "uuid": "274df231-48ad-430e-b34d-46bb0f831341", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691161590, "uuid": "1b3be5f0-912c-4c23-9214-863f71a4a8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161590, "uuid": "999ed5c9-6c7d-41ce-8cbd-1d5ce2f91148", "value": "RFQ-FGIP2-MR-MS-010-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db57404-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184380, "uuid": "4255dc59-3d79-4821-a4fc-b4f85083022d", "comment": "Malware payload (RedLineStealer)", "value": "1505101c601f690bc6443f8c137f8241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184380, "uuid": "cdcc17f4-a6b0-4da2-b315-29d09ceb16eb", "comment": "Malware payload (RedLineStealer)", "value": "5298ff9156e98a6d81504674168fdd23ee5f04720b85bf86d44efdb6d5f680c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184380, "uuid": "e003101d-a55a-4fd0-b246-228efbabd280", "comment": "Malware payload (RedLineStealer)", "value": "a914aae152316d47b0a0383d3e3b8a942b1fcda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184380, "uuid": "b75cab61-e591-413c-941d-1953b1aef3eb", "comment": "Malware payload (RedLineStealer)", "value": "161ad88bf7526f7c7c81b8fe97c61d2f8ce9ddf79f28be1691155fac11b02781e0751ba65cba6ee2a7c7a20b44948d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184380, "uuid": "6ca9aedf-e87a-4f97-b02c-3900596498ca", "value": "T1B7E41202E6E9E073DAF027B05CF202870B757D6168B9930B3695198F1DB3545E932BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184380, "uuid": "b7cefa6a-7c85-4eda-ac93-c3651aa81ac7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184380, "uuid": "10d4cc1e-081d-4bf9-a766-61b84d094085", "value": "12288:yMroy90ULQhqND1cgV7yJTDHQqCxBinKwN++eHtje4EIxXMcg:Gyl9dV7yJTj5CxvwNjOg4EIx/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184380, "uuid": "3fbc916e-f03f-41bf-ae2e-bf4e4f0ecbba", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184380, "uuid": "7a831abf-4aa7-4c82-8f53-de8679fb9a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184380, "uuid": "a2c3125c-f705-4ce4-8d69-35ac12014ea1", "value": "1505101c601f690bc6443f8c137f8241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579950e-32c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691152825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152825, "uuid": "2f1244a4-23b2-4cc6-a38a-c52d10286b09", "comment": "Malware payload (RedLineStealer)", "value": "5e3b97c3d2825d9d448ab145c6f0fb64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152825, "uuid": "12a6d07b-79d7-4b70-bbc6-8cff11f41ea4", "comment": "Malware payload (RedLineStealer)", "value": "532631b46cb7e5b8b034cb3ef0ecc549fc10856261d9710cf23e7967055ddde4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152825, "uuid": "1b24a5d7-7e43-4bd7-b412-4a7c275a37f5", "comment": "Malware payload (RedLineStealer)", "value": "a50b68653e42a3083190f9e78a1325d83774cd49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152825, "uuid": "f7345bc0-8412-41a4-9663-d08fa93a3644", "comment": "Malware payload (RedLineStealer)", "value": "9a23435f81461f4f3babd356b649642b38d23b6cf3f8a9c398196f52ae1a987598c5e4ec1fbe1726be9e8882b39dc36c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152825, "uuid": "55fff0d7-6b96-43d8-9710-ad648dfb25cf", "value": "T149B4121163FB9A1AE1F587F2183314402BBABD4A64B2D18C1DC1F4CF2A65F859B61F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152825, "uuid": "ba07e375-258f-4873-aa43-1ec0e515cbad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152825, "uuid": "2d440405-c0a6-49b0-a3db-1f942dffef9a", "value": "12288:E4rlX5HJbzC4gSBsi6viA67aLVzdhP19g01xQ6+BB3c:rxX5JfCjk/6viA6GLV/H1xQLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691152825, "uuid": "58956db4-673a-4af9-ae5f-939faba6141c", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691152825, "uuid": "21a44bb0-62cf-416f-a779-2579c27d0f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152825, "uuid": "49ab5bb4-63a4-4572-a910-91d6416ea1c7", "value": "5e3b97c3d2825d9d448ab145c6f0fb64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f245e1bf-331c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691190991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190991, "uuid": "98a6f82b-1e21-4974-ae12-122116ecc0b9", "comment": "Malware payload (Amadey)", "value": "4e75b88370ad68c915c9c7791e7f14e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190991, "uuid": "05ab242e-8fac-44d1-8102-31c5ce9aad69", "comment": "Malware payload (Amadey)", "value": "5385f6fea25b0441d5820065e10174f2a719a4dfb310d1f3d26144f0767b6ab5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190991, "uuid": "de5dafae-a891-4681-b0cb-74349a49890c", "comment": "Malware payload (Amadey)", "value": "414032b0d7336da7b02925102cd4e74ae4fcf5c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190991, "uuid": "e1cf8d78-b667-4680-b548-56bef7bee492", "comment": "Malware payload (Amadey)", "value": "dfc213dd8431f8550eafbca60ee53c3103336bd351b72e5cac5f7adebee43b2a72b94a920279a66b86dcfb817f64b592", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190991, "uuid": "6ed2b472-4da6-4cd9-b161-fd32b5a8ab1b", "value": "T12603F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190991, "uuid": "16a454a9-28bf-4417-8eb9-3dd9bda02aa0", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691190991, "uuid": "49b3ef5f-4226-422d-ba95-38ddf6dcef80", "value": 40167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691190991, "uuid": "e4bfda68-653d-4e42-811a-28880098a01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190991, "uuid": "a7353e4c-7018-4af0-90ea-7e9472e98abf", "value": "4e75b88370ad68c915c9c7791e7f14e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89192c96-3295-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691132832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132832, "uuid": "475db690-9484-4677-9252-a5cc3ea0486f", "comment": "Malware payload (RedLineStealer)", "value": "7d132a7e0881ce43b5f5e89d9710d3a2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132832, "uuid": "2d098cb8-240e-4843-b040-c4627d2a9205", "comment": "Malware payload (RedLineStealer)", "value": "55bd4c11cbcbba5abc815bca5cac0afae9669a8986a1c1130666f673b4e171c3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132832, "uuid": "8bf3e4a4-4d32-4544-90f9-d1a065966125", "comment": "Malware payload (RedLineStealer)", "value": "987fdb1e27f00656d3de99e247e35b0ad02939bd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132832, "uuid": "7584dc27-613c-4232-bed4-89eeb43206bc", "comment": "Malware payload (RedLineStealer)", "value": "7206d233b9d5139457015b90c7db1b19bb55d88d9c70e59bd8fa055893dce022ac6c8e2f666e89323206b16b8f79bce8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132832, "uuid": "bde0455e-3c73-4aff-8a21-c29b37f7d930", "value": "T1CA33BF69C74F0169CF525237AA27194842FDBB3EF74516A1306C837533EEC2DA12A2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132832, "uuid": "9d75c17a-a723-4fad-bcc5-de67ad09e92c", "value": "768:XwAbZSibMX9gRWjyJpsQJPUsnRFueiNceyUzAgKXMjADCg7:XwAlRJphPUsnRiN7ADV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691132832, "uuid": "98166ad2-f6ba-4223-8519-e113f2421c10", "value": 53691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691132832, "uuid": "0f59413f-153f-4f4f-82ae-097a48951589", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132832, "uuid": "653b8768-cb6d-498f-bdf8-ba9599135218", "value": "7d132a7e0881ce43b5f5e89d9710d3a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc59da2-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124388, "uuid": "bad9f396-d772-41cd-80d7-61bfd13de41b", "comment": "Malware payload", "value": "5f2308b18597536713227b1d9c134612", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124388, "uuid": "52f601a9-9588-4ffd-a863-65c56ab18a20", "comment": "Malware payload", "value": "55f417619668ba52a031eff29ca9993c8d989f699d871cdc518d31f4dccfa230", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124388, "uuid": "868890b0-425f-47e7-ae5f-b2711a2c3991", "comment": "Malware payload", "value": "59b76465a2bb715eafada6102dd4bbe6d2d10d6f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124388, "uuid": "2b05e9c6-e7db-4ed2-ab46-415b779cc32f", "comment": "Malware payload", "value": "46db9f7f1898b470c1308d58916e51071d972a0b00e17befc17db9e87a834bc420e93121fc79bc2568db0e79acf1ca31", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124388, "uuid": "af7738fb-adbb-47dc-ad81-9fca3938b33c", "value": "T10EF40224737D8927F97D86F488E6D45807B1748A296AF1EC6CC135CE21F9F884A01B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124388, "uuid": "829dbae7-fc59-4564-806d-0f8eb93b529a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124388, "uuid": "e4488f01-9c91-4a2a-876e-0b41b38a7146", "value": "12288:EnjOMxnVhS1rOyrJVzTlujRtuICtWCO84uitouszhIWZY:EjOMxVhSBOa3zTUjBC8yitofzKeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124388, "uuid": "bdaa26c4-ba24-40e7-8045-ac5b63f15b28", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124388, "uuid": "5740b085-b947-4577-b6f6-3805afeb91a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124388, "uuid": "316f673e-4026-4a85-961e-9bd01c4088c7", "value": "DHL Documentos de Envio Originales.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b850e01-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178363, "uuid": "57460cfe-be64-4471-9878-dd9005da52f5", "comment": "Malware payload (RedLineStealer)", "value": "06f7f35756387ea33ac5183bcc4338c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178363, "uuid": "4816fb3c-543d-4164-b49b-b84d1f683ea7", "comment": "Malware payload (RedLineStealer)", "value": "56feff709b1b698bcf6c1d32b06f88a9caf04a50e0fb8dfd3bbe2cd41aa967b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178363, "uuid": "b11236e6-5cb9-46b9-8abc-8bbee1a4d4a5", "comment": "Malware payload (RedLineStealer)", "value": "5428b66c4501739c4999efe76bc0fb68ac71de36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178363, "uuid": "aafd23cc-de78-4f26-bdc6-57f2253acec2", "comment": "Malware payload (RedLineStealer)", "value": "098b5246b418d4c345efef7e512a3736278dd73832da8d3069f6690a3d993da7ad3d448bed6f07fa609e5e99e734e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178363, "uuid": "6d6d2507-a54d-4603-ad0f-751b99748ce2", "value": "T167C41243A7D49076C9B56BB45DF703530E35BCB19D68826A3346AD1B1CB2288FA3473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178363, "uuid": "a25c4b3d-e5d8-4ce9-bf20-18e44d5f4b12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178363, "uuid": "5074c498-9250-408c-afa6-d02bb193fceb", "value": "12288:vMray901enCNZdGQgYaCf8Rg5+ry3QFah/tPHpbatQkiGP/e9NI:pyWeCNvGQWu8RCfpGtQkiGP/eQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178363, "uuid": "42a34766-877f-44d0-a231-e76e94abf435", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178363, "uuid": "d1dbca5a-371f-4f6f-9f21-16ced0039905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178363, "uuid": "a46b050b-1750-44ab-8868-5d233b94e9b3", "value": "56feff709b1b698bcf6c1d32b06f88a9caf04a50e0fb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c256cb29-32b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691146243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146243, "uuid": "470f1a3c-226b-4930-bb40-c6053026d9f8", "comment": "Malware payload (RedLineStealer)", "value": "41547ada94ff3312f7bd024b36037a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146243, "uuid": "e8ea6ef7-fe12-4ae9-b4ff-24fe5454ac1e", "comment": "Malware payload (RedLineStealer)", "value": "578693a662f82e27c7f8b4443f32e977da129a0a3f31d036e39786d1aa06a6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146243, "uuid": "dc478e65-5c5b-455d-a90e-ccbf8753dd6d", "comment": "Malware payload (RedLineStealer)", "value": "c289df87f973775e6fab413039cdcb8d6898a534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146243, "uuid": "872e9e81-2645-4801-a687-7a33cb356e5a", "comment": "Malware payload (RedLineStealer)", "value": "58f207386a66a428c719855e83ce56f41a6f41ca7cde115334abab4f6254f41da739ff41d123a323699cc6365340f978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146243, "uuid": "77b71853-e821-4899-8cb6-c2dff54497bf", "value": "T1EAC41217AAED8072D4B517B018F643D30B357CB19E78927B27568E1A0DB3B84A97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146243, "uuid": "2f0c8edf-f15e-4888-a805-83d16686d7eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146243, "uuid": "aa84d1ad-c376-49c8-8733-9579bd07f442", "value": "12288:uMrEy9014d/YpppNB6NwRoOQPQYoWUyGvWi5PS9dZ9H:myq4d/Yv02GPYjDy0WEqTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691146243, "uuid": "a8f16d79-a04b-466d-ade1-9e6f5fba8be1", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691146243, "uuid": "5418604b-80a2-44e9-a938-032cb1f3b167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146243, "uuid": "69521d7a-372f-4f5c-9c35-a3fe6960fd42", "value": "578693a662f82e27c7f8b4443f32e977da129a0a3f31d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65abc8e-32ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Floxif)", "timestamp": 1691171214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171214, "uuid": "7247a371-b7ea-4f98-837d-14e8754cfe08", "comment": "Malware payload (Floxif)", "value": "774c7ec4bb7314dafa8335fe1f8c26b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171214, "uuid": "622ddad7-c868-4a12-b5e7-26904bee09f2", "comment": "Malware payload (Floxif)", "value": "5824816c15c14812f8d8fe64a2317520ac6e1e96f59d4477aacbaff84d706718", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171214, "uuid": "308b89f7-dd8e-4d9c-9f04-147021bea71d", "comment": "Malware payload (Floxif)", "value": "36bdd75cf778d27b2ab68c9668bcc7025b1bede7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171214, "uuid": "fe627b14-a46a-4bf7-b13f-7fa9bb1af1c7", "comment": "Malware payload (Floxif)", "value": "88e9e62eec854446b443a3822ef3a283a07350e8afb00a807992d189a3a38ee978b2af15603c0fb99437b19747dbd0bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171214, "uuid": "dd6dc0eb-4e98-42e5-b980-7f3a884247b1", "value": "T12824BE80758243F9D4850674309E6B339FF52B3F01AFCA83C725DD519E2EA22FA5925E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171214, "uuid": "123db39d-c113-4e82-9506-9d87665ad1db", "value": "78b83b8b43d749ca306a862fdad9acd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171214, "uuid": "d13f40c3-531a-47eb-b16f-70207f5c473d", "value": "6144:5WayCdJ5qDezAawea2BV+UdvrEFp7hKhqE:5WoDqYA5EBjvrEH7IqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171214, "uuid": "9bff8f02-3e74-429b-961d-23e280a7464f", "value": 229831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171214, "uuid": "bbb58a5e-e627-4c96-8e0f-4c0e509937e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171214, "uuid": "394c5d29-42dd-439f-b45a-24c40e3a9914", "value": "jpeg_12.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c20bc0d-3322-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691193396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193396, "uuid": "f65fd995-d68d-435a-bbc2-361a382aef80", "comment": "Malware payload (Amadey)", "value": "22e10a2b76c8964a613ce45e92299f26", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193396, "uuid": "361dccde-a698-498a-9094-3da45137e914", "comment": "Malware payload (Amadey)", "value": "58303ecf4c0ee619f7ff80dca1361e58c6ea6a3fcd04eac792f0301796d384b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193396, "uuid": "3e3fea6e-b85e-4a68-933c-6ff4f47bd5be", "comment": "Malware payload (Amadey)", "value": "1907829cee11ea61c4f8064c8b1eaee556a7be6f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193396, "uuid": "f09062b3-ccf2-495e-ad95-95f9460e313d", "comment": "Malware payload (Amadey)", "value": "cbbe75ae750ee801a602197c36c28ebf1ca4af4dc1fa90bdc61b297c0eae2efa5bc6c3c9b772ce9f2178f296949b47da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193396, "uuid": "6a077ce4-6293-4d38-9f76-e733069a76d4", "value": "T14C03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193396, "uuid": "50b5a2d8-f740-496a-8ba3-2c234ff80a0f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691193396, "uuid": "df8a09a5-6bdd-40f7-94a2-b8921a013e54", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691193396, "uuid": "b7c1e388-10f1-444c-b9ff-0f03e19b587b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193396, "uuid": "4500f5a4-94e5-463f-9575-26a509731f4e", "value": "22e10a2b76c8964a613ce45e92299f26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1b467b-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691124217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124217, "uuid": "ba1f4345-470b-4b0f-bc4c-e6a13e20ed67", "comment": "Malware payload (Formbook)", "value": "ef3435c8c29e539abf62a9d238f23985", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124217, "uuid": "189c2113-68ba-4398-9e3f-6ecb560c0143", "comment": "Malware payload (Formbook)", "value": "58576570f9b3638b927bde6f2d814cc55c61aea6e3275ba6540f0f9718e48d7e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124217, "uuid": "c7d09131-229c-4ddc-b3a1-af6baaef408c", "comment": "Malware payload (Formbook)", "value": "6e772532a7cb8e1290235c76f017e520b4b20f2a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124217, "uuid": "f87293dc-19f9-4696-a4f1-44e9fbb90f77", "comment": "Malware payload (Formbook)", "value": "49b3a3fa35c00774146b3efd691098621302b42fbf09d4e66d5a6689034791f04ac09d6bbade63ae308da008f0e38094", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124217, "uuid": "b082d05e-102d-4567-9c72-2b939689a211", "value": "T14D75F103D804CA86D50D83F87E1339D94A0D7F2AE4D97DDB06527F9B3A32AB7492A50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124217, "uuid": "031ae4bf-c31c-4b24-afb2-d97b047d2556", "value": "49152:FQmmQ30jKo6VIQmmQ30AFn6VwiNhv3tXRyXnjgV6PQ5t:FpmQkjvmIpmQk4mwMhuXg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124217, "uuid": "2181aeff-fa5c-403b-aac6-9c64464f77ed", "value": 1611264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124217, "uuid": "92a9b4ab-2992-496b-81ba-bdcfab7a3332", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124217, "uuid": "5e29d847-4432-43de-8773-a65c06600607", "value": "\u00d6zellikler.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c97ff9-327b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691121633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121633, "uuid": "e3bfe20d-d6db-44a8-9b0f-dec90343ff80", "comment": "Malware payload (AgentTesla)", "value": "4a22e79ac77bae6154fc85555cc26460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121633, "uuid": "3df04fab-77fc-4f6c-92ba-042426a7608d", "comment": "Malware payload (AgentTesla)", "value": "58fd81b3dab9a0a782d4ba5add432bec81dfcbe752287fbb16cbcf165aca3fa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121633, "uuid": "73dad6a6-93f1-46f5-afd3-e84f6c44b16f", "comment": "Malware payload (AgentTesla)", "value": "35eff02a0259fe804ba9f593a7d4e8f18355a8e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121633, "uuid": "a286b641-0767-4704-97dc-7767b9239baf", "comment": "Malware payload (AgentTesla)", "value": "138ef75a43b1bcc0eee97f874767a38a68eaedd4f1f0c729af8a63d3f9cacdf33b4581cf71f0b925a4828f1b814654f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121633, "uuid": "499b5bcd-8b41-4b71-8845-401601fecaa3", "value": "T12BE412AB3D387A61CD94877321659B4C034F1E0EBCE9F36B049D71ADD3B7B885121A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121633, "uuid": "9f7c5ca6-41aa-4435-93e7-8610ac8ceb24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121633, "uuid": "5c2fafa0-5a6f-41c5-9cae-80f8cc01c4f9", "value": "12288:Lq+zNpckaekY0SKMkeOIc60rCGqem8/XtOpCOlqxe5rnu+k7:++zNy4bYCX8Qlqs5rnXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121633, "uuid": "4c7cbdb4-f380-468f-babc-737f0b3f5ec7", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121633, "uuid": "3cc8c05d-e6f0-4ee9-a243-7bcba871bb8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121633, "uuid": "09340a70-b772-424c-9238-3c6b1e1fbff9", "value": "4a22e79ac77bae6154fc85555cc26460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4807e9-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184374, "uuid": "cecc76c3-ccec-4aeb-b29b-5edf8d12c660", "comment": "Malware payload (Amadey)", "value": "c65a9f398078714ca966583498e0efa8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184374, "uuid": "1b6b2470-a5ed-452a-ab5e-5f70af3c3106", "comment": "Malware payload (Amadey)", "value": "5996cfbf8260b39a2e3dff4edddd24406f983e7ac81d40d3b8ea59d97f789953", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184374, "uuid": "33daefb5-9a4e-480c-ade4-245fd543209d", "comment": "Malware payload (Amadey)", "value": "1fd5754b09221f62aca30dc6eaa117ec689f8c15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184374, "uuid": "86a60c03-ff15-4d42-9682-5ee853bb4fd1", "comment": "Malware payload (Amadey)", "value": "ce28ea7747ea17f562e3a4921be2548feac45dba6e25dcd6fa3e011fa1c088e291b704042a69a78518d5d5545101b0d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184374, "uuid": "59ff82a0-2eef-4bd5-a22e-29f5a81adc40", "value": "T128C41212F6D45033D8B4177159F613930E327CA69E7D877A3396EA5E4C72AC8A53032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184374, "uuid": "8260cb52-32a1-4995-a7c8-f43aea2efd63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184374, "uuid": "8cb03a11-fee5-4ecd-ae0c-03bfccc0d0ae", "value": "12288:LMr2y90i2+k6uRACxr45n40qgVrrdNALq3y1KVWmw:hyuR5ACB50VALq36KVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184374, "uuid": "c623605e-d71f-445d-8275-c0e4b525183b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184374, "uuid": "a7a0884b-8835-4196-a487-29fd7660bde2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184374, "uuid": "57e3c224-219f-4e1b-b1b0-c51fbdbf7e72", "value": "c65a9f398078714ca966583498e0efa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b47457-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124753, "uuid": "cda91a80-f1bc-4ca9-ba35-2f235a055b06", "comment": "Malware payload", "value": "98a2aba1ff44441f1cdae2d332ec01ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124753, "uuid": "3f6c7b32-3e47-4ee2-a862-2309bf9d3a39", "comment": "Malware payload", "value": "5a25bcba79390405c1607a2b8a2b653132cde854044d4b03572a062b0aa62cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124753, "uuid": "7930b5eb-6f03-4345-95f6-fcbf293b1de2", "comment": "Malware payload", "value": "127f0a19b7aab57c424e1a7f16501ca7858bf8d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124753, "uuid": "ff309984-3324-492d-b56c-74227d18bb0f", "comment": "Malware payload", "value": "819187e3e6ef035abd00b4c26cf2394a67c4b31c2af7aefd730219a07f2b2925ace8c57ee9f6b1458f07343bb435eb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124753, "uuid": "4908fadf-bfd2-46eb-95a6-b03dcce14931", "value": "T11615CF4FDCAA3C3EFA3579787782D372D966318A217C1D6045B0EC6628A5C6937B24F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124753, "uuid": "db7ee9de-fdec-4e93-9963-f928722afd4b", "value": "24576:2GBgRbzl0jdIhq1tngMM0I1JCuQdjYDom:tozl0yh6n1sSEom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124753, "uuid": "0b5a6b01-4fc5-4269-9cbf-a1aa8504eda3", "value": 900850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124753, "uuid": "c85ba41d-f006-460d-bb90-5af6d9ca3a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124753, "uuid": "7e3d22fa-1a6a-4f5d-b143-392a79313ed4", "value": "98a2aba1ff44441f1cdae2d332ec01ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474c4706-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184691, "uuid": "ba164bbd-7171-4584-9674-a1cb853e87d9", "comment": "Malware payload (RedLineStealer)", "value": "5686c2e5be4e0b254963fae602493dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184691, "uuid": "d50a1e9a-2898-4c6d-bbd3-d5b148fddbdc", "comment": "Malware payload (RedLineStealer)", "value": "5afc92eeebb0e0c67a88e85e8614a4f2e0797fedd8d1292d9aaaea914bf8fe22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184691, "uuid": "f3848b49-295a-4be0-ba91-ff9271410b3f", "comment": "Malware payload (RedLineStealer)", "value": "aa7c56f4a677492f45921d75642f97b6482d195b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184691, "uuid": "8ac2ad57-ae67-4a6a-98da-b057587e98e3", "comment": "Malware payload (RedLineStealer)", "value": "23ca60457765d97756d7be93042617971faeb65e62d8e53eacda9897bf63ea9d03ed8fb0dd8f67a318e339d10c313f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184691, "uuid": "574b21ff-3b33-4af5-a443-5bec9353785e", "value": "T14AC41201A3E84472EAB17B7494F742D31F3A7DE09E78036B3346994A1CB3184E97676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184691, "uuid": "21e052e4-501e-472b-84cf-043879c35597", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184691, "uuid": "01ee9baa-0a39-45bd-b6db-ea8877c094db", "value": "6144:Ksy+bnr+Mp0yN90QEg4EkZfOoXkCjnT66l/hsnIybHoOSuEfqfeYV3tm1D6qNnkS:AMrYy9025kDkC60iZSuSUe806WnGPBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184691, "uuid": "103dffb6-e36b-4dde-bbf7-a1656afbff47", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184691, "uuid": "0ad89404-4910-440e-b6e5-71b8eec207a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184691, "uuid": "21131aa4-b1b2-4484-9f7f-e33db3634528", "value": "5afc92eeebb0e0c67a88e85e8614a4f2e0797fedd8d12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39a7d14-32b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691146245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146245, "uuid": "d880bcef-2856-494c-8021-2c66db7dbb98", "comment": "Malware payload (RedLineStealer)", "value": "1eed8a36c788803d21aa5d807d2de72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146245, "uuid": "6b5c9cf7-71b7-4d04-b6e1-59c9d3552198", "comment": "Malware payload (RedLineStealer)", "value": "5c4b735d72313ac00d7a9adf96760be994cf6838562e76d1ba91ee17bd9c3644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146245, "uuid": "7bfa96b3-96fc-4ee9-889d-2553a03167fd", "comment": "Malware payload (RedLineStealer)", "value": "44f9d35b4939985b1bc22f268c4562d3ee7a6559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146245, "uuid": "b045f56b-37f6-43c4-a165-17ca26985525", "comment": "Malware payload (RedLineStealer)", "value": "dbf51500b85c44966b31067666319991ecdbf9fa6edf07b98eb882c624a82722789dc7d6eba559f6a64a40194483b819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146245, "uuid": "8b785f03-2c0a-4212-91d0-fa8d7c621bb8", "value": "T1B4C41203E6D99073DAB61BB04CF712A31735BC618D78632B3645989A1CB32C1B67673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146245, "uuid": "3e350480-061f-4160-9a1a-dda8d27e8341", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146245, "uuid": "d87d3dcf-e87b-4b22-9cea-e1fcf54bc2d9", "value": "12288:cMrny90fdY41JEbcVn6LdCPlaH7YAYxemlHyEn7w43PPIBC2:DyMdYaE/LdCN4HYoiyWE43XIBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691146245, "uuid": "3f6ff9ff-8c3a-4a51-816c-b07987dd7d8b", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691146245, "uuid": "60c7492e-69f2-43d9-8e10-d120f279f8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146245, "uuid": "ab42fd47-91cd-49e4-a004-0f73ec5e3a7c", "value": "5c4b735d72313ac00d7a9adf96760be994cf6838562e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb41c2fd-32ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691155680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155680, "uuid": "0921982f-dda5-44f0-be91-af075474b73f", "comment": "Malware payload (Amadey)", "value": "bcac5e21dabc3c7114b75fd530a18135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155680, "uuid": "471c8161-b098-49e6-ae76-760a041faf42", "comment": "Malware payload (Amadey)", "value": "5df950342b3b292f012ad2ae6bf9566a907a1052e8e4d346eb0a367638321b29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155680, "uuid": "955d930c-d8b1-4d49-9e1f-2254f8614525", "comment": "Malware payload (Amadey)", "value": "0a20dec53fe2624db08e5da041a9180d5ea64cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155680, "uuid": "e3015365-5551-4a84-a188-e03e75b0957e", "comment": "Malware payload (Amadey)", "value": "6d4e5eb9068b84e709fda3cda984c37e77b516085958b80953afb78db065fae6e8ba0182f09c68f3a5c44425a23f3960", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155680, "uuid": "4fa9c27c-1e65-420f-b8b0-b37a0b91c8bc", "value": "T1A9C41202E3E94176ECF617B04CF613830B3B7CA69978526B27859C1F4DB2694E53232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155680, "uuid": "e2548cba-580b-4e54-b53b-98fc42f5ed51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155680, "uuid": "14bf8d43-42b0-4268-8463-74f4d8aa187a", "value": "12288:NMrvy90bDhrPlrkaCQE4TmBTTdz2NB+Ll0bmOw8O/:KyiDXRm5piip0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155680, "uuid": "0abc06a8-3eed-46c9-84f2-9db9f43d181f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155680, "uuid": "94b7c26e-57b1-46a3-89ce-27d00c137a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155680, "uuid": "fb9c560b-b986-419e-97dd-bac70869c0fa", "value": "bcac5e21dabc3c7114b75fd530a18135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df689bdf-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691114938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114938, "uuid": "43e5c999-ec19-4479-bd69-950a490d17e4", "comment": "Malware payload (Mirai)", "value": "18f707b39f387eca515769f9ceff5158", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114938, "uuid": "c1b659d2-c12e-4aa5-9a67-102ac839e4e6", "comment": "Malware payload (Mirai)", "value": "5e56ca1eede59ffda7fb76a7fd4d93dda80332cbba6de70af471465555dc78b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114938, "uuid": "e67018d4-146a-4b9a-9623-9d594d5151a3", "comment": "Malware payload (Mirai)", "value": "9f38a708ae03d2d3652031663a2bf5f302b3f5d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114938, "uuid": "dc23f10b-2787-4235-bc90-13c9db41132d", "comment": "Malware payload (Mirai)", "value": "41f91b9516717b5dfe743c3fdc800e0f11da5a80185da1c028105f426940f5c29fb7907375c802060f9f2911c81fa7a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114938, "uuid": "bf82ffaa-2853-4fc2-975f-408da14f79aa", "value": "T1AA031A41BC43869BC6F023B6AB5F538E335223ACD1EE3617D9245B31778B95A0E36B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114938, "uuid": "af9c2cf7-ae3d-4472-b944-4830cd7f0718", "value": "768:rv9xYXQXajTO+IrKc+KeyBpwiJy9hUjXaDJo3iUOuINq2Ep78:D7LAO+I3PBpVo9yLaDJo3AsFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114938, "uuid": "45a02027-e917-4b0d-bca1-d78a2de8bd3d", "value": 38804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114938, "uuid": "27c26d3f-3c89-4348-b401-6770e8b74f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114938, "uuid": "6a7cc3ba-5e90-421f-86fb-c968a14e5777", "value": "arm5-20230804-0208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58461f31-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691114711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114711, "uuid": "e17238b3-4d81-42d9-abbd-2efdcbf85dc9", "comment": "Malware payload (Loki)", "value": "4268288fb3dbf0b63cf0836a4201135d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114711, "uuid": "737a37c2-4363-48af-a1c2-cb713f28fbd5", "comment": "Malware payload (Loki)", "value": "5eee327c9547654d3cc01473d65113b1346801acfaa70e2e79bf24b3eb226521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114711, "uuid": "8bf6d37f-17c0-4aab-bc45-3ec36289cd49", "comment": "Malware payload (Loki)", "value": "5e2f695f8bf5c1fcd5086818554a15cb5da08bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114711, "uuid": "e8871bbe-5f76-4fe4-a9e5-9c260b9837c9", "comment": "Malware payload (Loki)", "value": "2da7a6838f823e7f86ba20e6ba331f1298401433f7041285e9c71d86f801b98f6d361888b3d79fdb82a529fcaa7a71b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114711, "uuid": "d040c471-3d98-425b-ab4a-9497418947f8", "value": "T18E44BE3262A2D872E0274730CE1AC7B4AA7FB8F05F599B5727444A2F0E717B2DA57341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114711, "uuid": "d97381f6-1d56-48cb-a1d9-c7bb2832af67", "value": "c6ca54cd6e670e7ae3e297db42de48d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114711, "uuid": "a6b2791d-55e4-46b2-8dea-00620347bb59", "value": "3072:cbnhSeH5GQj0l1LIw5VWQhuHGdiWs3qaVY65Jw9WhqhW:vQj0l1LhVWQhRdiWs3tVfwer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114711, "uuid": "77559f55-9f1c-45ba-9197-4ee0289c6842", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114711, "uuid": "c5c8112d-16e7-4989-b633-2b105e485ff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114711, "uuid": "ae78241c-6eba-46c4-baa3-3451aa92babb", "value": "4268288fb3dbf0b63cf0836a4201135d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419d5b76-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184681, "uuid": "e031096e-ba9a-467c-9b4e-2d69ba6156be", "comment": "Malware payload (Amadey)", "value": "27882e0ae8cf9fc44a884fcd4352c63e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184681, "uuid": "7f68d324-aef0-427e-b67a-578acd2ad593", "comment": "Malware payload (Amadey)", "value": "60aade9a5f1dbc704ffdee19db1bccee34dde5830f745f9b53b6957690a957d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184681, "uuid": "729abdb7-2f5b-432d-8700-bb3af6d1789a", "comment": "Malware payload (Amadey)", "value": "8dcef7dd4a329cb3b6cfbb8ae32035bcc8d9babb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184681, "uuid": "e32a7957-ba6b-49c7-812b-5c4f4934ab17", "comment": "Malware payload (Amadey)", "value": "67a712e5057565fed50c1f069778655faa2c1272e068f7329b7beede0a9677bd3d976b1e329128b68704116c0a6e83e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184681, "uuid": "993823cf-6908-48a5-b037-934ff90d62dd", "value": "T10BC41202ABFC8137FAB51B705CFA03D30A36BCA18D748267570A694E5DB3694A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184681, "uuid": "973d3a8d-53d9-4061-bec1-b7487a472118", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184681, "uuid": "abdfa6f1-eddf-4fb4-b38c-61ffe7762b90", "value": "12288:mMrhy90VlweKoHUQkEAj3JGWJc8SHSY/tmPiBJZY8Kp:TyclweDUQvAj59GvsiBDY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184681, "uuid": "54658faa-eb7e-401b-b637-db86ca129f37", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184681, "uuid": "4d5676bc-763e-44b1-9578-18244d74bc02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184681, "uuid": "4598e666-7b35-4ad0-ba74-d4c04d9a1a7b", "value": "60aade9a5f1dbc704ffdee19db1bccee34dde5830f745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef95ccce-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124414, "uuid": "f20ea96d-3c72-4d44-afd3-15e6f14b8df9", "comment": "Malware payload (AgentTesla)", "value": "f25c760f13869c4790729d332a61ec35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124414, "uuid": "223c9f36-3fc0-4818-9cdb-347216df3909", "comment": "Malware payload (AgentTesla)", "value": "621a484146f3235541df356798228148c9029b0327d6696d09206f573dd94b88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124414, "uuid": "0cc72ac2-fb4d-4920-a2f4-4383539db3b2", "comment": "Malware payload (AgentTesla)", "value": "57690128485d24da1cf155757e3c5b29c0a142c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124414, "uuid": "8a98e6b1-49e6-4d1c-8877-00acd366051d", "comment": "Malware payload (AgentTesla)", "value": "687dbc4389cde8383847fada72808f78e45257a63515390f665ddabd610ab0b14bfa645dbdd29e3926ffa4ae0ea1f3e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124414, "uuid": "32beea02-9bc6-4062-a1d5-d172636af102", "value": "T1292502A3AD0CC2DEF81E8EF94490B029E7A46CC53C20D5097EB93FEAE5327559141B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124414, "uuid": "55995057-2c87-4b6a-b371-aa6bb080a947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124414, "uuid": "c9938e88-c957-4db1-ba9f-20c77f7cd066", "value": "12288:M+1WYQvjOSidvRJ/aCH1YpIrv5OPsYQYYLvq4b1qSZz+b3rxB0xl:M+1kOFdbaCfj5OwY8C4bcSKbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124414, "uuid": "fd07d98f-d98a-48a5-b0fa-da808f5d808c", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124414, "uuid": "506e27cd-9d46-456a-9f20-9ce32da7e2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124414, "uuid": "a39965b8-2e7e-42f1-a843-5737fe373d5a", "value": "SOA-DHL COSU6355297070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9575e47-32ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691157368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157368, "uuid": "4b3de8ad-eee0-4b6b-bb6c-c052ed5930dc", "comment": "Malware payload (Amadey)", "value": "1cbda8a11e39c27e414d6853bacfd4f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157368, "uuid": "ef845571-92a5-4a90-bfec-19bdfbd97500", "comment": "Malware payload (Amadey)", "value": "62b64d39c67835bc47de4e7e899acc4cfb72d61570f7a6a3830cf0821dd2abd0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157368, "uuid": "c7c0a4da-cdc2-448c-bd43-04bb2e9eece9", "comment": "Malware payload (Amadey)", "value": "f04b6713bf3e8a000bf19c78c772c84e55319414", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157368, "uuid": "f8bcab0f-c3b8-43f3-9764-28e971372437", "comment": "Malware payload (Amadey)", "value": "6aeb2278cc2e4d8050ca0f58cbbd975fa0a45cde1f311b1efd88e2c8bce5541f8d7b103743ef483e85208c352dbe6285", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157368, "uuid": "0abf1935-f537-40e8-a1f9-f2b13f000aae", "value": "T19303F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157368, "uuid": "86399c76-bc3f-4319-a757-eb4ea99f6fd5", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691157368, "uuid": "f8a17334-85e2-4316-a66e-4794485a7965", "value": 39612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691157368, "uuid": "01f849ef-1400-4dea-aa4d-4660c7630754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157368, "uuid": "54785572-71ec-44c2-ab4a-3f061d8e6242", "value": "1cbda8a11e39c27e414d6853bacfd4f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41517cc-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124717, "uuid": "86ca5bc4-c408-4ff5-bfc9-18391e70fad0", "comment": "Malware payload", "value": "399069447a45a0c7120f7148b4d13696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124717, "uuid": "dce54e66-8ae3-4cae-aa28-9a5a5c49c4bb", "comment": "Malware payload", "value": "62e9a0d6ea8553419fc15ae61ede5b23e2fbc4c555db4c1c5f819dd14e88bf24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124717, "uuid": "7eb26048-f936-4c94-97fd-8dbb8828bfc0", "comment": "Malware payload", "value": "5d7c6a54c29782fb7e3a653984d2eedd2e9313ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124717, "uuid": "e9ee410d-9637-49e7-b9f6-65f409bef309", "comment": "Malware payload", "value": "ed708b665d07ad591ab46215fc6266823846a0eadd65543f1bf50863dcbea5f302908dc8bd0a147feb03a0cb54aa7b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124717, "uuid": "3b02294f-b5f2-43ec-b666-cf186894b9a1", "value": "T1B0E4022473ADC823F53E9AF594E5A54803F1754A193AF2EC9CC121CE61FAF486901B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124717, "uuid": "583ddd74-5c39-471b-9a23-368bf8adc0fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124717, "uuid": "cc8c9cbb-0bda-4fc5-bf09-a6e72972eddd", "value": "12288:NnjOMxnVhS1r1WzlTfT6wSrEJBC4kccY52CAMR/1Nu2vzYs4Hkx5h:NjOMxVhSBITGrEy4xVe+Nu+zYhEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124717, "uuid": "b3dbef98-05e6-423b-8a14-ae77143a8235", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124717, "uuid": "cab5eea2-1745-46f6-ae52-a99453b65a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124717, "uuid": "81a939ac-3d4a-4361-baa5-dbe175c9a0de", "value": "399069447a45a0c7120f7148b4d13696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb6f402-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124629, "uuid": "329e122a-7618-4c58-86b2-ff5e54a9b61f", "comment": "Malware payload (AgentTesla)", "value": "df0c3648fd1f3d0dd277c1931e01f495", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124629, "uuid": "9760d74b-c3e6-489b-8bac-71f6d2a86b63", "comment": "Malware payload (AgentTesla)", "value": "62ebd0e86e60df2f3994766589cf1b73d14dec9d6a4f6a07b120c6d39ecef2ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124629, "uuid": "4090aff2-a8f8-41e8-92aa-b63515b29675", "comment": "Malware payload (AgentTesla)", "value": "381c866736b6d610dc58e39886c8f028cada277f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124629, "uuid": "e67b3245-c4e2-4520-97b7-5f8fa432c794", "comment": "Malware payload (AgentTesla)", "value": "45f9844e5a2c0ded69d672f5f751418e90aade0a3008d2460049787f48814af8cb433fa3293c4c5ca90e9ccf3a86e438", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124629, "uuid": "3d367206-5420-4fc8-9033-f5cee6c2321a", "value": "T142D4233E3A7E867EDC4C07B42C798CC4432DDF8AFAD9FB194EC5248972A3A142135598", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124629, "uuid": "f9c408fc-b99f-4c63-85c4-cf0affce01ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124629, "uuid": "213b88e2-b5b1-4a72-8094-c507d15f19dc", "value": "12288:pqg/9ecfFmsfvvL/LtiWE6qj79AW4vC4vjz47i4oz93ILpG16:4kl3fvvL/yOW4PbZ4dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124629, "uuid": "4c040f15-adc0-466c-895b-d5e56ea69c5e", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124629, "uuid": "45dd9339-b74a-4ef0-996a-960c2e246051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124629, "uuid": "b8334823-47c4-4a4c-8b14-6c46593d9e93", "value": "df0c3648fd1f3d0dd277c1931e01f495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3a0e10-32d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691160381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160381, "uuid": "186d985f-ef85-4403-bbd2-b15121391328", "comment": "Malware payload (DCRat)", "value": "a8331e50e85849f47d59f1d1f14fd78e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160381, "uuid": "b179676f-6d76-4c79-bd9f-f82c37906e3d", "comment": "Malware payload (DCRat)", "value": "62f1d4e331c6eaa835a1b1cd59244a6b064f0dfe8b97f07ec51336b6258a1eba", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160381, "uuid": "73345e4c-9185-4311-ad38-56c3c127d2d3", "comment": "Malware payload (DCRat)", "value": "709f5b95b0b51079f6b9374a30e0a2319ee2cfa3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160381, "uuid": "847810b0-a0f1-44f0-8b7f-f3fddb812400", "comment": "Malware payload (DCRat)", "value": "114fadd1050ea60cd02511d8e475dde4f11ccb9b2059d67991d926ceca11275bfdd8d454f24e3281e67721c1dcb03ec0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160381, "uuid": "19bd5490-44c1-4d54-ba32-4ac428f471ef", "value": "T12D456B25E77B645AEF19A5E88E1F847278CADCC0F1B5C488A7E76C0385C23214D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160381, "uuid": "4a33394d-0cf1-4b7b-970f-58caf648fa88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160381, "uuid": "b50e3772-7736-4191-923c-2b15d7ee6f93", "value": "24576:Uo53R8dBoeZfWoXzNOraLyMkKH/5KOguyRs6CE3jLMpppdpppppUO9Rs6CE3jLMt:55CbTf/BEaLyv8YuyRs6CE3jLbO9Rs6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160381, "uuid": "8a759ade-c9d4-4a0e-a1bb-eb5d95fd8d60", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160381, "uuid": "6256292d-eea0-47fb-a258-fcc29cee6dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160381, "uuid": "3943b27f-c88a-490c-be87-7b9575e58593", "value": "a8331e50e85849f47d59f1d1f14fd78e.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd579973-32ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691143255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691143255, "uuid": "6a9e0de4-80b4-4cd1-948b-8f0f08bd5575", "comment": "Malware payload (RedLineStealer)", "value": "f41e75b512e0c9fb8bf3b0503a6a97d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691143255, "uuid": "5f963cf7-646e-42bc-8dff-a15e6c309ae8", "comment": "Malware payload (RedLineStealer)", "value": "63351a0cc2f5c9b7f1f06181e288d673aaf4c304f04d8af23abc9db3ea44474a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691143255, "uuid": "befb4995-35a1-45a9-bd53-2522ef85512c", "comment": "Malware payload (RedLineStealer)", "value": "ce0d11f0c67bba718e53d58ee357bb246909994a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691143255, "uuid": "3142aab8-204c-46e9-a23e-3281d4e9e29b", "comment": "Malware payload (RedLineStealer)", "value": "f874eeab1430dba8e327d7100154076d24fae2f08a18439240fbf27b49603f934ebccbf67bca16c71a04342af683d55e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691143255, "uuid": "962ff362-66cc-48b7-97fe-d948b0d93a48", "value": "T1C7C412B3B6D98073D9F11BB02CFA03D31B38BDA14C78975B6652998A1C736C4A871736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691143255, "uuid": "e5cefe6a-0e61-46e5-9aea-c8723cfcf1a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691143255, "uuid": "0397fc53-206c-4567-926c-6e147a35a0fb", "value": "12288:bMrCy90I3JxScuYju+4+DkVzUI2hyzCniJ1uHRtQg7O:Vy53PSYju+4+IKhy2n6aDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691143255, "uuid": "77446d17-9a90-435c-8e86-34370be8bc68", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691143255, "uuid": "5842a9e5-6f07-40cb-9087-e1369e53d2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691143255, "uuid": "ae1815c1-67cc-478c-a7e1-0b1435a5bc91", "value": "f41e75b512e0c9fb8bf3b0503a6a97d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25430e97-330c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691183775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183775, "uuid": "2f5fb4c8-edef-4b99-8eec-f393dadd4805", "comment": "Malware payload (RemcosRAT)", "value": "2af0d9cf826c6fb7a97f0b2aa092c6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183775, "uuid": "0c4efbcf-bc3a-428a-a3e3-e5adb23eda3d", "comment": "Malware payload (RemcosRAT)", "value": "63ef4597dd8f8958ab0c9c5f486e98a1bc7de071927925f413a184a48178d017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183775, "uuid": "e8ff37ba-a073-4589-9cb1-9e78f42086ff", "comment": "Malware payload (RemcosRAT)", "value": "f4eb081a9d62d7448f8478602c67781ba35bbd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183775, "uuid": "39c0e7e8-c439-49fd-9e9f-9f96025e4286", "comment": "Malware payload (RemcosRAT)", "value": "5d01a88c154a29f35cb5f210f773c0a9105c08b8b17b48e287b726163586eb7eff5b9bfeb6b0bf2d00c6b3b16497fee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183775, "uuid": "b856dddf-a4af-42a2-b827-9b084bb9b2b7", "value": "T145359E1663B88532F13729384B87A7F9D8AD7D2028357C8167E53E8DBE372417F24296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183775, "uuid": "2f387e19-c615-45a7-9daf-dbe5b1ba3a41", "value": "59072fafcf3a1401322769f6c49eab84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183775, "uuid": "b1c5f0c6-f380-4e01-af0a-58a12ac4a47f", "value": "24576:n8L2PlTQaGGtmlF/w/NConLI6HpJ/W7Dfavrjnpia2++:8LeqI/NCCLrW7mvrZ2++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691183775, "uuid": "07f08f84-aa15-41e7-8dc2-842b0b1c3a54", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691183775, "uuid": "0cff9ff3-8d61-4cc4-8ac0-b3bfd21df22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183775, "uuid": "7824b43f-c7ed-43b2-81cb-9cc6ca817587", "value": "NewOrder0578657875678788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65b3601-32fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178059, "uuid": "7638204f-46ec-4026-b555-1f0eb43a5370", "comment": "Malware payload (RedLineStealer)", "value": "a9f72b5df859b49269ce7edfc0ad65a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178059, "uuid": "665de9d3-70ef-461d-a54a-b7f66ee75170", "comment": "Malware payload (RedLineStealer)", "value": "63fc9241349f0a12aa47a578a56fc7fd965377674cd45acd52edceacf98abe7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178059, "uuid": "47773a8a-2928-49fe-b2e0-01d5cc56b0fb", "comment": "Malware payload (RedLineStealer)", "value": "4c7bbe40e8417129260a6730190c3da5e550d442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178059, "uuid": "75e74bda-195d-4c44-94fd-33b1b5bea965", "comment": "Malware payload (RedLineStealer)", "value": "d49191872b4587d4765eae72406a971cf993f5ede6b0dda7684f0404ea669265782c17021a46ac165cd4afaad7598b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178059, "uuid": "6e16b7d1-a712-43f1-81a0-d1af71b25df3", "value": "T11C03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178059, "uuid": "a150712b-8ee9-4cb3-a17a-975e9586a6b4", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178059, "uuid": "b3855942-dba7-4e6b-8dbb-ebef07ff3948", "value": 40395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178059, "uuid": "d0a66110-42b1-4895-b308-848eb76cff11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178059, "uuid": "e398e43e-1ae3-4494-b792-8d84c52945f1", "value": "a9f72b5df859b49269ce7edfc0ad65a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47615e8a-3306-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691181255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181255, "uuid": "0447d44a-7443-4e5f-b23e-b9dbdf2e7af5", "comment": "Malware payload (Arechclient2)", "value": "353479441f9bc398f6fe46feb7740985", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181255, "uuid": "6bad63a8-3d2b-4e07-8d09-904eb03a6665", "comment": "Malware payload (Arechclient2)", "value": "641710df66c792439f85b79879a268caa17b78ea0bf6924369fa6131fda01cd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181255, "uuid": "022a48a6-af3d-475e-9202-14b61816f844", "comment": "Malware payload (Arechclient2)", "value": "a905e2c2c0dae16fbede1a54b515bd5c111d0244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181255, "uuid": "491ac49a-6245-49d1-ae3d-740e03eec2e8", "comment": "Malware payload (Arechclient2)", "value": "442e3a648391b9c17d1a71dfaa860a884b6fa908e0419bd6a3eee051ab180222e4adb4e25af1b12d49c7acc0f8ddfe5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181255, "uuid": "1fc7c9da-1f57-4c42-81e6-6b398041c05b", "value": "T11FD533AB1DC65CA7E7AC8FF6C1C1C052D7016DF2A07E5AD4309C22096FA9D68DA83753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181255, "uuid": "8b292dc5-edb9-44e5-92dc-fd5190fce4d3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181255, "uuid": "5927d2fa-5a2d-4e59-ba1f-5c6caf07264a", "value": "49152:p9N2pMhLuZJ9N2VlUrMzuN73GD3outeBsb8FBa8+Fe8Ag74w8TTeh2aiITNkr9z+:pP2pcL+v2YQM67oucsMB+U8Agl8TTeck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691181255, "uuid": "ae9279cc-f145-4d69-9158-1912b1d75048", "value": 2964480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691181255, "uuid": "b7f61b50-4dd2-4a60-a839-6ae28a55e919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181255, "uuid": "ec6ab8ab-9cc6-4f4e-a83d-d8f289c218d8", "value": "353479441f9bc398f6fe46feb7740985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2584921b-32e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691168743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168743, "uuid": "99fc441e-502f-40b3-9543-8772b0d75d68", "comment": "Malware payload (RemcosRAT)", "value": "b73135a05ba0cfc192c9a02c24733592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168743, "uuid": "85e19999-df7d-4fa8-a2a4-7eaf623a95b3", "comment": "Malware payload (RemcosRAT)", "value": "64a84bec84d96284205b8a487b36768a75c398e70b12ba590125570abff291bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168743, "uuid": "fecf7b68-a23a-49f1-97b9-e433ccca1891", "comment": "Malware payload (RemcosRAT)", "value": "d641c490b93facf65216565fa791ac7b64026b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168743, "uuid": "32464dc3-99a5-43ba-b2a1-45c8237da08f", "comment": "Malware payload (RemcosRAT)", "value": "569c4429e35e86c54ef7104dde630b72122000e6313c769b31267500641ad9f683d40a9e7f3aa87d4d6cef18cb217b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168743, "uuid": "f3ed44c7-959a-4110-a12c-b6294cb75359", "value": "T1DE65D052B67C8737C0F24AFE9F4EB3E5590DBE705E18D4022AD87E8C9A36281781519F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168743, "uuid": "bb399d5d-5956-431c-a27f-13abf19db1df", "value": "2f4cc4c26fb236cfcb3f37f1dde590f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168743, "uuid": "59a2f979-1bf5-4c9f-9644-7bab14fd3098", "value": "24576:a30AU6QvVe3VQihYCjEHKPj13Dhazz9b9ZTZKjsWwySRO/I2jfW7xfSb8OUsfxb:aE6bhfj4GBT2z95ZWnwy0O/I2jfW7BP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691168743, "uuid": "343406cd-5fd7-46fe-8f2b-84ad0fdea298", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691168743, "uuid": "843a45b0-7e06-489a-8b0b-1885533bfd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168743, "uuid": "0f88c0d4-df06-44c7-a824-87de9804e8b9", "value": "B73135A05BA0CFC192C9A02C24733592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fcbb00-3299-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691134542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691134542, "uuid": "5d45f651-4db4-45b5-aee5-0f00149225c2", "comment": "Malware payload (Amadey)", "value": "507b94edde299290e79070a11c95bff5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691134542, "uuid": "bbc63d92-13eb-40ea-b192-98acd418ecf6", "comment": "Malware payload (Amadey)", "value": "64f545d0790c680398b0992d53288bb5084e531f618aaa00cc002c10c56151de", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691134542, "uuid": "599ae1c3-703d-4145-a57e-7390bb7ab10f", "comment": "Malware payload (Amadey)", "value": "1df5f2415f8cae2baf9a31cd17cfa3751f9edb8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691134542, "uuid": "87197feb-c853-4e12-a119-3aafc074c6ad", "comment": "Malware payload (Amadey)", "value": "09c0af3c74bb60fb4e0f80a11185ed8e7cc8be6346d52b6c99ef1829e1acbd18dd9842a3c02c70ddbae9284e672748a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691134542, "uuid": "07aa7bc5-69de-4eda-a11f-610e14cfda34", "value": "T173C4121367D99037D4E117B01CFA02D30E3ABDB15DA1572B2A95A95E0CB26D8F83633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691134542, "uuid": "92445cfa-f755-45fa-8820-77168eee4f78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691134542, "uuid": "1383e882-1afc-479c-8ac7-27c78e45db15", "value": "12288:VMrey90UznDitro5Ssk22OK5TWSaxDD40A:3ypz+tIk/OCTuZrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691134542, "uuid": "16de6ed4-40c7-4617-9593-fe5d5ebeb760", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691134542, "uuid": "b5b91763-1cb0-4b89-a932-614836adde8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691134542, "uuid": "e8ab650d-e026-4d9f-bae7-8be53027170b", "value": "507b94edde299290e79070a11c95bff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee1315a-328e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mekotio)", "timestamp": 1691129996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129996, "uuid": "498f40e8-9fc9-4b1e-8b04-7f97f7495fb2", "comment": "Malware payload (Mekotio)", "value": "296fd0446e8b4c74a6da81bf76942f10", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129996, "uuid": "813bfeaf-349e-47ce-ac91-e389b0fe2a26", "comment": "Malware payload (Mekotio)", "value": "65ddb35ef70878fa54900a9de4865d6b7626e0e6692d8cf51f21b554e18d4851", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129996, "uuid": "ce8ff940-3b5b-431d-83b5-0f8822a6ceba", "comment": "Malware payload (Mekotio)", "value": "c4de8d3841b70dda452fbe56e02f6527bc03c076", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691129996, "uuid": "4208015a-ed6c-4262-9c5a-79e4ec8a27b8", "comment": "Malware payload (Mekotio)", "value": "bcf27b9d8a50eb43bf61fdec5bee1b54641e3009a0340a8ee67c638e9f5fbd38b27a3844153041ee91d31dab75ceb6fe", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129996, "uuid": "f69df42b-99c7-44b3-91fa-736c4f0ffb77", "value": "T1614633B6B5B1910177AAE73F8C70A0B6329D5E3E2F6F78C01E036BB2F559D105A61C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129996, "uuid": "470e83a0-527c-4eb8-ba01-56418603d7a5", "value": "98304:MfRf1RU7I1obUbUJGAdk8ishdErrBrXm+SlPNbgSgQpcgM0yrprTUk43yA4oxSyz:MfR1iqbU0Z8ishuXBboNEQh/yrpckMyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691129996, "uuid": "62256c10-4a02-43a3-90a7-f8bb8ea280a1", "value": 5710512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691129996, "uuid": "663e0e3e-f51e-41f2-a112-3b2172c78148", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691129996, "uuid": "11e983c5-ce7e-413a-a3d9-ebfef5e1b317", "value": "ID-FACT.1691129794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccfb482-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124114, "uuid": "1212068e-d233-4f73-a7aa-69009cccd1b9", "comment": "Malware payload (AgentTesla)", "value": "ce9df067d2fc077d69c4dc8218a80b70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124114, "uuid": "781eb42c-410a-4d7b-b72e-189bb6a158bc", "comment": "Malware payload (AgentTesla)", "value": "664e334a6f578d3e8a1e8e87ef8982957443605b938417799bbed29cbe4a9fae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124114, "uuid": "2ca5a489-ed7d-4d2b-bd72-787df7300b85", "comment": "Malware payload (AgentTesla)", "value": "0a0c49cc788c7bbf26c0c4ddb54dd26dd325e336", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124114, "uuid": "29af8671-4df4-4019-b39a-c0626137015b", "comment": "Malware payload (AgentTesla)", "value": "57b4dcd2bb320ff5126ab1267e8f7211773a01a2df44dcabdc5580d7a16ce7ba6a8fecd2865a280e64439b5f79de0cce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124114, "uuid": "8f100627-f7e5-4701-84d5-f90cc1316e02", "value": "T13BE4228822C07B67F92DC7F960E5F8356FB6AC256811D745FDE963E12636F810980E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124114, "uuid": "b477ffe3-ace3-4c51-a68c-8e28a3b60b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124114, "uuid": "98e6a0f5-b098-4443-8146-9143a6644672", "value": "12288:O+1iYQvjOzzeFZVXVpz+qaJd7RGBOkDpFc9BW+QvB/RLybG:O+1QO3ebpK5zVUgBWtB/RLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124114, "uuid": "2ab19f65-2486-4dc2-85ab-00574bb9c3a4", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124114, "uuid": "872097d8-889f-4773-a4bc-c94145f4fb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124114, "uuid": "ff226e63-1e71-424d-b01c-ae63d417fb88", "value": "Invoice Confrimation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9fbe89-32bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691150748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150748, "uuid": "9f17b238-54d3-46d9-beea-56513b3d42e7", "comment": "Malware payload (RedLineStealer)", "value": "3139bc679b4ba81be913cceb0b41073c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150748, "uuid": "30d09b99-fdb8-4c72-8710-a947c277b845", "comment": "Malware payload (RedLineStealer)", "value": "67fd0fe273faabb1c632ac49ba5c631f4fb30e1517efa10976a4142b964a0ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150748, "uuid": "a56a3bd4-cc99-41c4-ad5e-df73e8a87124", "comment": "Malware payload (RedLineStealer)", "value": "0ef470924962a29882c48b3ccca4d3cae633468a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150748, "uuid": "eb3279af-dc48-4a56-9058-0cbee27bca13", "comment": "Malware payload (RedLineStealer)", "value": "6481b15bc09ac4659ba930878a115aee494b5e655334212b3b94277b99c52b78fda5584db1c42092f7b170967c6c4f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150748, "uuid": "2006e52f-7ea4-4624-a537-75569a76d828", "value": "T1A1C41267BAD99073C8F267B05CF356A31B31BEA15939829B2751994D0CB37C0B071B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150748, "uuid": "d996683b-6d9d-4371-99c1-5a6669cb4c8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150748, "uuid": "67ea801f-6bae-4639-8ad9-502d4c42adf5", "value": "12288:lMrSy90w8bvVumpyMLMCqpZ/LmDyfYWiQXGXYzs/:vy78btujHpxLmDygWTWX5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691150748, "uuid": "29449f2e-7e24-4a2d-8be8-9a61634a742c", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691150748, "uuid": "1de87904-c832-4f29-a5ec-1906077fee78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150748, "uuid": "0df5e02d-e54f-4562-adab-a8f4100f9f01", "value": "3139bc679b4ba81be913cceb0b41073c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ea425c-32a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691138142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691138142, "uuid": "4784ce5c-cc5c-4597-9596-5171c164f241", "comment": "Malware payload (RedLineStealer)", "value": "f9a6f634d774e492d6c32d23eef7fe0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691138142, "uuid": "95cdbe50-0350-4418-a43b-35fd42ed6a8d", "comment": "Malware payload (RedLineStealer)", "value": "69ad452e8c46e1efa750c8a93a769045b8b0aea0874d70305a356d7a4a164ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691138142, "uuid": "83b74f6b-cdc0-4cbf-ac1c-9306e6e9c1e2", "comment": "Malware payload (RedLineStealer)", "value": "8176a5b22db8b4dff28db4bc7fe44e99548d5ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691138142, "uuid": "ba3783a2-a2fa-43bc-bf22-2bc2816135ba", "comment": "Malware payload (RedLineStealer)", "value": "538fbea2ace9e870d853057816a3ce48a895f2e0bb1b42cdb91cb0796676d3e8409615c67510cf8a9bf84d972b12bc04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691138142, "uuid": "3095aedc-9a8a-437d-8665-325bd74500f2", "value": "T139C41253BAD990B3C9F01BB01CF647D31B30BC664D74536B6262AA5E1C73A85A43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691138142, "uuid": "03ebf987-c0cb-4894-ad8a-dc6b2dc9e6b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691138142, "uuid": "d789c96a-53ce-42a6-90e6-2b149ce9f34d", "value": "12288:WMrLy906khj936740+IRgysvNiq7rr+GvG:Jyxke7mIuyuNlnvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691138142, "uuid": "373b0b99-1084-4cda-a0fb-7a7cb0dd550c", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691138142, "uuid": "dfa4c4b6-db0d-4517-8db6-088d2eff9de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691138142, "uuid": "4690ae1f-6056-424f-8698-e6e29a38279f", "value": "f9a6f634d774e492d6c32d23eef7fe0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0e08cc-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1691124646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124646, "uuid": "9d3865fb-3827-4372-b120-887b7a51231f", "comment": "Malware payload (GCleaner)", "value": "f96281b847a320f20f61912a44891fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124646, "uuid": "1bf694d5-68c3-4089-9bbf-e3006cb13eb8", "comment": "Malware payload (GCleaner)", "value": "69f3bb57c68219505a660c704c331c92dbb0f1dfa4ffdf389a997e66b6c4507c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124646, "uuid": "d7b891ab-06c4-4128-832e-e91b064ba1f4", "comment": "Malware payload (GCleaner)", "value": "d825d60b3a40d2161c6b578c2aa458374833b89f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124646, "uuid": "1e24f91a-143f-4d32-b07c-46440c0c2e5e", "comment": "Malware payload (GCleaner)", "value": "ae4b2d6bb794fdd9533f31f23d12cb1d1c82b6504d653c4f638a787c8933c65aa4191c50b05f3bd393522b8a16b8222b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124646, "uuid": "c678ecfb-5122-4c61-a8e0-e3b197e77d85", "value": "T19D949D535190BC21E5265A329E2FC6E8361EFD928F1937A732187A2F79B13F1C172742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124646, "uuid": "61ffb94f-976b-4931-b59a-7913a76a43fa", "value": "53827632ddd0de733b0a70caaced2fc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124646, "uuid": "81c44b4a-2aa9-4f14-ad21-215bb441bcbd", "value": "6144:IFF/107QE8s1tcYW6vJfnKbV/m/Q+4dEXseY:ItsQE8Sd9FnKbZm/Q+4dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124646, "uuid": "acfb4920-48de-4527-a328-0b82d28fa80f", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124646, "uuid": "24ca8704-0503-4b85-8740-6761163749be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124646, "uuid": "c456fa47-1ae4-436f-be07-3f2d29ec9271", "value": "f96281b847a320f20f61912a44891fab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7ff479-32c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691154283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154283, "uuid": "3e9cf969-ce3a-4b03-990f-ba121f1915c1", "comment": "Malware payload (AgentTesla)", "value": "45b304de3bbd56e5a0ff1a0d5eb2e03e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154283, "uuid": "2b2896e1-29c1-46dd-9365-48fba061e4cf", "comment": "Malware payload (AgentTesla)", "value": "6a35c74d3d545c03769ee2f4e617dab819233e9c7749e85b7bc0f3456d2f8419", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154283, "uuid": "e75e6a36-5bd0-4755-86bb-b451fe75d1e3", "comment": "Malware payload (AgentTesla)", "value": "7163dcf07d6413d7c9c5a45f1d548dfa97ebbddb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154283, "uuid": "d4849362-ed69-4f18-b27e-99a99f0f218a", "comment": "Malware payload (AgentTesla)", "value": "a023acaf66031fa6f4e43ff3bfd8ada5939cd03efac9624a86b89283ce1d3a7e71123e61b466541265144b79016ecbf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154283, "uuid": "043750b7-a8cb-4a58-a4c9-6272e431deb0", "value": "T16E340E037E44EB21D6983937C7DF6D2413F2A0C74673820BAF48AEA529616536C7E32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154283, "uuid": "e10960cf-215c-4670-a539-509838ce0693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154283, "uuid": "a3c17d0a-88f5-458d-9757-34b51f019f96", "value": "3072:+ASzw0RHKbL0X4D/JEcaeoAH7niFRY+abmC:Wzw2qEX4D/JpriFRY5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691154283, "uuid": "ab14d9c0-e599-4b3f-8faa-d7704aeac469", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691154283, "uuid": "867f411d-75a3-4e91-bf2e-05e03bbe30bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154283, "uuid": "28a09da4-0f20-4a6d-ba34-b7642481384d", "value": "1691154280e1016e620be6005c308dd94efc52c9637677d4c26eae5922dcb7818d38e30583645.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda46cee-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691124411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124411, "uuid": "a7443949-feb6-47b4-bfdb-63a014ebcca3", "comment": "Malware payload (Formbook)", "value": "471cae709f41adf03fbac3cd46d34a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124411, "uuid": "58715ae3-eeed-4db1-b1e3-3f1fe912bd0d", "comment": "Malware payload (Formbook)", "value": "6a5fb47fa51f3c9fda9c9b2646a5d0b7d35ea2447e1c144131f2819d49e73518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124411, "uuid": "c53d6530-6847-4292-a42c-29073deff505", "comment": "Malware payload (Formbook)", "value": "8b6773e92b2437aa3a496be8ba46b00d743d60c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124411, "uuid": "edbfe644-2c15-46c2-9a4b-1d20442d8cac", "comment": "Malware payload (Formbook)", "value": "9f066633a7fc1509c19d959f2e6c176c3cbfe04a0100fb9688b78b861bf4d305ec809b62a8d917e0d204127cc0d3ecb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124411, "uuid": "be563db2-332b-471c-8a1e-49e4ac4e8212", "value": "T119D4128526A4BF27F93EC7FA59D2D02517B6BD229012D328ECED52F27236F460185D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124411, "uuid": "1c439b54-7603-480d-b0cb-7282dd62e8ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124411, "uuid": "0900cc88-dfbc-4cbd-b63e-72e487c57642", "value": "12288:C+1/YQvjOZ/QRm9KzF3NYqxEYZ4HO5V0lJKAVGq:C+1lOGEeNmYiP7Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124411, "uuid": "d01f5e3c-bb44-4177-a436-aa1b84a1c08f", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124411, "uuid": "c5783c08-ee3c-48e0-98c7-e146b4b5b8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124411, "uuid": "70b80ebb-a7ed-446d-b576-a8cb94167969", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563457cf-32c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691154222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154222, "uuid": "d5f7c882-720b-4ae0-8c20-ba18c7127ebf", "comment": "Malware payload (AgentTesla)", "value": "713ad4e2b7e1dbee78a72f2e1d78660f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154222, "uuid": "da46cf01-e74e-4539-94fc-870fb8d64336", "comment": "Malware payload (AgentTesla)", "value": "6b7e43e9b8c5156b30b5e476409ac5137dec537a66521ea6a08d5fa40ca63344", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154222, "uuid": "0e600259-022b-4a1f-a23d-92bdb0a0d643", "comment": "Malware payload (AgentTesla)", "value": "995b406d6e22a51525895284cf64e06085231ef6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154222, "uuid": "7c9e5030-f69a-4baf-9cca-f9d80bb533ef", "comment": "Malware payload (AgentTesla)", "value": "00f1721865de68cfbb4ec17e5682595413c4e06c04b9ae61f7a10b1dc7cf84ed625def9e8975e8957919fb5f5598e700", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154222, "uuid": "91fc6f75-b55e-4c84-9f51-5c98243faadf", "value": "T118D423F531DC4ABACD7A43B18053125E1F32BF5E66CEFB394ACA20ECC5DA5426421A5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154222, "uuid": "af660d88-603f-4922-8e38-3d4c57024562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154222, "uuid": "f9dcc7eb-13d8-423c-9375-9807ed516572", "value": "12288:oqm/pAfYZRLXnVZYcppiSVx3UFxRBIf00/IDlX21v+ZWWkXXGf9HZ:FmkgRJ9N0BQ00gDl8mie9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691154222, "uuid": "94e72edd-2b11-4425-ae29-f9e24d062b19", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691154222, "uuid": "3b2d43f8-57eb-4050-b308-665a39b98392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154222, "uuid": "ddbec7db-0fc4-4600-beba-7ae9995e7db5", "value": "EFT Remittance copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc74186-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691130261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130261, "uuid": "281d6671-8f3a-4706-9285-4cbccbe3fcc8", "comment": "Malware payload", "value": "343db0aa175acdb42158cd9a417c57ad", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130261, "uuid": "2d4d87e8-f10a-4155-a619-e271c7bea1a5", "comment": "Malware payload", "value": "6ba54cefa3afa897aaa049680e44197603209bdf97a8b69660f5e5a3711e6b00", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130261, "uuid": "7168b823-1f67-4b9d-b726-30698f2350a0", "comment": "Malware payload", "value": "d8e0b65927fc7c89c86ae2e42392392aa6ff0f00", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130261, "uuid": "eb591d6c-24ea-464d-8956-1e9a964ebdef", "comment": "Malware payload", "value": "6244e11b80bdf75687d497dbaf4c0721875c22216c34b437dad7ccfb7708fec403bbf6258bcb299f22cffa9e61131a46", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130261, "uuid": "76cfd227-1b8f-4ab7-b55a-ef8a0fc13594", "value": "T114E423BEAF2D5DF7994B9629B624CFA4A2071EA200364D8CDF9D0D7F3C39195D012623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130261, "uuid": "ffac9170-f87e-45ed-b23d-234118389fd5", "value": "12288:itR8OlC48hQNc/dbU4GCcG9tzpAI2T633DRbiEvI7ZBcKLq+JaJ1YVf0mBx:ij85QYbU4GTG9lpALTmDRbFIbcKLpJaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130261, "uuid": "147bd599-06cc-448a-9793-28a049bf67cb", "value": 675828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130261, "uuid": "ae8452b0-1afd-43a2-a054-218ba71cbd0e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130261, "uuid": "b9f87736-f0fa-464f-9e77-69af5d6a174c", "value": "\u767c\u7968\u865f\u78bc 112 \u548c 113.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bfcd2b-32c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691151612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691151612, "uuid": "6da989d3-0004-4ff4-af0a-241e3107af2d", "comment": "Malware payload (AgentTesla)", "value": "442ae498b4922d82330d052a07066bc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691151612, "uuid": "3e96d1e2-9adb-40a4-8988-93c4fb3368ce", "comment": "Malware payload (AgentTesla)", "value": "6c358b2f1adefc69a7743b5df9a83c54454b3558cdc14f63c9a953bea9895ac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691151612, "uuid": "94f1fe61-c738-44a3-bbae-efaa5c144fed", "comment": "Malware payload (AgentTesla)", "value": "a06b80a3b25da0cc5153f1e6973aff9551282082", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691151612, "uuid": "e72ca8d0-2272-41cd-a8bd-f13a7dfaf7f9", "comment": "Malware payload (AgentTesla)", "value": "a737b8428ac7db7b4bd18d6927a6afb029f32c7fd23bd540629542084e666e7ad4633b3e1f14a745b22d9bc435077d62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691151612, "uuid": "2a908c41-49d5-4cfc-a13b-5eae64257655", "value": "T10933635032F86B26E97B0BF55AB45E6413B3F8666875E2481CC931CE2B73F088563B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691151612, "uuid": "0a41d7f5-4a05-4d4c-8f86-108f7c342287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691151612, "uuid": "17e0dcdd-e39c-4702-8859-3d34ae84bc10", "value": "768:EKuukDRSa2IVI9JDE25Eps/iRHHcum/SUjznWfLUyqSTaHJkwiwGoJT2y:Wu4RRGJDpO2aBwiqSsk2Go12y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691151612, "uuid": "503260b2-ca23-4966-9e76-154427f894d5", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691151612, "uuid": "67b108b6-1f7e-49c0-957d-39d96ccf3bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691151612, "uuid": "ba9c5c51-c799-41e1-9e85-f06072f812c4", "value": "6c358b2f1adefc69a7743b5df9a83c54454b3558cdc14f63c9a953bea9895ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6caeff9-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mekotio)", "timestamp": 1691130412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130412, "uuid": "58b06aa8-2fb2-4158-b746-bf6142d54c38", "comment": "Malware payload (Mekotio)", "value": "55282c7d2a483cfa9cffd7752c0e0c88", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130412, "uuid": "86cb44c7-8e22-4076-8622-d4f3f19441c7", "comment": "Malware payload (Mekotio)", "value": "6c596efe9f4c63a592c0ad9e42c936151479c93d0f55731973723bb517e29a75", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130412, "uuid": "ed08f513-69fa-429b-aa24-a2bb02508a4d", "comment": "Malware payload (Mekotio)", "value": "81325abb4b35d23b1ebae08b2febf325217ae353", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130412, "uuid": "87c326a7-b12e-432e-b0f3-365fb29144ce", "comment": "Malware payload (Mekotio)", "value": "5fc46c50f4000063caf8e56513a680b1284c7ad703affab27d399bf7b8c8a53058dadb18d87506da4325c57a6ceb8ad4", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130412, "uuid": "9aefef8d-2c80-437c-b51d-bcc4e3bbb48e", "value": "T1D94623A17AD21244E6EEC3380F53FAAD74E2172C9172102AFC502BDFB5F6B545AB1943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130412, "uuid": "d9e94ae2-afd6-41a3-84ce-d646976918ad", "value": "26743bd67965998be9966d88940cc6ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130412, "uuid": "4ba20061-26fe-442b-a7f3-cf6d1b19db50", "value": "98304:e3OtZdlWPDRabO7mev+fRh3/nwvuXD1jNmSER3bv+QSKpa8A2yxHXZUkGFWgNH8n:dtZdYPgbOi5Ma8b0KRNyxHWkyWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130412, "uuid": "9c2c32f1-3ba0-4813-8fa0-66fb13fa1eee", "value": 5799936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130412, "uuid": "032ba40c-762a-4755-88a3-86d6322d8ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130412, "uuid": "bccfb78b-9b37-43eb-8bcc-3b2fdd4686dc", "value": "MSIE5A.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1145409-328e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130000, "uuid": "8428c2af-37d5-44fc-97e8-c911bd4e5e9a", "comment": "Malware payload (AgentTesla)", "value": "f9517124ea186fa125326ed4feb50da3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130000, "uuid": "c8dff8bc-7e60-4378-a6e3-4f39e939923a", "comment": "Malware payload (AgentTesla)", "value": "6db288a6dbd0684c4978fa8efa113e733b8c670f04a3bf2ceebe9487ad379142", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130000, "uuid": "1dc0df22-b388-4742-b049-d3b41b2ac565", "comment": "Malware payload (AgentTesla)", "value": "a27b52a43913c3e5d2aeaf0997dbd991f67e52bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130000, "uuid": "96832b6b-9306-40d5-a0d0-c5e149caa4cc", "comment": "Malware payload (AgentTesla)", "value": "a38c60dbaa2ac67c2e066b6dd78d21e5c0de5895367070098bb5145fd8858b81fe9babc16465dff787d73d8903e0d36f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130000, "uuid": "4e11f32c-4684-4d3b-8d34-1900554d9f12", "value": "T1FAB5E503B96795A3D1849737C1D6240043ABDFB1726BF64A268B331969737BA4F0A337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130000, "uuid": "f9ad3918-40cf-4a19-8b6a-f9a3fe081288", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130000, "uuid": "3f361a1a-86ca-497f-920d-295a3e8bbef7", "value": "24576:i1aVYP+XpZ+8vSv5IGvshsGcuWVpzszn/HEeHKXNs9zyMNbYgzn45tsI0Y9uLSiF:7Zr+CWP47c9XNs9tFZn452jH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130000, "uuid": "2324d35b-d8dc-4605-a458-c9fcc26ab6a1", "value": 2378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130000, "uuid": "f68a68ef-814c-4eb6-a429-4efcf3989dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130000, "uuid": "9950605b-acfd-4e84-86a0-e256b9134ffe", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89231116-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184372, "uuid": "f92341ea-83dd-42ac-a884-1e5481c2d877", "comment": "Malware payload (RedLineStealer)", "value": "a6738ba8fc50ea7c69619a0f2e9987b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184372, "uuid": "863162c3-4820-4574-ab1e-2e295bbe0e66", "comment": "Malware payload (RedLineStealer)", "value": "6e00f680440207690e08f615358f388d3d9af4e4fbe8665d4f774ca452dca186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184372, "uuid": "d9610433-2b0a-45d0-9b05-731271313bbd", "comment": "Malware payload (RedLineStealer)", "value": "38ed6052b659e4ab5f5359d031f162fc886b8cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184372, "uuid": "743c3e7c-0ec9-49c5-9a2e-001731ac8e76", "comment": "Malware payload (RedLineStealer)", "value": "2ae24e69f3d0bee2502fac60ca09e6ba8aa49ce68119419f3787888604bb87023a9db431ecb428527f7b7eaefacdf766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184372, "uuid": "0d942dee-5808-445b-a759-7800674a30e7", "value": "T182C41252B7E89272E975277018F303D31B357C21987893EB228A586B0CB35A499B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184372, "uuid": "a96b6cab-5f77-4280-b332-a4655f88bc42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184372, "uuid": "68732b64-932a-47aa-b5bc-4afc6a17da84", "value": "12288:mMrIy904/N6N9xfBqpfjfz3CdpSNxnpyrb7:SyP/Nu9xfBqNzUqZpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184372, "uuid": "7a95b817-8eb7-438f-91c3-f1bf2f320318", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184372, "uuid": "12c31e92-ec58-418a-86c5-052a0f6fc8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184372, "uuid": "07fdce2f-0137-4526-a1e8-c735fdcfac46", "value": "a6738ba8fc50ea7c69619a0f2e9987b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4879eb4-331c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691190994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190994, "uuid": "cd5f631d-a2dc-4c2c-9e23-9391e2c44f06", "comment": "Malware payload (Amadey)", "value": "2cf3f4caded8baf36110617535354421", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190994, "uuid": "ad3b34e2-022c-4dc9-afca-f5ac44dba8a3", "comment": "Malware payload (Amadey)", "value": "6e8e1ba3cfb41dcac33b9f2b9fdc314340c79691bf821851a86d99d0e6d74f05", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190994, "uuid": "72735f91-e269-4215-a323-6fd3195a0d3a", "comment": "Malware payload (Amadey)", "value": "e1a7096a476dfd709f3674e8d0393ceef7649ce8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190994, "uuid": "61631c20-de0f-4631-ae14-002b1936a3b7", "comment": "Malware payload (Amadey)", "value": "632bddd700f9ff6bb7800353405ed0afb8c30dde4d44d8d9f5990d28f2a7efb6a1b83a1f7b6728e7b06da992c2a060b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190994, "uuid": "2a4b5a89-1f9b-4a72-866b-4b39a0cf7779", "value": "T1A2C41216BAE84136DAB617F018F543830B3ABCB55939927F63855C0F4CB32D5A532B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190994, "uuid": "463a9599-288c-4270-ac2b-c6a617c8a9c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190994, "uuid": "44a56e2a-1227-45ee-9124-c6f764167876", "value": "12288:UMrXy90tDUJgZUwzu8NX5bSQW7Xg4TBKPIXm3O:byWeqJX56gf3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691190994, "uuid": "3e88fddb-4a00-47ca-9812-381a2abc0d5c", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691190994, "uuid": "6ac0581b-3d6b-4b9c-af36-bbb082e9d2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190994, "uuid": "48ab8fa0-20e3-4943-838f-36b203892962", "value": "6e8e1ba3cfb41dcac33b9f2b9fdc314340c79691bf821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0dabc2-32ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691169156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169156, "uuid": "18a0a698-4637-4595-887a-39264d4c81e2", "comment": "Malware payload", "value": "561315341c9a5ee5586c8df8a6b790cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169156, "uuid": "374233b8-6229-4ccb-9d01-6bb50e1b8f22", "comment": "Malware payload", "value": "73d579e0cd3111f41f834165405d43b14b2a3b4c23f9f30e7d024fa383013827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169156, "uuid": "e59ac7c9-049b-485a-8160-15f7b8bd7b72", "comment": "Malware payload", "value": "63e6fc7df9ac91949e8a153742635f43682ebcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169156, "uuid": "cf858702-7fa3-4342-87a6-f10be583b743", "comment": "Malware payload", "value": "1a7417cdb2016981985a2bc45714baa8725b168d6467e3fdda71ca219f74c2fe7f0e3958c175fb42429b8c0dd0ad6a9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169156, "uuid": "1a542ec5-b943-4c11-8b55-ddcf491528f6", "value": "T12B644C156FB91CB6C017B43F0C6E84524B337827166B83F7A496DEAC0EF76E8D456822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169156, "uuid": "f0b14890-806a-442c-8a4b-bc5b5af564f9", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169156, "uuid": "b9ba2627-455c-4743-9a09-bb8f2f85a432", "value": "3072:HPk/TDYQ0qIN6NtVcOXoK5ULK2/sPj0peyRS6CSfKVu1xgCAWU8fvJqxEm4x1ES1:IDnt3oP2xPjCp/1fvoxEvTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691169156, "uuid": "22bc3535-d898-467b-9f27-84ddc11c7d88", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691169156, "uuid": "a9cf497a-cba5-4d04-9e95-d381490c4971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169156, "uuid": "afcf2e56-7bab-4b61-8878-cdf783c4fd46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a66234-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691149248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149248, "uuid": "77530233-26fa-4974-ac8a-b5cfddc2dc80", "comment": "Malware payload (RedLineStealer)", "value": "4eddc6bfa05438d9403c15181f91ee27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149248, "uuid": "5d2ccc1a-2710-40af-ad0d-4411e0a92c51", "comment": "Malware payload (RedLineStealer)", "value": "752465ceb7759edd1230ff43d0de6fec68f69e2a6b45825833b1e1c1b26822c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149248, "uuid": "58f7f789-8fd3-4b6d-9fa9-cef0412ffcca", "comment": "Malware payload (RedLineStealer)", "value": "69561192ed6cb22c52f17889c96bd03a72c24473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149248, "uuid": "e2a26c3f-6d00-40e2-a655-5e30e1fb069e", "comment": "Malware payload (RedLineStealer)", "value": "80a7103c82e89af3ff7d42429d75ac7c48d5fb4dfbf76d752e273ee01dbc0cd5235445a382bc2ef7be03d520a29cc8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149248, "uuid": "c3591820-a782-4765-a00b-798689385bba", "value": "T124C41212BADD4072DAB61BB018F702D31F367D62A979472B2751881F0C73384A976B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149248, "uuid": "1c4b630b-6c76-4a4e-941b-b20da0411e0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149248, "uuid": "c21e5f63-1431-4157-a905-ab1509ff656a", "value": "12288:SMrGy90/zxl+hPjIVQVYZTylgniNZQAmru9iR:4yUzxBuUTyunmQAOiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149248, "uuid": "a394ee2d-e994-4ae2-98d1-c0446041d04f", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149248, "uuid": "d7a736e7-1f2d-46ab-94a3-89024fb3db2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149248, "uuid": "c0e9891e-8228-4b2f-af22-fdfda42ce333", "value": "4eddc6bfa05438d9403c15181f91ee27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671a06fe-329e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691136641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691136641, "uuid": "e39306ec-c13a-417d-820a-e254d4cffe50", "comment": "Malware payload (Amadey)", "value": "78cf4fd12d007b72a9807e1e166db012", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691136641, "uuid": "2b8ef31d-d4b1-490b-811e-3cd79cc6d631", "comment": "Malware payload (Amadey)", "value": "75af23f20fc1c3b7a63d64c442a53fc3ae40eb60aef540faa140f32e7c24fc33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691136641, "uuid": "fbdc55b9-d547-441a-bbd2-9b999f4a9f55", "comment": "Malware payload (Amadey)", "value": "8ee631b03cbb327027fcbab4ea27ec04e3fffce5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691136641, "uuid": "f9047fb0-b52c-4110-b6e7-b16e18edb8ed", "comment": "Malware payload (Amadey)", "value": "37a0d8499528084c174777a5b59af71a33bdf07fe98070c39ac8060bd0652c5ac7e0d04c81f122e147714e937c9b86c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691136641, "uuid": "7eacc447-f409-4bfd-aed1-58223c0afc7b", "value": "T1E8C41223ABE89063C9F2277058F617930F35BDA18D74972B67456C2B0C72790B93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691136641, "uuid": "e8c46dae-079e-41de-9c34-9c63f00d1e0f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691136641, "uuid": "dc4ed4df-8128-45fc-b76c-db217103878d", "value": "12288:iMrRy90UOCG7Fbiqaokwk3SM6XuuzO0k0XU1iV+Wqd77Fq50:nyDOZxooZbuuC0k0k1bZG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691136641, "uuid": "b577598d-dc0b-41aa-8265-6b0cf1bdbc12", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691136641, "uuid": "186be94d-a15a-42e5-a2af-9cce2d5779c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691136641, "uuid": "cbecbf76-9497-404c-8783-f724a0bad734", "value": "78cf4fd12d007b72a9807e1e166db012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ad97f2-3276-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691119401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119401, "uuid": "474c0d60-db29-421a-ab6d-49fc67a1f2cd", "comment": "Malware payload (RemcosRAT)", "value": "4853aa5ad98757a756f1acfe1bed460d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119401, "uuid": "c3d40d2b-3996-45d2-aa88-f99e3999ef4f", "comment": "Malware payload (RemcosRAT)", "value": "75e57d3f76491b9bc7fe155b20ea8f9498892bd54a34824fca50bf0ae4a1902e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119401, "uuid": "3c6a5c4d-476e-404e-b217-e1847786945b", "comment": "Malware payload (RemcosRAT)", "value": "816027f9fbce3d22624db698ede23a2d4cc25023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119401, "uuid": "127d1966-3572-4500-b5d2-12bc7db32df7", "comment": "Malware payload (RemcosRAT)", "value": "fc5db709c644647fdbc0feaf1bf822368d4664c04336d6fcdbebc5514b8a99f3898b300965665ea467719b54eaf32dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119401, "uuid": "696d6ab8-a778-45db-ae07-40c80a61fc86", "value": "T11615236CB4ACAFA6FA28C7F59CD0E53457B1B43B6923C61CACF526F21A70BC15981503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119401, "uuid": "ad3fef84-04b5-4bec-bb76-791c1d013998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119401, "uuid": "6712d6f5-23c7-4d06-8ef0-58c23174af59", "value": "24576:F+1IOE/QNWkphcu3WGMPBGqHsOGCP9xMS5RkP5:F+1XrhcuW3GqBGCP9x/5RK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691119401, "uuid": "ad669e9b-9a6f-41c6-9bca-7512ef5add50", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691119401, "uuid": "606be754-f52f-410f-b8f5-e4122d1fa894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119401, "uuid": "37eab9e7-e6fa-4d5d-8999-e8c02db9132b", "value": "4853aa5ad98757a756f1acfe1bed460d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b606b0ee-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691124747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124747, "uuid": "53043541-02f9-4033-bfe6-d5a75e4a9cbb", "comment": "Malware payload (Formbook)", "value": "50dc985e3749a03e19cad19ecf48888e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124747, "uuid": "5d9b0526-64bc-405b-afbd-70d15afd7702", "comment": "Malware payload (Formbook)", "value": "7604b60990297c5b6f34db41501c0297dbeac0f303377ccc92c4092579b2c846", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124747, "uuid": "3378212f-2eb3-489d-a83c-9090ab97699d", "comment": "Malware payload (Formbook)", "value": "b800887d75f8cfe2f55541e7d201e94e46ca8ab1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124747, "uuid": "a790c55c-ba74-45f0-82f2-16bfec7ca658", "comment": "Malware payload (Formbook)", "value": "963db2137582b3cf1d6430e523d76ab295e93e179b6dc1ab0753e523ef622c70f29175604144a635db21a243f7a18b8e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124747, "uuid": "71cc76a7-0b13-400f-a483-420097d62eb0", "value": "T1AE33486DD34F0269CF52537B9A2B0A4446FCBB3AF24551A1306C437933EEC2DA1266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124747, "uuid": "280a541d-f725-46a1-863f-fc46bb8110dd", "value": "768:zwAbZSibMX9gRWj4rOoE3M04JUNWMgQvWx1BuYUdVJ:zwAlR/23KUNWdjrUdVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124747, "uuid": "6f109aad-9013-4348-82e9-16af0ac1c160", "value": 51569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124747, "uuid": "2e05f3a9-3f93-45fb-b42a-a98eab81659d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124747, "uuid": "3d3eaed6-6bca-412a-a816-300714b94e7e", "value": "50dc985e3749a03e19cad19ecf48888e.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb91634-32f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691172941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172941, "uuid": "70361a9f-0d51-4fc9-8d92-723ad63eb8d5", "comment": "Malware payload (RedLineStealer)", "value": "2777eb03832e5bbe73430a5bdd6e0116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172941, "uuid": "f7f6ecfb-50c4-41f7-900b-29bac4160847", "comment": "Malware payload (RedLineStealer)", "value": "761060924e9d97d5723ebddda4b0d97209f7268e8b17a6c066af3b426cad18dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172941, "uuid": "aaab11da-7abc-45a0-b2a4-72299bbc8420", "comment": "Malware payload (RedLineStealer)", "value": "070772a31762aa4617b1313ef82168dfdc45fc6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172941, "uuid": "fb39987a-d3bf-4109-bb83-7bd054bcb03a", "comment": "Malware payload (RedLineStealer)", "value": "d18c0954565fdceb49b76e8a672f15058d61b0b6247a754d336bdc9677a86dafb79133ac5ae5d91c94720d576f7856f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172941, "uuid": "9a9e43f2-9420-4208-af70-333885607afe", "value": "T1B0C41246E7E8C432C9F527B088F712D30A367C96597482AB23415A5E5CF22C4BA7377E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172941, "uuid": "0e3d6878-f9e8-4a5f-b014-30d50c9621ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172941, "uuid": "04729ddf-981b-4d4f-907f-8459b3d4a982", "value": "12288:GMruy90AubSwSNFpb1/lligBYC25hDqi/zb10ahhV0rf:0yI6NFpb1RzCqi/zbTV2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691172941, "uuid": "e0b02f7e-0b04-4cad-bd8d-333eb9895e2a", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691172941, "uuid": "1fcde8c0-d41a-4f22-80b2-69601f7ec825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172941, "uuid": "cb0ddd54-7f1a-4c2e-a36c-3f15f9e42699", "value": "2777eb03832e5bbe73430a5bdd6e0116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd122802-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124356, "uuid": "faf38367-dcb7-4842-93d8-c991247b517b", "comment": "Malware payload", "value": "67743470e5695b6664a907285357c4f5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124356, "uuid": "368c9010-9f7a-4205-aadc-1b866819bf8f", "comment": "Malware payload", "value": "764d6644a25732b56e661d27e172e5fbb68cc2b42ff4ce109c2cc5f8a6fbaf98", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124356, "uuid": "32dde95f-617b-446f-8a71-390a4ef31c64", "comment": "Malware payload", "value": "496cb1235dfe76c3fbf72f9855e171f486dc4a4f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124356, "uuid": "b63184f4-4a13-41fd-8324-c6fc1441626b", "comment": "Malware payload", "value": "8fa37d8ccd21a62a17092e0d7ad55ca11141bbc605957392ffc5be16bb69c660e09ac61783b2db7bd7c73b3bbbe512de", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124356, "uuid": "f982257b-fd2b-4bcb-ab52-4dccf31ad767", "value": "T162E4339AE159E25CCFAD46F5D07BF3E0851249CAB8B0E42D102DD448A9EF68CE758F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124356, "uuid": "12ccfb42-5188-4c4c-a0a0-df141e43cf8b", "value": "12288:61nWssapW9CysfjVVysU/SmLdHTGlTyEoT0aQLKUjekLzOE/iRM09a4lq:klWQT7VAsaSSCGEoPQ2eIM097E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124356, "uuid": "ca8f4f0e-9782-480c-a2b9-de0122443f95", "value": 678113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124356, "uuid": "6701dd99-6ac1-49d5-8da1-9d6be0fbe86e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124356, "uuid": "d77d09cb-fcf1-4293-b4e3-5bbe36ea247a", "value": "SHIPPINF INFO.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ba5616-3289-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691127637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691127637, "uuid": "d47a54a7-bcc6-4c77-a2dc-eec1ae383279", "comment": "Malware payload (Amadey)", "value": "f5dcbe4de3b75dca3b456b066ce398e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691127637, "uuid": "468bc459-271c-4850-8495-705fe65b9f2c", "comment": "Malware payload (Amadey)", "value": "77b66558d894838e7ae2f9b203bb9a45244a41d3d4373a3ca0ed8523ab553c0e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691127637, "uuid": "29989474-ccf8-44de-90e3-7d002257ea81", "comment": "Malware payload (Amadey)", "value": "a6372adb20913c8f1a2b996b5068fe2b1c6c44d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691127637, "uuid": "b257cdd9-c65e-4309-83c5-6ee68edbfe12", "comment": "Malware payload (Amadey)", "value": "9e226624dc9f84313409d5e8d470608df71ecc830415c1c03518f1da7ba78e624fbe36b592c59f43d7a62dca6e94f10f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691127637, "uuid": "5c2b7b2b-7807-49b1-8f01-94bfb05f4671", "value": "T175C41263B6D980B3D9B12BB05CFA03930A35BDB19EB5121B63519C1E0D73784A93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691127637, "uuid": "5016e2e6-4ed7-43d0-91d8-27c47f9cd362", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691127637, "uuid": "72179534-c221-40b0-b47d-a1923577856e", "value": "12288:xMrky906StfmV7/wSHI8F7C4yAJNi8+X1RY7FL/T:VyFSteJ/w/K7C4yQNfG2LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691127637, "uuid": "d2dfbc0b-1c18-4f79-8617-1bb8406fbb7d", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691127637, "uuid": "33390253-b32c-4d39-8b06-19967cfc29c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691127637, "uuid": "3b890631-f75b-4e1b-967d-12a046363dd9", "value": "f5dcbe4de3b75dca3b456b066ce398e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dffea2a-325d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691108735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108735, "uuid": "b826756b-cfb3-450e-9007-1a6f8e7f15e7", "comment": "Malware payload (Amadey)", "value": "ae48f4a6989b94a79ea40094ffb3dde5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108735, "uuid": "058994d1-e344-4d5f-b09f-5e821c347412", "comment": "Malware payload (Amadey)", "value": "78909dc4aff7a7c3624c4a3be1f9e7d98a63075d0bb706ebb8d28397e6748cfb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108735, "uuid": "ff87f05d-6f8f-4fb9-8b5c-8dfd8ebc58f8", "comment": "Malware payload (Amadey)", "value": "9dc1f8985fab6a1e8ca363f578dc40e36897c6ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108735, "uuid": "24c5e64e-b824-4102-94b6-02996fc34ba0", "comment": "Malware payload (Amadey)", "value": "c9ac102947f068218d1f4e070e1b61514a9e52d09494f4d9b8394362f907627c28eae73730c4bd29a80b5ecbab72c99b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108735, "uuid": "2d427d56-349c-45c5-b162-cc6db1f4329e", "value": "T12EC41253B6EC4033C9B1177048F712D32B3ABDB19A75939B6782984F0873685A536B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108735, "uuid": "411bccaa-1428-4c2e-8710-cc4dca9e46cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108735, "uuid": "c05a49a3-ddfe-454b-8f40-1116591b0dc3", "value": "12288:nMrey90DFmfpJymjS54Wbk+c4KZQiLiYZcub21+ToPE:pyQ6emjeVYHLlZnb2AsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691108735, "uuid": "4d9b5f28-fdf4-49e2-9c66-649c0bff43d4", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691108735, "uuid": "dd49c2f9-1605-4f93-8cbe-d2f622158de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108735, "uuid": "675d2a14-5ba0-43f6-a17a-0d62edd31e30", "value": "ae48f4a6989b94a79ea40094ffb3dde5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e89b6f-32d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691160373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160373, "uuid": "26debc98-a641-4466-a15c-2801a35945cd", "comment": "Malware payload (RedLineStealer)", "value": "055b183a7067b4f9559aa365c3b316d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160373, "uuid": "6a5640a5-2cbd-45a0-99dc-fae1741ecc3e", "comment": "Malware payload (RedLineStealer)", "value": "78cd523322984e3aa227c71a8f52c0de17ffaefd6a0174d808655b8e051d508f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160373, "uuid": "7a915f2e-6604-4af7-81b5-77d211419d15", "comment": "Malware payload (RedLineStealer)", "value": "d492ae44675dcebf83af5014c98303c4105a7188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160373, "uuid": "e3b53ad9-0067-4833-a58a-23c82796c8b2", "comment": "Malware payload (RedLineStealer)", "value": "92e9c7d97161745a485f5d9161d98a6cbd216bf7fe7d696dc3fa788565b49fab058b6f981d533b10e594ff2b8bccec29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160373, "uuid": "15d81c11-b2bc-4445-892e-312a6a62149b", "value": "T1B9C41223A3E58173DCB6177088F90A930E357DB59DB8C76B23866D6E0C726D4A53132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160373, "uuid": "ce3b2d1b-bfd8-4840-81a0-09d59b8998bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160373, "uuid": "d93e5930-d1a8-42a9-9527-1ad5aaec3a8c", "value": "12288:qMrSy90tHaEiWuQNBn5z57NNqCSNDXl97wphNLp39MXMl/4I:UyuHaUuQzn5VrjSNx97WhZ48l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160373, "uuid": "0ffe4968-0df2-4cb2-8eec-0dae7d00c06b", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160373, "uuid": "c68868db-dc11-4fa6-9cee-a5d165bbdd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160373, "uuid": "fbe8339f-73ca-4c43-924c-e627f9374e9a", "value": "055b183a7067b4f9559aa365c3b316d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8566ae-32f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691175657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175657, "uuid": "d072ce67-680b-4f9d-98d9-62df5e214682", "comment": "Malware payload (Amadey)", "value": "c615e3035abce3f87f699b5926c87fae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175657, "uuid": "924c95ed-8f01-49ca-afb6-08395d291406", "comment": "Malware payload (Amadey)", "value": "78fcec141096dbc7235c1b2e532e08124192620fa4ad19a1e551a7710fb02eb3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175657, "uuid": "309dc3d2-1407-48f5-ade4-7f27d7b548ee", "comment": "Malware payload (Amadey)", "value": "708cecddb46fe813aa38e4f316209d7c01d79d27", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175657, "uuid": "c7de49c6-f8bf-49da-bcbf-4a24ed5b5437", "comment": "Malware payload (Amadey)", "value": "922b8ef72652570dc3ad773b7d273e904992c2c6c6ce14b2bdc21698d6c13967575d11cf1a2866cdb2b674728caa5c18", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175657, "uuid": "92739b68-948a-4aa8-ab9a-c7bb3c37de8e", "value": "T1D2E41263E7E494B3D9B6277018FA13934A347D71A978835B6386664B0CB31C0A531BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175657, "uuid": "1652da16-f6f4-4738-8214-7ad10cee96a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175657, "uuid": "703892ac-df47-4993-ae6e-3120ec14f88b", "value": "12288:7MrWy907ORIl2mVLIh7LjGT5JQff18KzCH5JeLtNpnkfyTB0HqsTGG8yYargnnLS:1yDmVkh7mXS18KzayBobiGlYaMLb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175657, "uuid": "50c8cc1a-6709-45fa-9b05-9f3a0d6677b5", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175657, "uuid": "739683b3-91ad-435f-af46-63524e6c97ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175657, "uuid": "b2478eba-5c09-42be-bb8c-5a38cfcf6ef8", "value": "c615e3035abce3f87f699b5926c87fae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f36e7e-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173248, "uuid": "71c03286-89e5-4489-a9bc-ebf3a2688dc7", "comment": "Malware payload (RedLineStealer)", "value": "31d705fac4898155233b7a0280d0b8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173248, "uuid": "b4c7eaec-6411-44f1-ba9e-301991f07219", "comment": "Malware payload (RedLineStealer)", "value": "794dece52c508f6e3a864455e95e183a3d5871013901be51be203491837bfb20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173248, "uuid": "64288fe3-61e1-4be2-be9f-91a8026942eb", "comment": "Malware payload (RedLineStealer)", "value": "cfa6df40c0480c1dfd706643b92b389c8d3788f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173248, "uuid": "eda4403f-0e3e-4e73-8026-24c70be31a26", "comment": "Malware payload (RedLineStealer)", "value": "ec790366d6e7314cd29bc2669ee5b16ba4a76aeb989a3b78320e61b483c42226542b7a4e475d5d749e74061653d8938e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173248, "uuid": "f753bc37-be25-4998-9164-c11cc9af3470", "value": "T166C4128297C89472DCF12BB058F302C30A36BCB19D38975B3B9699591DB2AD4B532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173248, "uuid": "3e204805-8a27-49c8-8e1d-8f84af159ec8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173248, "uuid": "1316afb7-adee-4b0a-9c2a-9c4f63424790", "value": "12288:VMrCy905wtSU07p8LX6Rf1StteJCsEHdnJgBYCPaydizpAazBz:byc6mRf1SnRNHdSzyydizNzBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173248, "uuid": "75d71c96-6d9a-41dd-8762-26bb32f08b40", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173248, "uuid": "ac81d7c3-a6ee-47e6-ae76-a913acafcaa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173248, "uuid": "e1fb45b2-90d1-4ef8-9731-e93a137562de", "value": "31d705fac4898155233b7a0280d0b8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d04ecf9-32f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691171735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171735, "uuid": "64749de2-fb04-476b-aea3-b450100fcdfd", "comment": "Malware payload (RedLineStealer)", "value": "5cb36dde8646045bbeec68613f485681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171735, "uuid": "46d777c9-f2f7-40d6-a479-a79d3c3f81ef", "comment": "Malware payload (RedLineStealer)", "value": "794fcb7f13917d156e1fea8fbdf04488829fa735abc00cce8a93efbe3a93cb95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171735, "uuid": "19f5c447-3c5d-4e58-aac0-ccdec881f24f", "comment": "Malware payload (RedLineStealer)", "value": "192d63634d00b2f027b30147fb513f7835edee43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171735, "uuid": "8906dcba-cf93-46f9-835c-af9349e2c4e7", "comment": "Malware payload (RedLineStealer)", "value": "10f3646bd48258ceee7d2ae9fec2ce1858d8dd66365b748de61ea042aad30d88b29e6511ae1a2c337253e042fe5e93b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171735, "uuid": "134ed9ca-b65a-4592-89a6-116c26ce0716", "value": "T170C41256A7D84432D8F617701CFB03D30E39BCE4A878C36A2346995B6CB22E5A53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171735, "uuid": "16392a4a-1d57-4397-bf24-98359d2ee72f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171735, "uuid": "2d8cc149-2e69-4b86-9a41-7433be2f37f1", "value": "12288:iMrYy90T9JRpiLMUZmeg5uacn3GAin1KFjwlL1rW:2yg1YMUUeP3E1eQL1rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171735, "uuid": "1dad0834-eb1f-47a4-8cc3-c96d062cd004", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171735, "uuid": "d9199a73-4d09-4d1c-a18c-f432535f7feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171735, "uuid": "6883ad0c-c863-4a87-a204-ac44477aeb49", "value": "794fcb7f13917d156e1fea8fbdf04488829fa735abc00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ea1c21-32e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691167838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167838, "uuid": "337d899d-d164-40d7-9811-423ecb36c8f2", "comment": "Malware payload (AgentTesla)", "value": "cbbda3dc0940588dba1ac11f82bef032", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167838, "uuid": "9a542fd2-1bda-4678-ae8e-42be7bdc089d", "comment": "Malware payload (AgentTesla)", "value": "798a1dd333191702e1ada41a7d113ebf25f611e17562d9466d0bfed0d0f87271", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167838, "uuid": "d62abb26-a868-4878-b47e-de4949bfe84e", "comment": "Malware payload (AgentTesla)", "value": "e7697987767f3a02ca0bf7e3320a84241c469361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167838, "uuid": "c68d7bb7-a9aa-4aec-8883-1f256a532b1d", "comment": "Malware payload (AgentTesla)", "value": "ef87f1fa370fc187df513745d41add8c5bb6461e7060d1fbf4e0e313cce282988fa2feb00ce591cf634050b8b22b3c9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167838, "uuid": "267a0eaa-fd87-489d-988f-932fc11d03ca", "value": "T107D4124531E9FF27F96D47FEA8E2E930137428295C21E709BCFA56E32572B460841E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167838, "uuid": "0b20378a-2c2b-49c0-800e-43cea2d88b18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167838, "uuid": "eec77320-7d7a-4137-a906-d221aee8eb4e", "value": "12288:7+1WYQvjObb/OBHsc++KUSf12geoiPRixs1hcLuTNyXhPKo4l4:7+1kObb/Ox7++KUSfIgeLPRvXGkNEhC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691167838, "uuid": "80bf7945-4d00-4a2a-9c3e-d1c388feb506", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691167838, "uuid": "c4904a7e-cffc-4c65-b6de-742c51f5711f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167838, "uuid": "f5ed0479-79f8-4718-a7df-2366c56857f6", "value": "Cotizaci\u00f3n_804200.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0aff07-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691184588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184588, "uuid": "1bec151a-3b39-47c0-bab9-6dc23f9168dd", "comment": "Malware payload", "value": "62ae70d26d5ac24c57e519bf4f2a9aa7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184588, "uuid": "130e4d80-0cd7-4152-8ad5-0638e8c5860b", "comment": "Malware payload", "value": "79f481158cf60cec713c5e56180bbd2223ced74eb7b8828a6ccb4498b63f059e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184588, "uuid": "8adff576-f23a-438e-8f74-9ec27e6e02b9", "comment": "Malware payload", "value": "2720cc0e9c0720afae5ca417fa8f0dd4f082463c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184588, "uuid": "0b6c425c-978c-4e91-a125-b36c922cecaa", "comment": "Malware payload", "value": "71d2db51f568e8aa0c8703b638bac4639c38e8f341468172a32e347d69da2e32048b025e57eaef6bfae18ef0ee47c309", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184588, "uuid": "4b44f224-0fbf-4e3f-850d-b08b0dd90d83", "value": "T130512A3860885DA3DA8E99036D56B65B4533F8FB13D78DF062CE66F5043B96C8D29C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184588, "uuid": "59285def-e936-4135-8386-5255fadaee99", "value": "48:bNaakN5CEzxB5gBq5AMXPlUxWFP7RQNNQcFGBYKQO05SXCpmXCiZdHEdbF:M5CEzqBhMXPlQWFP7R/cwBlgSi7iZ1Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184588, "uuid": "06b9c044-f63f-43f9-917e-4785fd7156c3", "value": 3017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184588, "uuid": "3f56a045-6033-465d-bdf6-0dbb08168667", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184588, "uuid": "df5b1cbf-e722-4cfb-b8e0-e4f762ee7594", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.3034.3461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f723ab-32e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691168737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168737, "uuid": "8eaf736c-8ae4-4d50-89c8-03978df41feb", "comment": "Malware payload (Amadey)", "value": "15d298d96fdacddfca0a0121eb880bf3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168737, "uuid": "b9424acf-e30e-416c-8d9d-63e6cf3b0a4a", "comment": "Malware payload (Amadey)", "value": "7c9976fe71d33717acfd2f90ab4b2012344e812be7473aaa77bfc179bf4f85be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168737, "uuid": "5443674e-b34c-4915-af98-595b4ebc66ee", "comment": "Malware payload (Amadey)", "value": "7a1e72ade30bf8d250a63aa40fff919c7db6818b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691168737, "uuid": "ce19fb49-aedb-4192-9469-d9beba5828b1", "comment": "Malware payload (Amadey)", "value": "f1d6a28f637bcfab55451b85c8d600169fe7261b852f3f8803dcdfe43c4b3871d6f0a272091e90946f7f04c2613a7f09", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168737, "uuid": "f9411af5-e316-4b46-8c05-8a9d9b44f21b", "value": "T18503F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168737, "uuid": "11b57855-4bc0-4259-9edd-777561acb1a9", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691168737, "uuid": "9f334706-b2be-483c-9061-052760428334", "value": 40181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691168737, "uuid": "60e851f5-8f59-438d-a4dc-1ab78c670dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691168737, "uuid": "6c6369ac-9299-42ba-b9dd-9cd2b77552e3", "value": "15d298d96fdacddfca0a0121eb880bf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5459480-32f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691175453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175453, "uuid": "9ec8abf7-df39-4498-8fb6-b77262d043bf", "comment": "Malware payload (AgentTesla)", "value": "fc812d61fe3afd580c377e1bc7676b00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175453, "uuid": "0d28ea54-3ce9-4cd2-acd6-32bb2173fccb", "comment": "Malware payload (AgentTesla)", "value": "7d1224868e02d9cf68c3616a6bece0e92ded63c727e4e844ea6d944712439d57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175453, "uuid": "9a963af2-b92d-4d42-a4fb-bba9b1c4fdd3", "comment": "Malware payload (AgentTesla)", "value": "651ba04ef28b4ea9168cfae5e1349b7641f52d12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175453, "uuid": "946738b5-0843-492c-92bd-1221e0db306b", "comment": "Malware payload (AgentTesla)", "value": "b7a04e823fb57c52e2edb3c63edf7bc52cb742d5d5ad3343006c5dc1c4cd5ef96f90136f09e5fcd84e67eb63883a2003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175453, "uuid": "c7545fd3-4dc2-44f5-a0fb-831b16cf8e23", "value": "T15B458003BAC799A3C14917B7C6DB541043B4DBA37323D60A798B2B6A19037EA4F4D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175453, "uuid": "8da15618-f591-4a2e-887c-e9eab657a29e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175453, "uuid": "cfafe43f-5564-40be-a6f6-c68c4cc31f0d", "value": "24576:NAzO4wlQanNM1P03oPVcLz4bsHXznIfBukNBRyWBNX9yFPEihCHL9V9QD:EJwz4qc9Wc9Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175453, "uuid": "2fda37a6-23ea-41e8-8057-cdcdca6df3a5", "value": 1236480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175453, "uuid": "e6a7aeb4-0f0d-44be-9d31-8fc46fb13758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175453, "uuid": "c0612e7f-0f1a-43bb-bbc4-65bc2012b48c", "value": "fc812d61fe3afd580c377e1bc7676b00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5229ff3-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124423, "uuid": "164f4581-964a-4d1a-a528-7d66e080e1b2", "comment": "Malware payload (Mirai)", "value": "23f972e7cc6801f13667f92694083ba8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124423, "uuid": "1a7e2317-6ff8-41dc-b936-4144934cabf5", "comment": "Malware payload (Mirai)", "value": "7e7123775ea26ae1352774a617ca216eba4c38fb6a24b55cbb8d667e5a320278", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124423, "uuid": "0afd4790-7d28-4f16-aa34-c8a41338bc0f", "comment": "Malware payload (Mirai)", "value": "3f06dd7e1e748ed77256c13cd7790c963ed897fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124423, "uuid": "c3f5e031-13a0-472a-9cdd-597bc694cb96", "comment": "Malware payload (Mirai)", "value": "c8cafe73f024df3dfce6ba0e8a691d012eb644371ece5045ba2137ead4c109ca9e9513440df1350c23737442e602ea99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124423, "uuid": "695bd97c-d213-4778-b52f-0c78be7a857f", "value": "T1D94302E19A8059F2DC1F8C7761086789BB04025CC2527F6A735C40519BC9BD67B6AF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124423, "uuid": "310fcadb-76b3-4cdf-befa-088eaa979ff0", "value": "768:Vd2EGyYVWhO92WTLeMLRxCKo/WTiOQ9OVxasTyq3UI4MttA29cEJxFt59BBss5SY:n2Dya9FaA49aH14Osat5x+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124423, "uuid": "17be7760-478f-434c-9861-4dccc9443abb", "value": 55776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124423, "uuid": "bf4ad577-3710-4ce5-9304-e7607b02268d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124423, "uuid": "9e23b2fa-33a7-43e5-b17e-24cc94799abb", "value": "23f972e7cc6801f13667f92694083ba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56211279-329c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691135753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691135753, "uuid": "86bf04b6-ec37-4c31-a113-983b11b6d25a", "comment": "Malware payload (Loki)", "value": "d34daab77612f1c0ba5f08cd6f2e9093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691135753, "uuid": "13de8347-d995-42b1-a2f8-cb0f98cd822a", "comment": "Malware payload (Loki)", "value": "7ec7fb11ef3642db00f72c811b4c651694b37afeb421742400d509d4dc57a756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691135753, "uuid": "1e7288d2-8616-4e5a-b64e-855c49da1d06", "comment": "Malware payload (Loki)", "value": "0449e18dc35448f84b82a576479f73dff07df3ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691135753, "uuid": "de57e76f-78aa-499d-be17-e47197fc7689", "comment": "Malware payload (Loki)", "value": "5bb86e9ad7298821fa0c6f839914a019fae803c3549f78183180c290a56343d441b95c9f334f33fe7952dbb423d0d015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691135753, "uuid": "3992f1e2-bd5d-43e6-a3d7-116564276192", "value": "T141759D03BA9B86B3E68A137BE19E0C10C761D98B735BD70F754A33A58853B67BC48117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691135753, "uuid": "156a7410-f357-42c0-8cb7-89f94b86d3a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691135753, "uuid": "ba30b757-d232-417b-a28d-a80a4bf39259", "value": "24576:lyFnVEHPzacRa2/7EeiuYKFV74LCxWj56QLZc/X/zQv+uBNC3eCBNUy:lyG570PKzLwj56QLKf/0+iNC3V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691135753, "uuid": "077eacd9-6890-4424-bd21-b200625c70a6", "value": 1560568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691135753, "uuid": "98c0ecde-d730-459a-a58c-5daa92e5f991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691135753, "uuid": "2eea46e8-9dd2-46c7-b358-2cf207dbd242", "value": "7EC7FB11EF3642DB00F72C811B4C651694B37AFEB4217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d6f0db-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124685, "uuid": "8930147d-9abb-4244-a4dd-42214efbe35b", "comment": "Malware payload", "value": "8e8350881381e2b03735e5cc78c2caca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124685, "uuid": "961b66cb-2024-49a6-b553-b2e9670e00d4", "comment": "Malware payload", "value": "7eec8b49cdc920e1b8af6b2197808ee501e37f6c64ef7ace095f078695f1c181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124685, "uuid": "548d8919-bc59-4a89-9be5-69043045dbbc", "comment": "Malware payload", "value": "9867ae2df7cc99e81b5aeb7731d6c669ee29ce3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124685, "uuid": "aeb71101-5356-49c5-928b-f5114cc1f3ba", "comment": "Malware payload", "value": "bd691121c2ae3e1d8642d67532ab4a963b612421af469310aded8091af994c74eef52eb0b582921709f42166f1898b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124685, "uuid": "92b085bf-4b5f-4693-950c-d9937d227c1d", "value": "T10AB412566BD88073D9F12B705CFA03830B76BCD1EDB4162B3765A95B08722C0B93672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124685, "uuid": "ab37a7a3-486a-42ba-bada-fab39ac13ead", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124685, "uuid": "d086e3a6-e9a3-4417-94f0-4df6510f3fb2", "value": "12288:gMrny906CsD8eZiNTmzCwLd/RGiLvsPPF8hP2z9:3yPCsDFzvVm9qi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124685, "uuid": "75913c90-30b5-4624-9ccd-e10dcbd3668c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124685, "uuid": "6cbed67d-c243-4c89-a840-199bd195aaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124685, "uuid": "a2c12c60-1375-4598-bb3c-411ec3390436", "value": "8e8350881381e2b03735e5cc78c2caca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16292620-3274-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691118466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118466, "uuid": "eb177442-f560-4716-8f2a-e29001d14ff7", "comment": "Malware payload (Mirai)", "value": "ddba1f70be2026d9c182017d0a601613", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118466, "uuid": "70112133-7484-40e6-a841-44edd81be654", "comment": "Malware payload (Mirai)", "value": "7f354399934a5bbeaf877d0191076867b3f63fc55f1cbd6c9ddeb373ebeb440d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118466, "uuid": "eb7f2f53-aaa7-4122-971d-c38b737da5fc", "comment": "Malware payload (Mirai)", "value": "263c9c5dd6454245906a0254758bb81c0be3d1e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118466, "uuid": "072e03c9-7a53-4c48-936a-32565b75396b", "comment": "Malware payload (Mirai)", "value": "59c5e05df5700ad337bf08ffd18cca1e4c47369051b71adccd80c4313ee20c457388eab93eb8b9403635ea80cb56e29f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118466, "uuid": "ce335bad-7a9f-4ad7-bf9a-7ed466a35295", "value": "T1EE736CC6A643D8F5FA560171113BFB779A33F13A1029DA83C735E932AD62501EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118466, "uuid": "310b3b14-9594-483b-9386-8c21ded66020", "value": "1536:F8Lji5Zvcr/xW3XUzGhrtx/wHJt+l2YtrnM:F8LjibvsWkzGdH/iH+JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691118466, "uuid": "e7446c4b-d94f-4fa4-be75-46634cf4056c", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691118466, "uuid": "2d916e92-ea0c-4f6f-a9c2-5857a9f33cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118466, "uuid": "3a002587-81c2-4492-84bf-2205440dbaa6", "value": "ddba1f70be2026d9c182017d0a601613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d71b8e-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184985, "uuid": "32d8ae9f-24c7-48fd-a53e-aea221df4fc5", "comment": "Malware payload (RedLineStealer)", "value": "9a64bc05885204d49843468d3ea1ad4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184985, "uuid": "8490f035-a41f-42bb-b25c-aae61114275c", "comment": "Malware payload (RedLineStealer)", "value": "7f3dfa01605c988cb28962e4a792471c7fd012430428e361117e83acff71ebee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184985, "uuid": "fb95bb63-55b8-452c-b6c2-483b7a2cd246", "comment": "Malware payload (RedLineStealer)", "value": "86391bb09822a28191fd502c1a6bee6a13d34116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184985, "uuid": "a46bf186-7570-438e-b170-1fe42c6c42aa", "comment": "Malware payload (RedLineStealer)", "value": "57c888ac52fd99cf18eb84ff51b743ffb6d6980367cb01f34b8077b49c07114a8c71930d9ddcb60a4439243499b4bd43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184985, "uuid": "69d8f795-04f4-4eac-9d12-b67ae3ada00a", "value": "T15FC41217B7D84072D8B71BB01CFA06831737BC61AC79832727459D1E0CB2A89A97676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184985, "uuid": "bc825deb-a201-42f5-beb0-5e10e2afdb9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184985, "uuid": "0f93d49a-ab20-477d-b88d-1f13baea9f17", "value": "12288:TMriy90cN2OnLSlUpGeSb9qA5eH72gBYCCuWBuGXsgf:hyV5LSOpGeSbZ5ebVziMGca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184985, "uuid": "cb42cfcb-66b6-47cc-aabb-dad9dd5f48b6", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184985, "uuid": "42117d83-f814-4172-8987-bb70e8b3d662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184985, "uuid": "66882789-4a0a-4a0c-87a7-4a83b305739c", "value": "7f3dfa01605c988cb28962e4a792471c7fd012430428e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9030b55e-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691130267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130267, "uuid": "56d977bb-c13e-4723-a857-fc4864da9132", "comment": "Malware payload", "value": "f312a5f9cf5a052d3f2fc022bb3f64d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130267, "uuid": "b7e05862-79df-4256-a77b-e9630c41f072", "comment": "Malware payload", "value": "7fa7aefc443c1293d807e079d8a8ce43b0d007550b0eff97945f53a9545a5c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130267, "uuid": "984d8ac9-b471-4657-9580-f3a582a00f5b", "comment": "Malware payload", "value": "ff446493d8500431cabca24e77f91cb01970be89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130267, "uuid": "cf241697-eb9f-456d-8288-12d3e493eb92", "comment": "Malware payload", "value": "aaff4ef8698b58060ae1edfc53e68f9bff6518cc6d9d67cc978e13e5fed054dceb7fcb0c2eb9ea56bf66f32f487faee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130267, "uuid": "cdb861b8-e484-4b6a-a798-1abc044de26d", "value": "T183F41228B36CCD27E57E46F598F4DA5903B268571D2AE1DC9CC629CE30FAF484901B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130267, "uuid": "5248b152-3a4b-46d8-9d1d-ad85cab3f0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130267, "uuid": "9acc270c-0fa3-4d3f-bac7-9091bce91b48", "value": "12288:znjOMxnVhS1r5UwFvcm9tzrS/2kSdEjBbiUvI7eBhKRqftkJ1Y9I2s:zjOMxVhSB5UwF0m9lrSukFjBb/I8hKRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130267, "uuid": "fb79948c-4e44-4727-8a2d-d820a89f0d11", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130267, "uuid": "b9eeff7b-3b0f-4d4b-bede-59e692e8c1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130267, "uuid": "7cf1ddc5-6fb2-4e69-9595-bf39dd276262", "value": "\u767c\u7968\u865f\u78bc 112 \u548c 113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e33d29-32ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691171045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171045, "uuid": "435c2865-aa74-4dd4-8f95-4f429b27d9dc", "comment": "Malware payload", "value": "9225af6907f744e62582f10d2ff6e55a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171045, "uuid": "de705515-e004-47e0-9b9d-d3f4ff518a66", "comment": "Malware payload", "value": "801c2bd3ddf4cc21ea6d95eaf5e9bbba3b9f0ce256e4af670217754dd7473a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171045, "uuid": "04a8421d-7093-464b-bc3d-a375c3b9ffc5", "comment": "Malware payload", "value": "e980cd01dc2ee38bea8de49eabff1ad84d0cf14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171045, "uuid": "2f188ce0-24e9-45aa-9129-f38d55a215ca", "comment": "Malware payload", "value": "1d620c439c8472e285ae92d97e4e65b38c5d5589f37321f92b779100e1f3e1f4fc7d9ebe6f791f46d4ff03a74dc59d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171045, "uuid": "af017084-dce7-45b2-afd9-e9009896e645", "value": "T16EC59E6079944231CCEFE0B646ECB1270D7DD0A00B2647CB9BD676FAC2106D56B37B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171045, "uuid": "7e375984-7253-46a9-a60b-f45059267551", "value": "fbb54f2c5d938313a3b7f029c06d43f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171045, "uuid": "9cbb637f-2eae-400d-8a70-af59b33cdd5f", "value": "24576:ezfDdstXT4e+MnrgWlDg8MnmBea3dyY69i1MWY:e6XT4e+GdrLBeq6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171045, "uuid": "71827301-ef96-4243-9a04-1b9080d090ff", "value": 2627072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171045, "uuid": "2ae287f0-ca84-470c-95c9-7d41f2232cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171045, "uuid": "0ad1e0d3-fa5a-40e8-9b3d-7e49d77bcdfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8027274-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184987, "uuid": "da714112-3755-4801-aa99-ccb9d4ed9d97", "comment": "Malware payload (RedLineStealer)", "value": "dbfac903a31a04ab813a7dbce7b9539b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184987, "uuid": "c39b1640-c338-415a-bf95-d39129349559", "comment": "Malware payload (RedLineStealer)", "value": "80b902977bc06ed435b31363f368d012f5c30b78cb193e2c8ffa9bde27b32f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184987, "uuid": "7b35a21d-6f18-46e0-a442-ecb3de048a03", "comment": "Malware payload (RedLineStealer)", "value": "5fdd151c49c789961df74c17c2275a8d21af407e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184987, "uuid": "22068f44-f2e4-474f-b018-2e13640d5e59", "comment": "Malware payload (RedLineStealer)", "value": "cd8c8e5ff78997d364d4dd02c4504379eafb0ef7f305ad4f4ac1bd8a193e1c343eea65662d9c04e8cedc8c6463a8c7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184987, "uuid": "810cdc89-fa25-4371-9806-db82f82c1a2e", "value": "T129C41253B6E984B3C9B613B018F602830E35BCA19975836F3281AD5E5C727C4B93A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184987, "uuid": "af8ecec8-cb69-4eae-adee-8dcd4a7099db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184987, "uuid": "8fb5fbc2-487a-4d19-b199-482d28d8f1ce", "value": "12288:ZMrgy90vvILEjcaCLxpOqVFIHElFy7jUiw0knN9wQe4TvapW:ZyCvHjhC9JVSElFyPUX02N9wQejs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184987, "uuid": "e7d33b93-b222-4d01-b3b8-6db0767d6586", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184987, "uuid": "2504851e-1bd2-48a1-9307-edcea943efb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184987, "uuid": "7b91e10e-9338-40ea-85dc-9496090db5c0", "value": "dbfac903a31a04ab813a7dbce7b9539b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9db9c3-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124361, "uuid": "6c3ea6b6-aaab-4404-8964-724be746dd99", "comment": "Malware payload", "value": "b7b2f2c4b07eac9fbdc862c8dfb79f79", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124361, "uuid": "e6ed779d-ff48-4d4b-bad8-662def75510d", "comment": "Malware payload", "value": "80e043b08c7f49d8c6d4da4211018a9f3983ede5df0648169ea2745d10770473", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124361, "uuid": "1a15d99c-db69-44f0-89af-e3e267afdb33", "comment": "Malware payload", "value": "f83e53dd6cdf4524d13bb56f9866886a923c10a7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124361, "uuid": "836a62be-41d9-49ef-82f5-4fc7f43aee19", "comment": "Malware payload", "value": "41998003cc59aa62f421057bda5e60542f4ee460acc0ea145f7fe3d69a2b8ecf1441f8a3eed02bf24de9030955db6aa7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124361, "uuid": "97ad6531-b087-497e-95c9-7c2f243a93c1", "value": "T19FD423876D6FB5D0E653487251CCAC30BFB02D9E86960D5207348876490BEFDABE1D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124361, "uuid": "4526691f-7583-4d14-b652-6b14ccb083a6", "value": "12288:BGqE0ABxFRyKVxkT5Wq3JWEMfmFqo7ZfR4mNtHNAKp:BGqRAnFRy425xCWq6TJNtHN3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124361, "uuid": "3af26518-51f5-4bd2-9926-254da9c30b25", "value": 609055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124361, "uuid": "e2dd9082-530f-4139-9428-d10b7437681f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124361, "uuid": "1699588a-2503-4b0a-bfdf-72a1c71f889b", "value": "facturas y datos bancarios.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da5fcb0-3306-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691181373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181373, "uuid": "46eae612-51a5-4707-af32-515caa5f511c", "comment": "Malware payload (RedLineStealer)", "value": "cfa9c0ff594d619c1e0252a70625c278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181373, "uuid": "a6f7e720-92b0-46d5-8343-5b04709a4c74", "comment": "Malware payload (RedLineStealer)", "value": "811a86af540ab7204b0275a8c7a6a5a84f2f58628c14688726cfa7f12763d7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181373, "uuid": "62f82d4b-87cb-4745-a739-ee7ec528abdb", "comment": "Malware payload (RedLineStealer)", "value": "b9e33ea4c7a42d37fdfa3ada35d2b3eaf5f68ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181373, "uuid": "0df049c6-4235-4d56-93cb-d76343d15543", "comment": "Malware payload (RedLineStealer)", "value": "6398bfcedea342f65b55fc293175e27a125421a49020f393d750c28df881c3bc86c32d8e1cdc0c0ca5fb0bd2ec4f1b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181373, "uuid": "a7d6665f-4599-43c9-a854-35687183882e", "value": "T1F6C41202A9E88073D8B527705DF616831F367C72DD7843AF2B45E55B1CB26E0A931B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181373, "uuid": "0b2d8e36-8c47-4495-81eb-fefedd7309cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181373, "uuid": "e4452d89-5f79-44e5-8ed8-228aa56c0f2d", "value": "12288:eMrqy907y5JH/e1T4vJDLclnP4ugBYChDwt4IF0By:wyv5oTiLenP4tzKj0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691181373, "uuid": "00983998-08bf-45b9-a448-317af31fb06c", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691181373, "uuid": "1ed95bc7-baf3-494e-ad53-08b14d8473dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181373, "uuid": "5b756d7f-e78a-4f4e-84c0-ef8ce11a888c", "value": "811a86af540ab7204b0275a8c7a6a5a84f2f58628c146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dde1764-32b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691147282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691147282, "uuid": "2696d49e-c034-4d56-8878-0f74876a4399", "comment": "Malware payload", "value": "d9242e75177504019e7c8a78b0f705f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691147282, "uuid": "783d215b-ff92-4f65-84f7-ab88f86b11ac", "comment": "Malware payload", "value": "815dabae21f7d2d183806a3d98eb2316bd65f25e42b7c0345dd4ddd0a89c4105", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691147282, "uuid": "91be909d-8c17-4eab-ab5f-cca6683336ba", "comment": "Malware payload", "value": "8d94f9bb80f81fcbd7efec85a789461f1cad97dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691147282, "uuid": "73ca27b1-b750-4598-8b89-3b8e5e81ea77", "comment": "Malware payload", "value": "e3913b94dba7c82bf2714237326d2a3a529cc5d01048cc868b231e7190e8b51d9f0dba133d4b93c0baf10bce814d46ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691147282, "uuid": "c48412f5-9d84-4e01-8440-8e9009b92750", "value": "T138942A01B6A1D034F4F716F58EBE61BD583DBE90172484DB63C46AEE4A34AE0AD31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691147282, "uuid": "6459d03e-cc54-4c34-bcea-855565cec898", "value": "3e2286457061b9bdef13936ef3ddc226", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691147282, "uuid": "04d16764-5833-4fdc-9ddd-323afed87f75", "value": "6144:gZXcIXp0TxYDEGsWsdWePmFbI8Xy9gZ1tQAmAdRU1SAOiIgmH:gZX506QdWej8C9g8ORU1SDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691147282, "uuid": "cb4192cb-3702-411b-90c6-4d3e668493f5", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691147282, "uuid": "2850e482-4fae-4714-8c2d-e19df2b872fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691147282, "uuid": "e33f1dfe-1635-4320-b165-40c3608635f5", "value": "d9242e75177504019e7c8a78b0f705f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b53bc4-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124362, "uuid": "fb3d8503-2586-4425-94a4-35ec66bbb026", "comment": "Malware payload", "value": "7bcf4664357c2c884e814ccd6e894018", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124362, "uuid": "137f6541-6e77-4072-944b-8f5d4a3e2306", "comment": "Malware payload", "value": "81ef9d7d493dd6f2706e21851567557974abafd54a5c25292c3d742223c96af0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124362, "uuid": "d8b79908-090c-4cbe-bf73-fefb56d5aecc", "comment": "Malware payload", "value": "09e34a6970af08e364d97c861f0d1b3954eb4280", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124362, "uuid": "81a89557-c919-4795-a557-75b07b3d4f7e", "comment": "Malware payload", "value": "4d36c5fdb2182f822cee14968f0b99f787ccbb6de12fcac969209223a4bdc462fc0a242d2bd9dea721ce68dae37b974d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124362, "uuid": "e6163984-0fc9-4c7e-b27b-0da352415921", "value": "T110F42398599B143CFBE7AF33D3D82E8E15D4C63290A3255AE8E9D1CF3F96449300849B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124362, "uuid": "79409c76-048f-4f33-a022-d31ab954e3a5", "value": "12288:jsaNW99ygcEoV9zXiNl01fCjcPRDwE+PBvlHIqRv+lcoCDhUDI0yBIOVjaRl/EKp:RW7ygcZN1aj8tdeE2ZoCe3yBIOVRY/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124362, "uuid": "5d68143b-d924-4260-a5c8-e543b5415286", "value": 762608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124362, "uuid": "c0337d0e-35ca-4348-93e1-0bd5f968204f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124362, "uuid": "9730d60c-6e3b-4548-ab49-03571760a1e4", "value": "..facturas y datos bancarios.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923d25d9-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184387, "uuid": "6ac26a24-1ead-40bb-9d70-9317d3a64287", "comment": "Malware payload (RedLineStealer)", "value": "0699b6ce113a7b31a1ea2a47552b0cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184387, "uuid": "4ebca848-19ba-46a3-b500-94e3bfb70380", "comment": "Malware payload (RedLineStealer)", "value": "829196b65eea4357c238ad4b6ce8c149e75a1133a0476565f8814446af0677a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184387, "uuid": "6ba44819-da7d-4d39-a156-a5df9f5210c9", "comment": "Malware payload (RedLineStealer)", "value": "8ad8d6f14c8d2501a5886d2b9e7395b28b683052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184387, "uuid": "6efa5333-f606-4211-b11b-e99d99733ebd", "comment": "Malware payload (RedLineStealer)", "value": "7a027b7afde12c308bc3b8944f278ae14ee38b855782d935a709d27b76e428f6fac8501c98803a2e017cfe975bfbe13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184387, "uuid": "98430c54-2af3-4be6-adbf-22f95bf3e4b6", "value": "T1CBC40242EAD89173D8B52B70ACF607931A367CA11D384756238A9D8B0CB36D5A73137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184387, "uuid": "11de77d2-0910-4be6-94eb-6fce6d6572c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184387, "uuid": "ca96d91d-7a92-4875-801b-a2dfd667e0df", "value": "12288:1MrUy90vrRycRX8XKWyctHUdhbwZVwOvKdx3iKX8+8wi0r:dyaFRfLuChbuVweKXzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184387, "uuid": "8881febb-f3a7-4368-acbd-c47c326e0308", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184387, "uuid": "281d9614-b62c-406b-aebf-b9eb4b502594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184387, "uuid": "2ec66f07-7731-45ab-8055-b2d977e8b745", "value": "0699b6ce113a7b31a1ea2a47552b0cc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b869cd9d-32ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691171137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171137, "uuid": "d70711ed-4a4e-4138-8f8a-6c94418fc1be", "comment": "Malware payload (Amadey)", "value": "19ec7e29b46db1ea4c210147e253e3c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171137, "uuid": "67b0f19d-c620-4aa2-b635-69178f17db5f", "comment": "Malware payload (Amadey)", "value": "835ef4434fd8bd276777771b2bd9f46c112cad61dd22b61ea048a31e4038b23e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171137, "uuid": "3a5c3338-372c-4725-991d-5f4c3c998e96", "comment": "Malware payload (Amadey)", "value": "50253577597dec8e25cad248ae6f5ed41800a36c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171137, "uuid": "30bd5f30-f171-4e31-82d6-102c0aba00ce", "comment": "Malware payload (Amadey)", "value": "a272dcebc378014cc309f043e4bbe2c0ce3e0ba6548b98d0d83e3935e5d48bea9da75b8ad96c46a84bd5cafe9a277e79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171137, "uuid": "42ea1cdf-3a26-4c1b-9616-34cd55151917", "value": "T1E703F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171137, "uuid": "9d99ff7c-a2d2-455a-82d4-f293fc6c2011", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171137, "uuid": "667bf72c-2aca-49bb-ab70-710c396f2e3d", "value": 40335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171137, "uuid": "47624a56-b53c-49b3-9d13-476315b9822b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171137, "uuid": "68d1640e-f41b-4704-8b23-885ad7a3d55d", "value": "19ec7e29b46db1ea4c210147e253e3c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71691198-32d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691161569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161569, "uuid": "03fe65dc-63de-483d-a0d5-781f6f09ea86", "comment": "Malware payload (RedLineStealer)", "value": "a9c1f9a2e1ee66bd5f6a949313452d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161569, "uuid": "fff72c44-07e1-483c-8a64-482905b06b60", "comment": "Malware payload (RedLineStealer)", "value": "84ffa17caf0a408fb8bc71a92a868b5aba66b625917a151b99d089142c4b43a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161569, "uuid": "989ea7d3-2567-4552-a608-f7bc9d8e4fac", "comment": "Malware payload (RedLineStealer)", "value": "18e218c19b37e8123318d8fba3c75c67b830d8b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691161569, "uuid": "0e167961-d132-46d9-b1d9-9e641f704148", "comment": "Malware payload (RedLineStealer)", "value": "9b24ae0b0c536ff4212834b1c05b4a3997f202112dc9dbd224e58d6a4729ef4d1fc60de68b78a9a9e3d4cb2c68d30202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161569, "uuid": "cdae848d-f109-4df9-99bc-94974817ff44", "value": "T1D403F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161569, "uuid": "50a02b36-bbd1-4aaf-b1ed-8dfbfe95c28d", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691161569, "uuid": "1e3f3871-d86c-4209-a2e1-c05dbac95c52", "value": 40415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691161569, "uuid": "9651caa3-5746-455a-9987-87c74cf28827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691161569, "uuid": "1646bf89-c209-4cc3-851c-85212b9c9a9a", "value": "a9c1f9a2e1ee66bd5f6a949313452d03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d234dd-330c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691183771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183771, "uuid": "9f1351db-8bc4-40d5-aac8-6b947aa3a985", "comment": "Malware payload (Amadey)", "value": "11a863a47073c7b10c3a181dd74b40c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183771, "uuid": "ac8740b8-788f-4ac9-ae45-4a6db50aa8ba", "comment": "Malware payload (Amadey)", "value": "85174a054702be5cfa696b0aee821151ec50738592f5b445ebf23f27c3232509", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183771, "uuid": "4d774aaa-ea3f-482d-8f85-ea3d0541b4ca", "comment": "Malware payload (Amadey)", "value": "42091183c0b978989f826adc28f3873a6254220e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691183771, "uuid": "43a4d062-b5f5-486a-b1c2-6e7d2301c268", "comment": "Malware payload (Amadey)", "value": "fed6827770908a676576cee0b08ca3baf761f39262f4b2b1148ce03db438dffe58b3c4fc190a1cf456c44b41710cb6f5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183771, "uuid": "5de3d095-77c4-43c2-bd5b-3a3ab4f62083", "value": "T1FBC4125276D99076D9B52BF029F902830F327C96897452AB37866E0F1C737C1B4B172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183771, "uuid": "226f455f-a3a3-4d15-9638-87a7c4cad0a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183771, "uuid": "8989dad7-b5f0-493b-bba8-e0fce08d7f0b", "value": "12288:gMrQy90p+DuOAgdzYzUgSEusp8ypp3LJ:gynDuOANm2xpd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691183771, "uuid": "44311ff7-0234-495c-967e-ed8620421f4c", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691183771, "uuid": "ea80d7bd-d6e3-4147-a657-085e9492b017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691183771, "uuid": "4524bc85-8a2c-41e0-aea7-e7ece05e4642", "value": "85174a054702be5cfa696b0aee821151ec50738592f5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9a5668-32c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691152833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152833, "uuid": "f3dd8381-6e56-49e4-a9c9-e53f9b11fa1f", "comment": "Malware payload (Amadey)", "value": "1a82465ad10ddcf703df39515cbcb5f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152833, "uuid": "5f78da99-5281-4497-832e-6526ea33bd0e", "comment": "Malware payload (Amadey)", "value": "853f28eaf5afe6f034ed567f9fbd59d131464468adb61e147b509adaece02415", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152833, "uuid": "4597ceba-54ed-444c-95f6-9730408b1eb7", "comment": "Malware payload (Amadey)", "value": "3ad5a3206c5cf6d8000f7a606fc4ce255d3db8be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152833, "uuid": "f4df0912-7c9c-42d7-9025-4d17e45fb4cf", "comment": "Malware payload (Amadey)", "value": "854d9ecdcc69506f87a59457f2507cce9e1ec424b98bc1c11fd2cbf15dadf01e22458558d1d8fe831649133223d68935", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152833, "uuid": "49f296d7-6974-4d49-92c9-ad4ffbb73076", "value": "T1AEC41226ABE5C07AE8B42BB038F612D70A357C6399B453571395E91E0DF07C0997273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152833, "uuid": "ceedfef3-8cf5-4346-9bae-e6f4fcbd7748", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152833, "uuid": "6f9097b0-abdb-409f-b303-2796ddb273e7", "value": "12288:IMriy90v9eLCD9Xkgf9DD/Il+v+77WB8HVZ24gFffxzq8:qyAcCD90g9DD/tmyB8L2/fxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691152833, "uuid": "6c715faa-0f31-41cb-8b3b-c5768c9a46b0", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691152833, "uuid": "c8a6daf0-d90e-432a-8e0e-fbe185a29672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152833, "uuid": "79949dc3-d5a1-4231-b9a5-c2f1eb4b4622", "value": "1a82465ad10ddcf703df39515cbcb5f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bde4f8-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124617, "uuid": "bdd74d1c-9619-47fd-a333-958dcc28ea79", "comment": "Malware payload (AgentTesla)", "value": "70fd7b754e592b02fabe68b5e2210a09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124617, "uuid": "fb305f07-aa5f-41bf-86c2-366db1fd7e0d", "comment": "Malware payload (AgentTesla)", "value": "870fc4761da55ad6c3d881026048561e5b9538cf996dfd3661da3e066d2cbdb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124617, "uuid": "e3fb8c9b-5b90-4314-baa8-813a9649a6cf", "comment": "Malware payload (AgentTesla)", "value": "be6125d2c4ede647d49829818829ac3b12e1aeb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124617, "uuid": "a3915946-ebb5-4a58-b7dc-0f0e9ea238de", "comment": "Malware payload (AgentTesla)", "value": "7f2c3638dc440ce9597980e31761c71192f0657a862b5763b987d454cc86a306db1b89b2f40fac6c374163d3badd928b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124617, "uuid": "825d13dc-1850-431f-9776-f050a313b85c", "value": "T14CE423953599BB79F67A43FA94E2E0321BB8BC177411D3099DF552FA227334A0286F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124617, "uuid": "1a4aaae8-bda6-4fd0-8b7d-03bb62c8e70c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124617, "uuid": "3830b199-5caa-4a6f-b865-c6f8c8729b98", "value": "12288:e+1LYQvjOWLc6vUNJQHkhKPeY3ggJ9SkSdmqo/2MmM9LAG0Tt19o:e+1xOKc6v8JQeUemPOnimJG0TfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124617, "uuid": "4bd18a00-8dfb-4284-bfcc-67bb122ebc78", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124617, "uuid": "e767ebca-2f31-4df3-bef7-af5c5d5b04e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124617, "uuid": "ff396a1e-8297-4c22-9f2e-81bd511671ac", "value": "70fd7b754e592b02fabe68b5e2210a09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4874c129-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184693, "uuid": "36615bcd-59a8-468f-8532-422617135ad1", "comment": "Malware payload (RedLineStealer)", "value": "691e62081968d7312417fe6963fb2a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184693, "uuid": "508c68af-cc76-4dd7-a930-a8b20c0e5c1c", "comment": "Malware payload (RedLineStealer)", "value": "879ca270d59a6203bd88bd8118a46bc7deb2f0326984a54d692af0687e635a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184693, "uuid": "b77c4a8a-b0a1-4c06-9a31-c5d42d0a247b", "comment": "Malware payload (RedLineStealer)", "value": "d76f1c5d2bc9ed27f215ea2d34462fe49154c9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184693, "uuid": "f6509981-8dc7-4066-a3b9-aaba7e3560ac", "comment": "Malware payload (RedLineStealer)", "value": "41b8de079cb4ea1d7a260b1cf7f51862f9f1597c87c4d6011fc8e18fc2a98947d84c918bd709966adadd491520e0ea1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184693, "uuid": "9447ee03-3831-402f-98fd-4cb50fefa65d", "value": "T19AC41253BBE95035E9BA17B428F603C30F36BDB19868925E33869A4F1DF31809635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184693, "uuid": "f2110485-44cc-4913-bcc4-a09ef1e4e44b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184693, "uuid": "7df775f5-6b82-4b77-ab5d-745f4db5d92c", "value": "12288:WMr6y90ARzlInM2wdSFSe/FIccdhnwtN7ODL:wylleM2x5EdhnI4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184693, "uuid": "e747c890-31b2-4c81-8013-04f4c502a363", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184693, "uuid": "63c42791-71f3-4d28-99f7-deeaba07e7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184693, "uuid": "ed8648c9-d9c0-4609-94c5-907344fb0d26", "value": "691e62081968d7312417fe6963fb2a82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cba207e-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178365, "uuid": "7a4741ae-fa47-4646-b1bc-7aa95b8f8b09", "comment": "Malware payload (Amadey)", "value": "92fd217a49a34e00a1a8b755ba39bb53", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178365, "uuid": "6aff0a7f-7197-4cc9-8279-c6e28c99e484", "comment": "Malware payload (Amadey)", "value": "87cb8e344e2c2ba7b83c6a5ead4d08c42cd496bb38bfcc7228ac540ee87c652c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178365, "uuid": "3f82b366-9989-4985-9148-4d1311befa61", "comment": "Malware payload (Amadey)", "value": "2320412495947138d653587480f3bea209dd276e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178365, "uuid": "19d941a4-c9cb-481c-9775-1d734ed869a3", "comment": "Malware payload (Amadey)", "value": "8232637a0febb299fb24a5bdccd178f106fa200fe33bae2e38650f32e28540df458cd44f3735076d43d34f3a8426a3c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178365, "uuid": "dfd9f837-502a-4f9b-9742-0b0650460e07", "value": "T159C41243AAE84133D9F647B468F647D31A39BCA09D68836F2744AD5E0C73BC06932767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178365, "uuid": "fac61d69-8e28-44cb-b2d1-b62c1b2e5ef6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178365, "uuid": "f3675acb-0d9f-4730-87c8-a3b14bae39db", "value": "12288:hMrZy90Wd16x0xrS1pK2t/QVetNmbccZUdK4yWVWiM2aOqlyI:wyXiaS1c2toVetmcjy6WbHOqsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178365, "uuid": "a698f8f3-2d3d-4e8e-b7d1-5ac260755223", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178365, "uuid": "29cc87fe-8f4b-40eb-909f-9f7a011bc85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178365, "uuid": "1b983b91-5488-4e3a-8472-c7596d25127f", "value": "92fd217a49a34e00a1a8b755ba39bb53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70a2dc7-330f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691185281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185281, "uuid": "dfa6552a-295a-4a11-a466-a5dc022f752e", "comment": "Malware payload (Amadey)", "value": "33f6991f38f3723ef7bf69aa99c6a239", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185281, "uuid": "e8870cee-925b-40a2-a3a1-7cbb38408128", "comment": "Malware payload (Amadey)", "value": "8823b9a0c71ed9de32bede2f8925f78bdff0c5a16621978a66ede52dc9fa23d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185281, "uuid": "864f7d4c-9135-4c07-b793-46c1155149fa", "comment": "Malware payload (Amadey)", "value": "2fc073e578a98749eafcc9def2c4c2beb1fcf8d0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185281, "uuid": "a49fb68f-fc65-4235-8631-0e25dcf9e4b8", "comment": "Malware payload (Amadey)", "value": "17acb0418ae5deb17638aea29087fb08aff3944a5f2e35b7ba60b812d13f8440bc44ec0c1c6603897816b4eb78cf0905", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185281, "uuid": "b31549e4-d99e-4bab-8f6b-9683f1c4b794", "value": "T11303F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185281, "uuid": "88db28c3-3abc-4715-827e-8b5c07526d5c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691185281, "uuid": "b6f1b876-0ccb-4427-b1b6-4ec4dd4d1603", "value": 40142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691185281, "uuid": "76350cba-fa33-4111-afb6-f8b76a695b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185281, "uuid": "c9673e74-64a4-4be6-86d6-06f1c25cfe03", "value": "33f6991f38f3723ef7bf69aa99c6a239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e5445d-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691149260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149260, "uuid": "ddbdf14c-5a3a-49d3-b529-9598d8d464c4", "comment": "Malware payload (RedLineStealer)", "value": "ca4eebf954ccc5d8aeb5cf3550d867b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149260, "uuid": "e5199b08-dfec-42bd-8b3b-ab8e463e9656", "comment": "Malware payload (RedLineStealer)", "value": "8932b9b1a6716b2c77235f2c0887308f8d691da0f731bb5a0abe5133983270e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149260, "uuid": "ca22d7d1-11ca-42ab-9650-d0d8c522e7e0", "comment": "Malware payload (RedLineStealer)", "value": "5ec55ac2d8445905434fb82aa981f85a909e09fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149260, "uuid": "e6b9d720-5a44-4a5a-9703-cbc6e8d5a886", "comment": "Malware payload (RedLineStealer)", "value": "ac9f6b073114992d283005ddfb1700a5473742535a055dbcbad020764714d78dc8bedacda20c9867bcacabe59ed967bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149260, "uuid": "0b51ac9a-2838-4dde-a006-0ed91c7f5b70", "value": "T1D5C56B6178FD4665CDE2117A41FCBB31476F60A04F2685D706B846FAD7F2ED03A32A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149260, "uuid": "2b617bf3-1630-4912-97ab-95f748f7da81", "value": "fbb54f2c5d938313a3b7f029c06d43f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149260, "uuid": "6e111c61-6b6e-4412-9603-ecb2e41ba967", "value": "24576:SbfDdstXT4e+MXrgWlDg8MnmBLczhddBckaQ/i1RMIXaK:SSXT4e+OdrLBcIXaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149260, "uuid": "033d50d7-d139-4f18-9474-75e49f7aa893", "value": 2627072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149260, "uuid": "97c4a13e-2624-42df-b5f3-30155330dab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149260, "uuid": "921f1525-0d4d-4ad7-a462-8ffabf360363", "value": "ca4eebf954ccc5d8aeb5cf3550d867b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8147222-3283-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691125261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691125261, "uuid": "ef9f2cfe-f726-472f-9781-6389320bf096", "comment": "Malware payload (DCRat)", "value": "d3cecbd0d5d50b39f5a5b7d114ac37f0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691125261, "uuid": "7c724e18-d9bd-4c14-acb7-80785a329edb", "comment": "Malware payload (DCRat)", "value": "899e1b8d4616306c8afbdd7ddb424b7caf2f84f8a1c5b24f04b09d7e16c2a023", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691125261, "uuid": "633fac1f-a41e-4326-a208-34f0dc4da79a", "comment": "Malware payload (DCRat)", "value": "27bc2dab26b8f07ec3ae66fdbcf8938382ef0267", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691125261, "uuid": "814820f6-f615-4969-b2c1-64d39ecd82da", "comment": "Malware payload (DCRat)", "value": "f1a38f0b18337528d636d6b53cd24ee361ca7b7982a78a52104e28c257b4a148fff3c6efce0b02979651e6496ef14a4d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691125261, "uuid": "ca9e83b3-77a3-4e79-819b-25f42368b90e", "value": "T1A04539017E448B12F0191633C2EF494847B4AC512EA6E72B7EB9377E59123937D1CAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691125261, "uuid": "d34b7375-ad10-4578-b419-a27316d6b669", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691125261, "uuid": "1effbe18-b568-411d-afba-fb26f1e70956", "value": "24576:U2G/nvxW3Ww0t78xou8rXqooaNUkuTR3WL2GV:UbA307o86uU3VQ2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691125261, "uuid": "aabf7f40-3376-4d41-ac1c-b5d1c4f63555", "value": 1165985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691125261, "uuid": "25a24b91-2b37-45a9-8434-952e3b9b7526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691125261, "uuid": "fcb59969-dfc1-49bd-a157-76a7804f26aa", "value": "899e1b8d4616306c8afbdd7ddb424b7caf2f84f8a1c5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d8da6c-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124799, "uuid": "ffb1d6e6-439c-46ac-af95-8cb1bb636e0e", "comment": "Malware payload", "value": "edc4d754a7b3cf3e0ee7008ddaa06a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124799, "uuid": "fb215632-3337-44c1-8e09-539a7c5e32fd", "comment": "Malware payload", "value": "8a540e6fcc65443ef8e9f69d5cc16a4c17018b35dd4526396f97209491a7c79c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124799, "uuid": "68bf1a55-3b56-478a-9824-792cdec886cf", "comment": "Malware payload", "value": "2751a7299715db7e8f9d07b51898448110b05dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124799, "uuid": "e9f597da-b48c-4e3f-b383-4bc705d03d73", "comment": "Malware payload", "value": "fa2303deb0d8f1971f8579a8415edbb743360b6074de97c4a1147825f39b38cc84ab4ee0913c6ac9a85ec9374d48096f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124799, "uuid": "5958052c-752a-424d-9ebd-df98b69d8d3e", "value": "T16384F07A6FD0513AD8531B3318B63655A6ADBCAABCA6E13EDB43374F35B070141E1A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124799, "uuid": "906f8c37-12cc-4c73-9060-d36fd256005a", "value": "bf8e93937f9e7494ce0335cf5d059356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124799, "uuid": "360d8f85-007f-4191-bc0f-9a98df058d9f", "value": "6144:/B2YanhhKxxBPy2MAX2nytb6jX1qP1sxLQoi636b8XHPJnExIH3mvWodyNQX:/B2tHKR5jmnytb6z1i1Usoi6uNLeEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124799, "uuid": "a1d4a4dd-3aa0-4289-9483-beca8b148db5", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124799, "uuid": "c190412b-39d7-4713-89ef-060f327472c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124799, "uuid": "99838436-1393-45da-bcf7-0439d3d77075", "value": "edc4d754a7b3cf3e0ee7008ddaa06a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dfbede-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178379, "uuid": "e712044e-0d18-4823-9efa-716f1808d7b0", "comment": "Malware payload (Amadey)", "value": "a2c4da02b8f9eb5758361bc70d23bc76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178379, "uuid": "d62eedfb-cc9a-43c8-8f71-30e2897422aa", "comment": "Malware payload (Amadey)", "value": "8aa2b392372c3ce728fd35a22b4e59f82391aa1f5d2a701d4cd1b4009dd8cc53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178379, "uuid": "5bc9f66c-7266-4bf8-b448-bc2938e51aa9", "comment": "Malware payload (Amadey)", "value": "5013f14b511d0230ec1ea834c1f1600d51f611e7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178379, "uuid": "e4976ca0-d1e9-4c83-a88d-69d5bae19df6", "comment": "Malware payload (Amadey)", "value": "d4516aa6227579702b1c5b63d60ac8a70a598993adb910254482d971628123a4077da1ce854fc57ef66b12117e7d9104", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178379, "uuid": "f55d55f7-c843-462e-96b4-6d68ca8ecf71", "value": "T1DEC41242BBD88073D9B11B7048F613D30A35BDA25C78837F2789A95E1E73694693232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178379, "uuid": "f228236a-d61d-4bbb-a834-4b9235a255a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178379, "uuid": "7887b893-3db3-495a-a1a6-ed28b4c0a038", "value": "12288:3MrGy90I9X5Q0B0KUHaKMKw7yY4gBYC9tQtG2HazuZo:ZyP0KUH7JWyYfzTQMeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178379, "uuid": "bf8c1fef-c1d6-41cc-a054-bbf38ca65e06", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178379, "uuid": "1dc0f37c-9517-4c5f-96f7-57035e63dc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178379, "uuid": "e43c4451-7962-48bf-aabb-faae3d98ef46", "value": "8aa2b392372c3ce728fd35a22b4e59f82391aa1f5d2a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e335171c-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124393, "uuid": "3611c998-603e-4a1e-82e5-7d1095ea63c6", "comment": "Malware payload", "value": "2430ede5871da3f4d58ce56282d4dea5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124393, "uuid": "bbbc0c1e-6f7c-4e98-94ef-f049f0c4ab52", "comment": "Malware payload", "value": "8b19aea82bee7f1e1a41913ba22927895f69b87d3dfbf1221348e0f8cb0b8241", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124393, "uuid": "dc1c21b5-cdf5-4f19-996d-0ee9a490b63a", "comment": "Malware payload", "value": "3bfcf1a272df6134d4e2adc266ccc6735338c35a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124393, "uuid": "0b0799ac-7302-4b43-905b-48310156f503", "comment": "Malware payload", "value": "dbaef09def29a5c5c57c71ba3afd0c1ee47cfcc93febeb6b8456f4d90ff321bd8ec23182cf9fb3b361501b56a2dbaf46", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124393, "uuid": "6692169e-1604-48f1-91d2-a7cdb2096906", "value": "T105435B01B2A5C62BF20B45398DD7CAEB363CFC189E41831F33507B5E2C757A44A65BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124393, "uuid": "eaf48015-71d3-4803-8682-c9d9053b8895", "value": "768:Z/BgUoNJT+8bMU3cl1rI9ymWzp+0g1qNyAMp:bgUo/VMUsbI9Izgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124393, "uuid": "70384bc9-a553-4460-b449-10e195671259", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124393, "uuid": "8244de00-df9f-448f-9418-c0f163a7f48f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124393, "uuid": "927d6de3-ab5c-42c8-aa08-d87ef22ff640", "value": "SecureMessage.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889dc45a-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178358, "uuid": "2ed5ce01-f1f3-4d66-9019-4518dde49b2f", "comment": "Malware payload (Amadey)", "value": "300835206222134571471208e2817b54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178358, "uuid": "9e194e45-0636-4b00-b67a-250a467b1916", "comment": "Malware payload (Amadey)", "value": "8b76817b27cfd3c3f925b1a0a9e3800cbb7e6e9c70ef0924a2e20a0ec7b76a2b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178358, "uuid": "941ad3c6-51bd-4e1d-9c47-b4ff30d64d3e", "comment": "Malware payload (Amadey)", "value": "139a6444422da50f7b710b3881e7abc80bd773f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178358, "uuid": "42bf2db7-9029-46d0-8872-ebe5c0fcfb8a", "comment": "Malware payload (Amadey)", "value": "0b7e060849e69f3363ae126c3c9a9e65d4733ee7e36e787f9fdc860c2d17fab7353e1b2183be549efd1ffbf99036d2cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178358, "uuid": "8efe5a9a-5002-440a-a651-ade818654c8a", "value": "T136C4125663C8C072EDF927B06CF617C30B36BCA1997886AB2749981F0D726D4953237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178358, "uuid": "8dfd0e76-f28b-4100-b646-908101bc3fdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178358, "uuid": "5174590e-90e4-4bf3-981f-5aa7a429c99d", "value": "12288:BMrgy90vb6Qj03ZGoR/sNeRpmfdU3nIo0Ihk:1ys6HpG7e1Xz0Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178358, "uuid": "afc306d9-edaa-462a-946c-31137e58d046", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178358, "uuid": "32fe7ca8-96ef-497d-b516-7e53445b2285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178358, "uuid": "29aef138-162d-41f2-9e84-157a4d142132", "value": "300835206222134571471208e2817b54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90027acc-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184383, "uuid": "237d9e32-d435-4443-b667-a114ebceaba6", "comment": "Malware payload (Amadey)", "value": "28c4ae35d1028e864183d62bce1daff6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184383, "uuid": "7a7d9ed6-af3c-4b56-b42d-7c201d61a783", "comment": "Malware payload (Amadey)", "value": "8c7f1ee94d14daeab0304a0395ed483121e3386bcca8bb034e2bfc52ca1e5ed1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184383, "uuid": "f3dbe2c7-ba7a-4743-bf5e-b7c1fbc267ea", "comment": "Malware payload (Amadey)", "value": "3bf415bfb01d597ad3c53a6475cabcdf8c4033ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184383, "uuid": "e8a13687-c6b0-4d16-88bb-d507089dca3a", "comment": "Malware payload (Amadey)", "value": "eecd7e7a83916d9c22b1d272d24cac1911efcf0874126034c55005b20dee4edfbacc7ac28e50d28c1a53c4199c79d2a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184383, "uuid": "25b942cf-8643-4eec-ac4a-61c2ca0c3b29", "value": "T199C40242EAE98037C9B527B09DF316830F3B7C605964469F335A991B1D729C0E6B1B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184383, "uuid": "08a9d3a5-0ca5-49d0-a661-78489c2e09d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184383, "uuid": "318d0303-266e-4758-90d0-b56ac9c42ba1", "value": "12288:AMrgy90p0AcfS5iqyt4TjnngkXuZYSlSdVl6YwCBLqVeq:QyZVMJTjnn1eBaclCBq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184383, "uuid": "e3bd9e14-09a0-4867-9dd3-1aa3ed9b8e43", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184383, "uuid": "7090788f-5944-4555-b31a-78d0c1b4be28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184383, "uuid": "7e24e128-8ee3-4832-b01f-598e1675b62b", "value": "28c4ae35d1028e864183d62bce1daff6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55969856-32f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173548, "uuid": "27c15660-5e03-4a85-8708-8179a8b91270", "comment": "Malware payload (RedLineStealer)", "value": "fbcb5df43f8f2c0cf20cc0e8bf978fc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173548, "uuid": "af9cc777-fd63-4852-a1a7-2d84a0f41917", "comment": "Malware payload (RedLineStealer)", "value": "8ca2192c5f7073a5fb0473e83f15aff8a2fc04e3e7b6623eaaf2141813781625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173548, "uuid": "6d0127a8-5085-46e1-add1-d992f48172ad", "comment": "Malware payload (RedLineStealer)", "value": "6fb3d4e5d4369ff87908c35ad7b3cba57d179e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173548, "uuid": "e55cdea7-85f0-435a-8537-b16b12f35b1c", "comment": "Malware payload (RedLineStealer)", "value": "287c1b4ee1fda95cbe342425f9ccd474e861c03e456eb82ae0172c01b5d6f12de4df545c90ba1a12bbcb81786b04f317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173548, "uuid": "9cc7d770-6452-4274-8277-52f436d143cf", "value": "T19BC41213A7E85173D9F2277068FA12430F327DA18D38975E134AAA4E5CB26C0B93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173548, "uuid": "bf5ec2da-175e-4b00-aa57-03ebe551bdbe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173548, "uuid": "0890bcdd-7c80-4d1f-96ca-0f26667c2069", "value": "12288:oMrYy90SzXA1H8+imBSBzMWspBhmPgBYC+ObdQ9mzom9:wy/7c8ASBzM5Bhmozvdsm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173548, "uuid": "744cb7d3-3a15-47ac-ba39-0fd3729b76f0", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173548, "uuid": "338c8367-4f73-4143-9a90-fb8fc2e55475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173548, "uuid": "3aaa7749-f996-417b-8961-4b074441428f", "value": "8ca2192c5f7073a5fb0473e83f15aff8a2fc04e3e7b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d609b412-325e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691109339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691109339, "uuid": "ae3dac7e-5973-4fd7-945c-fce871aadec3", "comment": "Malware payload (RedLineStealer)", "value": "80e9e27f5b773edbc704774deddd065f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691109339, "uuid": "362a734a-b182-45bc-9d96-8d53a2560e3e", "comment": "Malware payload (RedLineStealer)", "value": "8d5e3b7dd0b64a8d6b61a21f7b168abf2fad40bbd3557db47c05499ab34155db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691109339, "uuid": "dcf278c3-4204-4f77-b2a0-506c4f32b9d2", "comment": "Malware payload (RedLineStealer)", "value": "c3934774e987748717b44f126b5cb8898f727e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691109339, "uuid": "0eafab8f-a998-4d6c-9e83-07491ce24dae", "comment": "Malware payload (RedLineStealer)", "value": "050a4186d96a67ef4fe9ccd53cb2e79c0638a5c83ca26255a6f3d3c1f23500ea4eb18a5569d1a5468556e9549e51ba77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691109339, "uuid": "20881d61-d733-462d-b088-573c1cdab5ee", "value": "T15BC41292A6E85073D9B217B40CFB03D31A35BD908974D32B37A5991E0CB26C9B53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691109339, "uuid": "dd3e375a-b358-4ae6-981c-e3b5ac362812", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691109339, "uuid": "87e6892c-00ce-4111-af25-31f5a1697c80", "value": "12288:vMr6y90so3F4GYSFuslEHCXc+G6mS9YqLTCTmsEaBR:ByPJP6nYIT/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691109339, "uuid": "2bb434db-2cf8-416b-a922-9f6495cf53cc", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691109339, "uuid": "57b13e83-2e14-48a4-a888-4fe563444990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691109339, "uuid": "752f9285-8f8d-4549-8c17-561dff614742", "value": "80e9e27f5b773edbc704774deddd065f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b06b90-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691130189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130189, "uuid": "153390d6-5717-4235-bf8a-9787536980fc", "comment": "Malware payload (Formbook)", "value": "93ac4ae768e8bd69fa5e6e79fe1bb86c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130189, "uuid": "8e7741d4-4772-45da-8a43-74ad0ae86b31", "comment": "Malware payload (Formbook)", "value": "8d9ed6e86b3dd8272711c008c10d4b62f094bf98b84b87b2d18e0c5960d03a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130189, "uuid": "5d8ba2b5-43a7-47d5-8328-7c2489a96643", "comment": "Malware payload (Formbook)", "value": "8808d3d4d90f4653383dd683e7a139c301c8caad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130189, "uuid": "0fa26f46-8733-440f-8335-2b066488da87", "comment": "Malware payload (Formbook)", "value": "c6b45d2e2f46e9f3c4261794bd5b424d170b1da8caa27ad43420b9841f6feb8af62648485e9c4cceb332e27f9fc8ebce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130189, "uuid": "c1b28264-bc99-4d7f-801b-61e699cf83ae", "value": "T1F25401816B758AB3C492897086B5C8066DB19D321A2191936794BF7EFCF61E1CE4F333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130189, "uuid": "0fd49cfe-7d49-4231-b713-a215b06b3a11", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130189, "uuid": "c146fabf-efb3-4e4e-88c1-971606b2ecab", "value": "3072:2fY/TU9fE9PEtu1bv1fF8KmIBAMleFVmFjm4EarsWgCdSYfyL6kBMiY84jlL2QnA:gYa6DvkWP4FBeVEJBU15TGlgKPb4V5iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130189, "uuid": "51733484-70f7-4a32-ae38-af89a51e5cdc", "value": 288827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130189, "uuid": "334cd2fd-fa37-449e-a314-374073dba30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130189, "uuid": "e0bcb33a-1e0c-4687-aa33-17e2eaf1aba1", "value": "Address confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2ec404-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178361, "uuid": "5d303330-3e08-4fa8-8e67-4a1b634a5351", "comment": "Malware payload (RedLineStealer)", "value": "f1a417b37f1988011583c92f20b371a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178361, "uuid": "da084562-5a5d-4153-ae05-8d3aa61a9a49", "comment": "Malware payload (RedLineStealer)", "value": "8df9e14405d1d9feb53d79764a5f6f4cde76313a0e511f0531b09041155e9dd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178361, "uuid": "ab3f2dc5-4c97-4fd2-ac08-c376c797374a", "comment": "Malware payload (RedLineStealer)", "value": "76ddb9857bde715852a0b4efb2e56c0681ca96fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178361, "uuid": "f2bfd243-a67e-404a-b6c6-b523c0cbe949", "comment": "Malware payload (RedLineStealer)", "value": "0b36bb6176e76039414acbef5fe53646f7023ab827e8e8d5f9c11f09531ba44ba4004bd0d145083ad1903c31d096983b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178361, "uuid": "e9543aa9-b43f-484e-9d9f-42a5ae28a00d", "value": "T166C412027BE99133E8B117B028F602D32F39BD539938536B2786955E1DB33C4A57632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178361, "uuid": "ce5bb42f-9588-4ba8-ade8-0354a1fc67ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178361, "uuid": "4a94ad8a-3bee-4702-9a89-08eb5c6b4fb4", "value": "12288:aMrGy90+wBOB20fW9cI0cSHmVM7gBYCtrf4e7rOQKnGuK4J:AyzwBOQcI0tHmnz59OQKnpK4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178361, "uuid": "b93d4a2c-1737-4e02-bd4d-9b75278a1e74", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178361, "uuid": "bcb6e4b0-710c-4c05-8129-1e821d3c4af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178361, "uuid": "cd8b70cc-8860-4ca2-b0bd-ae581b8afd63", "value": "8df9e14405d1d9feb53d79764a5f6f4cde76313a0e511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902eb2a2-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178371, "uuid": "a425b274-7225-4d5d-8db9-de3b0cc84365", "comment": "Malware payload (RedLineStealer)", "value": "621bf3f1f9088f029367d2e439719d94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178371, "uuid": "6ce4bcf1-b604-4e88-a25b-dd064fb39b4d", "comment": "Malware payload (RedLineStealer)", "value": "8e9c9b84bb2acaf2ad8aed8e754fccabbbb203ac99019f522dd59a0f9e5d0a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178371, "uuid": "8e816bf1-cc9e-4f44-961d-d89f847bdca3", "comment": "Malware payload (RedLineStealer)", "value": "455e57778215c9370bc9465ece5ec498e6117b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178371, "uuid": "ebfc901e-1989-44c8-8ba3-72bc9d64225e", "comment": "Malware payload (RedLineStealer)", "value": "7f7ebd58a121a81bde73c1fb2d3ce446f1f47ef8bdab5c9e3807a0503b046dde081dc349f93c92489bbe8f79ca3063e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178371, "uuid": "f7fdcf10-aa18-425b-aaa7-0d94491e3471", "value": "T1F2C41242FFD88072E8751B7068FB13970E3A7CA59E79426B3785681E0CB2285D531B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178371, "uuid": "4783b8f8-7e3b-4b38-9bf6-7e5ed5bdcffb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178371, "uuid": "97544694-b936-4ce8-867c-f4c2544ca9a4", "value": "12288:/Mrey90RX2CHhlcAK2/lTz3e0Vo7n+qEVRSq4EbjR:hymHh61eS+V9rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178371, "uuid": "71acff4f-64d3-4cef-9824-eff51c9375f2", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178371, "uuid": "65c0357f-3a5d-4d95-a118-142c32c4e55c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178371, "uuid": "f5886c70-84a6-4bc0-bdce-fd54440ced2f", "value": "8e9c9b84bb2acaf2ad8aed8e754fccabbbb203ac99019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99053376-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124698, "uuid": "9fb04c8e-ed8a-4338-8258-624d491cce3d", "comment": "Malware payload", "value": "8b1b81f2088427366a46d76392044aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124698, "uuid": "a1056b94-3f93-47f8-9fbd-d9236e28af86", "comment": "Malware payload", "value": "8f5a454bd4b668404501cfc61cd1497ffbdd8decc69d2d043e0b58bcf038a397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124698, "uuid": "755a40e1-fe5d-4083-896d-56aaf4dfb9b5", "comment": "Malware payload", "value": "116c404ba0cd52c001b8b48e18e58d9ed3a9916b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124698, "uuid": "42e0384e-df58-46ca-abb3-aebbb4f2c81a", "comment": "Malware payload", "value": "970a5de53f5e77ec41a03b597c0633c7485617fb58a87180cb9d6103c70836c3763e964c6bfd315f32b59c8760e1fcbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124698, "uuid": "5091d0d0-f864-43cf-8c1d-215734024dd7", "value": "T19EF41224B26DCD2BF97D86F994F5E15843B2344B1D2AE2DC5CC135CE22F9F485902A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124698, "uuid": "c4eb78d1-caad-4548-bdd3-b0ff776e5d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124698, "uuid": "29322244-522c-47cc-9d72-33a1f1a2d8f0", "value": "12288:QnjOMxnVhS1rGSeJzD/Pr5MKb8dvXqR2+TW8A9fXr2WwD93iyZZ4xeUaPFzpSM7R:QjOMxVhSBG7Jzzr5MV5a/vqvru9j4YP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124698, "uuid": "771ea5bc-b380-4c06-9e95-e6ba010484a9", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124698, "uuid": "51851ad0-7d32-4067-a9cb-0e161275df88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124698, "uuid": "57b7ab36-4328-43da-a575-fc93a893fc4e", "value": "8b1b81f2088427366a46d76392044aa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5323412f-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130165, "uuid": "1e869dde-7a29-4c76-a75b-5820a7077297", "comment": "Malware payload (AgentTesla)", "value": "b670eea5fbc2a47dfbf3a6b70139d0ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130165, "uuid": "f794f869-a6e5-42ae-812b-728b3ef3f5f2", "comment": "Malware payload (AgentTesla)", "value": "901fc5bbd2f601b31d3588d300b00788c329a3a4506c0f7aa1e779cbc6fbe54e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130165, "uuid": "af4971b2-40d7-4b9f-8801-4fb1b29be19d", "comment": "Malware payload (AgentTesla)", "value": "b806c4234377940fe2440f26b0bb302f65d249b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130165, "uuid": "39d2074d-1a57-4e2d-a4bd-388e290c5f86", "comment": "Malware payload (AgentTesla)", "value": "8814781fff90b1a1a854da01d10f1f777040a923a48249832b2d6590e623245ebd7fc15bd4ccf7fbc5e1c5353421d44b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130165, "uuid": "93f583c8-67af-4fc6-a02e-c24a3615ef5d", "value": "T12685AD607AB0A533D1C9D7B590E2191043A7DC52A3D9EBEB358472993A3237C8F13E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130165, "uuid": "57691196-a09d-4f0d-accc-877b311d9990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130165, "uuid": "a84e05af-07de-415d-9677-5367b0da6d87", "value": "12288:fauTNz1Ef16eLIOJYBdxcfD91ycD3VOYdjG/s9ochuXHb57ezm8QvnYd8cYfVyOH:inf8sWdxcB1DF9dqJci75senYUoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130165, "uuid": "b5d9dcc9-a1fb-406b-8214-dfa2184cb9f2", "value": 1714176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130165, "uuid": "bbeb1dff-0307-422b-b60f-d846a3be368c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130165, "uuid": "f81600c0-6a48-4e9f-bc97-957679b8e6e5", "value": "CICU3023853\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b7eebd-331a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691190025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190025, "uuid": "8528ce82-d0d5-432a-94b6-5cd024e98b03", "comment": "Malware payload", "value": "72878595b1bcabbe5086376e35458d91", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190025, "uuid": "6c69a9c4-1586-4a94-a031-d0c472d4b23a", "comment": "Malware payload", "value": "909d6fe1cde6264e01cb5245efc4088fe5e8d39d1e8289fcdc7485e9468ad424", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190025, "uuid": "11578b82-e1df-451d-9af7-17dedb454d5b", "comment": "Malware payload", "value": "6d9f832995e4009633d07e318369a06dcf060af7", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190025, "uuid": "f22274c5-439c-4fff-a0f0-199c51733614", "comment": "Malware payload", "value": "e43a369c6182d30547bf4058c5cedfa632361b5d0fc4b2cc1e9d620cd18921855a7b2c50349242423a327a9e198ae693", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190025, "uuid": "3fab8eb6-7d97-489b-97c8-1d927a87a531", "value": "T107364C31E544C872E1960075DC7DAAED451A2DB00F1881DF7A8EB96D2FF23C122F9A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190025, "uuid": "30433af0-24e2-48ad-b09d-b3d19722fd66", "value": "98304:vEVFW3s2v3CC/TXNo0cpKwstTJIkS43m1D+:MY3xZox8tQe3m1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691190025, "uuid": "07ac03f6-8912-4a5d-bc38-47df3e09c869", "value": 5343382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691190025, "uuid": "ce139c5a-5678-46f4-916f-c29499b0ad3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190025, "uuid": "66032091-f03c-4866-a901-53300a7204e3", "value": "housealba.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43620ec9-32ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691170081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170081, "uuid": "74aa4e9a-165d-4866-86af-18adfd4e1c06", "comment": "Malware payload", "value": "bb6b51e51db2117bc7ca63388b3e72cb", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "autoscript", "colour": "#85ED4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "qqe", "colour": "#072C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170081, "uuid": "f5afd938-f159-46c4-bfc4-a6e24fcde29d", "comment": "Malware payload", "value": "90af07804c8c53bfa06399d7d0e4e4bd4eff286dbeaf4d97ec451faaad74bf7f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "autoscript", "colour": "#85ED4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "qqe", "colour": "#072C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170081, "uuid": "a9d4ce43-12b5-4cdd-b11e-edc2930ca568", "comment": "Malware payload", "value": "5cd41aaa6027dd2ffc05e8f7b0d01be69399227d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "autoscript", "colour": "#85ED4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "qqe", "colour": "#072C2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170081, "uuid": "2691df5d-3cff-45d7-a0f8-3a154c62344d", "comment": "Malware payload", "value": "8749b6bb4bdd279304a98804c9cebf1999356ab5d334d69264b4a36166135b61a32d95dd7504da35a4856cdf840828f1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "autoscript", "colour": "#85ED4A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "qqe", "colour": "#072C2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170081, "uuid": "d119bfe0-3fb7-48a7-a89a-a229e5d19c7e", "value": "T12B173391398B42F5EADE52380F2B7BC726F2476641744429FEC01ECBB4A9F706176983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170081, "uuid": "6850109f-d927-420b-9fe7-4e5c5136f2e2", "value": "ed0bd6bd9af49c37835528f98a0449e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170081, "uuid": "00fe7a52-35d6-46df-9115-37d2cd1d33b6", "value": "393216:OIe6D7iru8woGLFmN8PyK1JH7WPGNuTF/:OIe6D7GBwrKOHQu0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691170081, "uuid": "6edc87f2-80b2-4651-abde-ac71e59c129a", "value": 18974720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691170081, "uuid": "1bdd9c0c-8862-4091-8941-86a6d2dae2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170081, "uuid": "2a93fd74-4a83-43d1-9485-d89f27b2ed6b", "value": "RYNLXOYUDP.qqE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e27b77f-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691124117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124117, "uuid": "a98f2fc5-7180-444f-9347-09ba48a83547", "comment": "Malware payload (SnakeKeylogger)", "value": "9f0377d0a3c6e3fd416b0f43eeff149f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124117, "uuid": "92921bd6-0fba-48cd-a8fe-2ac05bac96c6", "comment": "Malware payload (SnakeKeylogger)", "value": "916acca260cdbdacc5327366a7b087a73241fef37d734a97749baf5c526ea059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124117, "uuid": "9b8a365e-3710-41cf-8dbf-1a1e789d8d81", "comment": "Malware payload (SnakeKeylogger)", "value": "059f5eb2a8c6def6080da84da4876b3b7f43ff13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124117, "uuid": "cdd0c354-5bc1-4e1b-bdf7-adda9a6093c2", "comment": "Malware payload (SnakeKeylogger)", "value": "d241c9758c16594b7088ca4b7fae882ba26b49160511958bee01db8f68d41b85fc1babfa5c6aaf2af38540896ec9faa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124117, "uuid": "17901751-b77b-4dbf-8ce7-d7fe2c255e64", "value": "T143C412487298EF37FC3DCBFE18D2E13147B8A925A012D3845CE662F65B61B46058AF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124117, "uuid": "b0fbed00-063c-4746-aee8-7e9d9ee31d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124117, "uuid": "558f658e-012e-4cfe-aea4-e1e4696ceb2f", "value": "12288:B+1xYQvjO9KEw6bgsGbqChoI/kn1s7P1k73ywqEg8/F3x:B+1fOEEdD/Ch58n1/CCg8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124117, "uuid": "865bdda4-18cf-4563-8f3a-16d46279d314", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124117, "uuid": "2e52b7f5-c192-4ea0-bfa8-a5346d3f826e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124117, "uuid": "908f069d-0056-4a40-b37f-49d37ffb1049", "value": "TKSC2310596000_ORDER LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac17942-32c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691155303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155303, "uuid": "b5233176-6e7d-491a-bdb1-a2eea59ebede", "comment": "Malware payload (Amadey)", "value": "2fc0744fde6727bbec9ce7433ddf04f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155303, "uuid": "a97228a4-6427-49c4-9a2f-2ac2b6419942", "comment": "Malware payload (Amadey)", "value": "916eb363063d0cc45a39e3560c08d4fa757c9673609a109a927dd4739cadedd8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155303, "uuid": "75be28da-d64b-486c-9a6c-25f2b31e3804", "comment": "Malware payload (Amadey)", "value": "f2a38eb1d77b2ea8faec08af01d0e54cab49d9f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155303, "uuid": "ba777dcb-8097-4502-b99b-4e8a1e4018b0", "comment": "Malware payload (Amadey)", "value": "27dd4c3155cd1f622d313c8e49c1ac7239d734d64b3c76f208e35e9ad772436a2f3a4d6badd95c384dacdf158c05cdaa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155303, "uuid": "caf5e0ab-a859-46a9-976d-bf617e6d940a", "value": "T18F34D012A7E88472E8B51BB058FA13C30B3ABCA19D74836B3755594E0CB36D0E97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155303, "uuid": "e51c57ff-497f-4632-b520-8a9be79a3eab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155303, "uuid": "ab93f85a-bdbd-4665-b097-ac780092a64e", "value": "3072:KAy+bnr+O1l5GWp1icKAArDZz4N9GhbkrNEk1K6D5dMOt7WQqmuXIsjyoc:KAy+bnr+ip0yN90QEzzDQqmSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155303, "uuid": "3d556d39-4182-492f-a1ca-77e9fb073494", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155303, "uuid": "fc555724-df95-4e21-9b36-a54f021f5dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155303, "uuid": "c5497106-f301-4270-ba2b-13ad1a074e0c", "value": "916eb363063d0cc45a39e3560c08d4fa757c9673609a109a927dd4739cadedd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d058cdd-32f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691175654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175654, "uuid": "4395799f-26b8-4049-9bf9-583475bd03cf", "comment": "Malware payload (Amadey)", "value": "c90590d4fd83486527e4f9785c416cb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175654, "uuid": "8f5072ff-1579-4a10-8efa-dd508a8b5a98", "comment": "Malware payload (Amadey)", "value": "92a4d829c3820330fa994078e55381384f83ca41371e9c9e44d3256402d076c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175654, "uuid": "059ff208-c514-470a-9343-0075bd731d92", "comment": "Malware payload (Amadey)", "value": "26fae2d85a9e4f9fdb8f86ef77dd91c9063b8ed6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175654, "uuid": "45218291-572f-4887-a55b-0e9534d4a45c", "comment": "Malware payload (Amadey)", "value": "7c12bc5335644ccdbaedb9c0ed3cf99e04802697aca063ae19f479af0bc2aea7482bf77ed562bc273cfef9abd1d57631", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175654, "uuid": "58649e71-9617-4d49-9f67-3b44263937d5", "value": "T159C41202BBD98532D9F1277158F603830F327DA188B4572B278B9E0A5CB36D4A53677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175654, "uuid": "2ed00cee-2720-443b-ba57-19536c1aa3b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175654, "uuid": "6555796a-2aae-4090-b522-0338c66a138f", "value": "12288:cMrry905gkqN39oUNXDtFMt8QzRuWsAFdlyW18KqX:nyEgVtHDtFX9WhRblqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175654, "uuid": "d9ed6fe8-972e-495c-9200-8846a743a951", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175654, "uuid": "94884b07-86a4-4770-b993-d39384ea519b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175654, "uuid": "841e3aac-209f-4cd1-ae8e-c3ae5f4e3191", "value": "92a4d829c3820330fa994078e55381384f83ca41371e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448787b4-32b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691144743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691144743, "uuid": "1edd3e89-ed1d-4cf1-84c5-36d24c60c702", "comment": "Malware payload (RedLineStealer)", "value": "9360df545f832e3f36d4ca607877e6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691144743, "uuid": "9fd4feb8-b55d-4242-ba5f-409abb04811a", "comment": "Malware payload (RedLineStealer)", "value": "9370d4b16d82d4ccc57901c943cf7b46e1c2c10334512d5327db387503abc6e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691144743, "uuid": "88245f1f-1705-46bd-9102-e1375f302ab0", "comment": "Malware payload (RedLineStealer)", "value": "188a64d6a7005324caeee326f3bf07ac696ce4e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691144743, "uuid": "72a6acfc-fbbf-4989-9bea-c7cd34d7e080", "comment": "Malware payload (RedLineStealer)", "value": "5891cb81daaa5b632332c7928d9b075cfe4254d6955773a81a08c5251d4e56c30f627811d0c7f0c409040afe2a1d8adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691144743, "uuid": "365cf041-0ab5-440a-a9f6-82267e49c778", "value": "T1FEC41222A6D98073D9B52BB018FA02D30B35BDE14979824F3250986F1D72AE4D97377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691144743, "uuid": "18c17981-024f-40cc-ab0f-9b2fa83d3085", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691144743, "uuid": "ebd4ab09-afee-4465-8ca9-58ca739626b8", "value": "12288:lMrSy90ZwWlB9jMi6DCpTkUNNzUZtAy88CirxMtelM5Ub:XyywWlB16Db8EtAyNCjg08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691144743, "uuid": "0f19f635-e457-4034-831b-48d2e6a380f6", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691144743, "uuid": "cd58ba9a-da9f-4fe5-8202-bc3ab9c88975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691144743, "uuid": "40e84fe4-4ac4-4ff8-b263-dbecd4ee6fff", "value": "9360df545f832e3f36d4ca607877e6fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff20371-3303-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691180169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180169, "uuid": "2fd2a80c-1c61-40e4-8f0f-f3fdc47bfe7a", "comment": "Malware payload (Amadey)", "value": "cd9c0667ea45a71dac1a44f5895d4792", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180169, "uuid": "a6ff21c7-2d18-4ce2-88f1-b2a1d6edf89c", "comment": "Malware payload (Amadey)", "value": "93f94a53ba4123685d77f22e5298ec8a0c36375933f6bd84ef7227dd3224644c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180169, "uuid": "03e4a15c-aa8c-4497-9b70-30c30ee2a10c", "comment": "Malware payload (Amadey)", "value": "b30ecbe4d9902ee545678c05d14acf5c5ca24d14", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180169, "uuid": "edda72ee-0be1-45b4-86b5-94a24454c418", "comment": "Malware payload (Amadey)", "value": "51ee178e9c5a774640bf677b888d28d95f783b76615d42ad98ada1df66cfa5b64ae47e371a9bc097df0fc1d63ac592d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180169, "uuid": "6b8d1270-d5da-4aa8-873e-4412412fe9af", "value": "T16AC41213FBE44572E179277048F203C30F36BCA69D79867726456D6A0C73686AA3633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180169, "uuid": "3b26a86d-e11e-490c-81f5-5f6324261a0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180169, "uuid": "473b782a-acf7-4d82-9b4f-5fda150699b8", "value": "12288:9Mrly90hHpCFvV8dwOJnTxm/z77sNhQQY2O:wyOQZXDvchGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691180169, "uuid": "d9970745-f6cd-4d57-be7c-2aa1770c0171", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691180169, "uuid": "a07c9fa9-c98d-4813-99b6-9e3ca9f89a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180169, "uuid": "76a436e2-de96-42b8-8ec9-72a183f6d6ad", "value": "93f94a53ba4123685d77f22e5298ec8a0c36375933f6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5584264b-32fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691176554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176554, "uuid": "07c68583-d569-409c-b7af-8cd396ca2ba0", "comment": "Malware payload (RedLineStealer)", "value": "2b31da16ed34b9cfcf8e6d206355f7ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176554, "uuid": "02c760b1-6228-470c-bd20-b77269642f18", "comment": "Malware payload (RedLineStealer)", "value": "96e27b4a5af84d15dea0eac4a48028bb527caeeb3256b51a6de00943e46e035f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176554, "uuid": "17c3581a-af67-46e4-89ec-e8c67c2b911f", "comment": "Malware payload (RedLineStealer)", "value": "801e35af4b99118037d8bb0bd8090fa1be1328ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691176554, "uuid": "5cae6bf4-0913-4cf4-a370-cb0f5b09d7de", "comment": "Malware payload (RedLineStealer)", "value": "1f2b05402a7c7d7a65d3fd77d859b06ab373cb1c6ea2c76845aed45a39e095d09a172b7301cf2a9c3f2851bcfb36e28d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176554, "uuid": "b8a877ff-ebe9-465e-bf79-2d389cc745df", "value": "T17A740113AAE88032EDB527B458F707C30B3BBD951978836F2346595E4D73AD4A47232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176554, "uuid": "5a1ce304-29c7-45e9-929a-508a6c972b9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176554, "uuid": "c0b71280-44a9-4962-85c7-01fba7afec7a", "value": "6144:K2y+bnr+Cp0yN90QE2rbeLKokW3PZNut0j5q2FIF6Mwy79T/HX0xM0pH44:KMrqy90aeOCw2FIFqyFHExM0pH44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691176554, "uuid": "a6221032-0c8b-435d-b4b3-bceb7d509e07", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691176554, "uuid": "07e1b5b0-7844-42a5-93d3-c34a536e74bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691176554, "uuid": "c5021d9b-9c34-4d26-acbf-c8e84c6f22de", "value": "2b31da16ed34b9cfcf8e6d206355f7ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66eaec0-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173254, "uuid": "29d04611-804a-4e61-a28c-4c9230399a9c", "comment": "Malware payload (Amadey)", "value": "2a686d5e3bf552d9031b0f8f11127e89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173254, "uuid": "3c258d0c-68a2-4d19-8ef8-6a339e92bbf8", "comment": "Malware payload (Amadey)", "value": "972b2a75524452754016a67b7b141424caea400f2cd0654a8e92074eb85db4ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173254, "uuid": "0cea8344-1021-4ab9-817c-90300a5ecfc8", "comment": "Malware payload (Amadey)", "value": "705dbbdfb82685bcd8dce97aff7bfbb4b3296b46", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173254, "uuid": "048e45e7-1dae-4158-92b7-1589f14a37ae", "comment": "Malware payload (Amadey)", "value": "33efafeb867239b490bb9ac51076b882a12084ee73075b9034fcc0bf555859b5a8a4beb90240e570fc69558fa125a56e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173254, "uuid": "fa33f412-6043-4071-b59e-fb11ba387d0e", "value": "T183C41202AAD88037DDF9237198F717930A31FCA66D78536B2286C91B1C727C1A57276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173254, "uuid": "c2608a90-257a-40ff-9ab6-d2f3d28c1634", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173254, "uuid": "ec99083b-4ee0-402c-97e8-2543eedb822b", "value": "12288:WMr9y90+4/KEHyP7/G3KF3sRdkYgBYCDhswF7QoZnpxz:3y5rzERq/zuWVxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173254, "uuid": "cbfd347b-2727-4906-bf13-0d4b9a2b26e1", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173254, "uuid": "a6cb7e72-43e5-4aaa-9086-1de47367d71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173254, "uuid": "11483d9a-3ab9-47a5-b5eb-fd60ef129324", "value": "2a686d5e3bf552d9031b0f8f11127e89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4cfc79-32d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691160377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160377, "uuid": "9dea5b2a-3bcc-461c-b601-64c964926b2e", "comment": "Malware payload (RedLineStealer)", "value": "dfa2a6abb11a926ce56d07f6bf54a37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160377, "uuid": "b30f5737-30cd-45a1-85a2-e2e7070e1b63", "comment": "Malware payload (RedLineStealer)", "value": "977ae9561372df93ecb49d6fe447ae9184d0f34a03e420eed0dc965362fe7756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160377, "uuid": "8a0b7fcb-a6c2-4965-915c-0a24b45cab7a", "comment": "Malware payload (RedLineStealer)", "value": "d68f2df2ead181b6db3e7d28da3b87b752765f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160377, "uuid": "4ec35507-e39e-48c9-a690-44cc79a935b0", "comment": "Malware payload (RedLineStealer)", "value": "36596d4b24d2c66e23ee8bc903243122397f57bcc9cc7fbe86aa674fac5fb6b1f82eb6fa4792099f44ccc0c97cbac723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160377, "uuid": "b124de17-8e61-460a-8bb1-cd97120afc1d", "value": "T1E6C41203B7D540B1D8B257B005F616930B3B7DA599B8872A2B45FA5B4DF2284E93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160377, "uuid": "2039c1be-0881-47e7-b147-eb9afaef1ce1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160377, "uuid": "81234716-2b83-428f-8c81-f727ecdbb062", "value": "12288:YMrsy90gmC6fDIZ8nRtj6yQbbXFmLlVAgBYCBf/+efaAg8id0hW7e:0yXa8Orh00LbHzl/FfaAgd0hW7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160377, "uuid": "ec30447e-0b80-4a67-96ce-32ec4f8fab6f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160377, "uuid": "7acbe1cd-8eba-4f60-be14-c22f85fcc944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160377, "uuid": "e6e7e353-11bc-4187-82d4-5e40a53b6842", "value": "dfa2a6abb11a926ce56d07f6bf54a37f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ad8abe-3311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691186190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186190, "uuid": "3beedcb6-bf2a-4f2f-a1eb-daa7ee1c98f8", "comment": "Malware payload (RedLineStealer)", "value": "fb42d745da5e24b56fd09438d35d6288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186190, "uuid": "f761e730-de9d-4dc5-b4e9-3cb2ae583652", "comment": "Malware payload (RedLineStealer)", "value": "9782873001d220366ef2ae121d9e5cd04cdf7302c53b654fcfb86fade87f9678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186190, "uuid": "c833c731-daec-4eff-9c4c-2e15ca7099f3", "comment": "Malware payload (RedLineStealer)", "value": "6769aa8cd7bfb9b3667ab501fc7f7e13633aad7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186190, "uuid": "23354b72-fbe8-4c15-884a-df3e55ad1efd", "comment": "Malware payload (RedLineStealer)", "value": "607f3ccc4d3b2555eccb5cdbbd1b45b12d2f01a4b718cdf4b2c82ea434c9523024ceccc531fd3cda2850a5a89ca89f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186190, "uuid": "b8df6ec7-6c40-4401-b8b4-b739a43c30a9", "value": "T13FC41202A7E98073D8B52BB0A8F303C70F36BC75997C47AA7316685E1C627A0953577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186190, "uuid": "f3d81e65-3c61-42fb-87e4-be53089fac88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186190, "uuid": "ea71003e-11fd-4964-8858-f968a851aa80", "value": "6144:K3y+bnr+Mp0yN90QEm5XhD3j5eX/O2fDj6ImJ3eH6VpOqrmJIXEqa4rK7XxFxcxp:RMrMy90IP5eXG8jau6VcqS4rYKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691186190, "uuid": "a4488d6c-6209-4beb-8786-814825e419d1", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691186190, "uuid": "8e1d5721-7c77-47c5-b825-a35a9c44f058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186190, "uuid": "9b315ff8-9517-432c-a763-32dc6e880630", "value": "fb42d745da5e24b56fd09438d35d6288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75de893-328a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691128266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691128266, "uuid": "cd56b0e7-20a0-4a64-9a70-56188c98fd6b", "comment": "Malware payload", "value": "6abb4de307e2e02d1ffe5369d54ac315", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691128266, "uuid": "9e55de56-a182-42e8-bb64-d63abcf0782b", "comment": "Malware payload", "value": "98962f488c06605ff276ae7fc49e494635ff1a7b250bffdfb080450ad99c0863", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691128266, "uuid": "2b7b1bd9-e992-4492-ba51-73fb5fd83348", "comment": "Malware payload", "value": "fac7d80351ac168568be50b386b63a27f49b2de1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691128266, "uuid": "3d558e5c-06c5-40f9-8a0a-a67dbdffbb55", "comment": "Malware payload", "value": "a7f2ca51e1bac6169590e40e8b8f6ec6e0463aada2b664d56dd21b9ed60618b339e4ca160c44ed2ae570a9ba2f3becb2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691128266, "uuid": "9dc746cc-0e61-40d1-8c85-381a051e62e1", "value": "T11FE4EB83B3C2B89102432BB1B61B69D9EE2E2EEC75D8046BC115FCD5B4A56DCD5F6830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691128266, "uuid": "71b165e2-7280-49bd-a5b6-dd47046f8522", "value": "12288:yAn50UMgPtclTj8hTkIf+A3ZYso7Te8vTUSjeuUpWLJkbQUiKTkzNcxGbJTxOOA8:yAn50UMgPtclTohTkIf+A3ZYso7Te8rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691128266, "uuid": "52bf17aa-6edc-46f4-8239-f89e1f21f7e1", "value": 686685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691128266, "uuid": "bb1fa759-6171-448a-8eaf-3208297d621a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691128266, "uuid": "1ebb4777-adce-43a7-beb7-622afbff9efe", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbbf670-3316-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691188269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188269, "uuid": "766997f5-17ad-4e9f-a00a-5ba6d85e22ca", "comment": "Malware payload", "value": "c26b50617b324243bef01fb359c385bc", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188269, "uuid": "6f88f285-6ae9-4e82-8426-73427377565c", "comment": "Malware payload", "value": "9955e231a270477c1b809ae8d09c5010c99899d4936b89331d224db9ddedabcf", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188269, "uuid": "a2e41952-202d-4c9d-86f8-05a544fc2ea9", "comment": "Malware payload", "value": "8ebc4a4fd5f48288f9bf93461ca1a8b02069d02f", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691188269, "uuid": "79ff5212-c104-44ea-bf52-ea7e29b1eb3e", "comment": "Malware payload", "value": "eb37608cc8a1ee0c1c06f70dd8a0efd78f4f87b70d927882575c4ddcfdb7d352e92aac15cc40289771f5da101c34a068", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188269, "uuid": "333eddd8-b051-4cce-9223-c845922e3954", "value": "T1B9C08C74455DCD25842B5A188919CEBCE81310C6319ACCB906D62A48FC4306A8E980C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188269, "uuid": "37f2aaf5-01ec-421a-a8b4-e37916a32adb", "value": "3:HRAbABGQYmimiLXIhzKEgu83uZ96ovUo1YSo/QJ5hQyYesbBSn:HRYFVmizLXczfX83ktvISoIJ5SyYesbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691188269, "uuid": "2affd5b1-9171-43c1-bff1-d490ff44df54", "value": 154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691188269, "uuid": "eb64aec2-3b4e-4242-862b-2e136719ec09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691188269, "uuid": "bbc7a2bb-07b5-4b2c-890b-eb99d17f4865", "value": "downloading-(114.0.522735.199 (Official Build).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8bbd9d-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184378, "uuid": "32cd9062-c0f6-4e53-8bec-47e16e6505b6", "comment": "Malware payload (RedLineStealer)", "value": "0038f7eda67d35b9e71b7a97aeb8998d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184378, "uuid": "08a0cf17-4c7e-428e-b137-f891b91ba4b3", "comment": "Malware payload (RedLineStealer)", "value": "9ac35a215372aabd03b299866f8f01282a73f761110932e67d5c46c263a340c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184378, "uuid": "b547f7bb-0165-4a6e-81ce-259963dabfdb", "comment": "Malware payload (RedLineStealer)", "value": "31bdb05f822756a820aee7743ee180de2cc7ea85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184378, "uuid": "652fdb4c-6df7-48b2-991c-b643896df37d", "comment": "Malware payload (RedLineStealer)", "value": "12fb58f67f84d4aa0e146213dd3b0a177a1cc88259f23a66f5ce31873f4c58b04ad2e70b904ed9ebc4e0acc71e1c8c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184378, "uuid": "a88d20ba-8ebc-4b2b-97ba-8d9d3e609e69", "value": "T1BFE4121797E88122EC786BB418FB06970B327CB08D3C836726956D5E4D736D0A5B07BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184378, "uuid": "e2f151fa-dafe-4b4d-8700-1f6cf2ffdf4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184378, "uuid": "d985a15c-7510-45a4-a7fc-b73c7c13fcdf", "value": "12288:oMrAy90fjSJMT+IqEO2NrWu4WOexHBsOu7CuhLqhs5DiLSsA:IyVJo+Iue14neVnuJ95X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184378, "uuid": "74aa6b17-aa80-453d-ae37-c1fc2f62b857", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184378, "uuid": "aa116fb8-1f84-431f-b5cb-d3781dfe56f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184378, "uuid": "fbc1aaef-e662-46b3-a69b-af34fe5904f3", "value": "0038f7eda67d35b9e71b7a97aeb8998d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5523149d-32bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691150784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150784, "uuid": "9c28a395-1621-46ba-98a7-17ca176b8709", "comment": "Malware payload (AgentTesla)", "value": "b938b5a911c7e945af48012d7392ed8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150784, "uuid": "eb7fee0e-bb6c-4b78-b72b-2250253486ed", "comment": "Malware payload (AgentTesla)", "value": "9afa483cf191fdd0a93929f83b6124356ecccb9c7d5caaa7112aeb2d40d7a704", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150784, "uuid": "93a96a99-ddb4-4185-931e-4d212b39896d", "comment": "Malware payload (AgentTesla)", "value": "56f5baecc920d7fa575801a9c6e9e2e8a94b05b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691150784, "uuid": "cf399fe3-e4b2-4dcc-bdba-6ddd13bee592", "comment": "Malware payload (AgentTesla)", "value": "58fd18804587d0025102d88d784d8cfb52cffb83abcbf9d5b39be8f323d74100a05af61aa344fd0a64fd4c51511dc9d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150784, "uuid": "50c04fe3-5fbc-4c30-8d30-f2684f01893e", "value": "T15F1575F731BD892AFE045EBCDCDA46288FEB643DD40D600A7730DF491E7AE88905A645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150784, "uuid": "7ab3ee9b-888c-40f0-91fd-747d8a46f13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150784, "uuid": "0f61955b-df23-4570-93e9-41748a95b2c9", "value": "12288:WrarDyzeBpkPgClHnQP3nsJ4F/GuSa0mitVmZMtntGGzGtGGGlGtGGGGFGGtGGGw:WrarDyKB4gClHnQ/sOFGxaVW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691150784, "uuid": "a8dc9239-3ce9-42dc-bfa6-e9c6bbcb6925", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691150784, "uuid": "cd0f77b2-2c4a-4515-870f-0ca202442941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691150784, "uuid": "926f294c-6520-4cec-a0e0-c2b3620d273f", "value": "9afa483cf191fdd0a93929f83b6124356ecccb9c7d5caaa7112aeb2d40d7a704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462fdceb-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184689, "uuid": "08220d23-28bd-4cf6-8358-571fc14902d4", "comment": "Malware payload (RedLineStealer)", "value": "a0ace59755e7f6c0ff6841a74ff552a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184689, "uuid": "f9759756-55bd-44c8-b52a-96c61c7109e9", "comment": "Malware payload (RedLineStealer)", "value": "9b52bdf61f9977a9f613ce30bcde5850e3bfa9335253d51c9bc2d0c5cca3fa55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184689, "uuid": "9f018509-43af-405e-a40c-79818889506d", "comment": "Malware payload (RedLineStealer)", "value": "d5fa9c42fb92bb2213289cc7f8a29694eb2ec8a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184689, "uuid": "ba6057a7-1450-427c-a0c0-c1bd6e92f3a8", "comment": "Malware payload (RedLineStealer)", "value": "482e86870dbe0190058db6a4f22d893413ca6da57d9f6757290231c7d96c94b46e8c6be3d21587e350282f68c4590df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184689, "uuid": "51403ef5-426a-4862-849a-80efb55bd26e", "value": "T16CC41217A6D940A3D9B52B704CF703A307397CA29A74D21BB7844D2E0D72AC8B57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184689, "uuid": "96c683e9-6ade-471f-873d-5214d4643ced", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184689, "uuid": "2882dfb6-1319-472a-85ba-7f4e04948ee4", "value": "12288:mMrLy90wPqWSQx/tmUh8CaLuNfSNix1cE2I1rDNgi:JylFz8dLuNaNErDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184689, "uuid": "8d6efd72-6f03-4c82-846d-6d03f12652f4", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184689, "uuid": "57cf94db-e164-44cb-8871-0627af35333d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184689, "uuid": "9f719617-2d11-4140-8264-7af3b2823900", "value": "a0ace59755e7f6c0ff6841a74ff552a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3182f-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691124166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124166, "uuid": "8f5a9326-f2a5-4f22-af47-805bbccbec78", "comment": "Malware payload (DCRat)", "value": "8d3c4b58a9943431b824df429088f51e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124166, "uuid": "a6b4b153-f8fd-4523-b070-7d620923d38b", "comment": "Malware payload (DCRat)", "value": "9c9d8a801b826de4a8d05a300673282ade62891684f682a695e6a1a8db083466", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124166, "uuid": "7eed1663-a646-4999-881e-0c4113d50a8e", "comment": "Malware payload (DCRat)", "value": "fa610dba7fc07c0292c1d14095d7ffba014a6eb4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124166, "uuid": "36121155-6a08-4cbf-b324-4984386d82ca", "comment": "Malware payload (DCRat)", "value": "64d3513743c87ca02f3ef0ec2df0822f9ed68ae56d33aaf62b236c73fba7b8f9642f1066de6c2764f76539092a82da8f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124166, "uuid": "12266508-2512-4731-996e-855ebf253c2d", "value": "T1EB455A027E84CA12F0085633D6FF454887B4A9526AB6E32B7DBA376D55133A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124166, "uuid": "ad37cc97-9c11-4488-b54f-f6bff63932a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124166, "uuid": "c9cd8675-c03e-4abc-9f0f-b87f22cbe366", "value": "24576:GsYNqE/uowl3MTv9PV9bOhBZwXHLreY4hRoR4y4b08d5:GRNqYuv8JDOYHLrx4hCRUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124166, "uuid": "81d63e68-c52d-4b7b-87aa-6e9535dc0373", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124166, "uuid": "1f37ef00-9ff4-42b1-ad65-1c3e1b5d2bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124166, "uuid": "500b19b0-f182-4dcb-9211-8457eca6b5f8", "value": "8d3c4b58a9943431b824df429088f51e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfed884-32f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691175706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175706, "uuid": "1cfad9db-2c4b-4257-92dd-a9f45819c662", "comment": "Malware payload", "value": "036d277c638e4b925bcb57160415bcac", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175706, "uuid": "709467fc-1a7f-4e36-ba63-17cf2da5c4cd", "comment": "Malware payload", "value": "9d13a2c20d24b58648534b51e25495b88ab55a156264b0a167130690ed116470", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175706, "uuid": "e227a968-4148-4335-8751-b4fa79c44e69", "comment": "Malware payload", "value": "f888fa66ebba2596533040ec505fc24a38d2b740", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175706, "uuid": "48dab52e-b594-437d-8702-b30d105d9691", "comment": "Malware payload", "value": "9e49c276de7c0b16d6910e1f69d28c7427d55fb062763b3dad44eeb14ed52411df72eff978d7b9983dbb04eba7bfa713", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175706, "uuid": "623b4394-632b-4703-be17-609d24e01f89", "value": "T1FDC4230715E8A7D3DC895777F86E41090ABAA8039BB8FDA5BF8D019A4DB73345303792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175706, "uuid": "d3575955-35c4-4d33-935e-3d9bc33cdda5", "value": "12288:xhhIDj62CZgK57tArtiCpuczvtjfv3uHPjE1T0Vp6eEqjcHKm7PHE:CDj6nOK57tWg8dRv+H7EIVptEIg/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175706, "uuid": "9a024a71-6190-4b6a-863b-b290d8dac14f", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175706, "uuid": "063325e4-af0a-489c-b5ee-9b7cb8900007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175706, "uuid": "96337b0b-ef49-423b-bb75-751058944fd4", "value": "036d277c638e4b925bcb57160415bcac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c3a009-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691149085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149085, "uuid": "26803192-b51f-4afe-aba7-914db679db9e", "comment": "Malware payload", "value": "f01a75cf343e5bee34a546f99a1fbb11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149085, "uuid": "e87ce4b6-7c1c-4407-bc6c-ed79892a9e35", "comment": "Malware payload", "value": "9d767186acf12fc3bf93dc990fb32b2ae011922ffe319bb08651bd1613a5985b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149085, "uuid": "3cbe3523-4d5d-44a1-bc4c-d17817bc66ad", "comment": "Malware payload", "value": "7f1ce1dab13bf07e899073c3cfb1b0b8990d396d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149085, "uuid": "17c2460d-a08d-4fec-987e-c5af60776f57", "comment": "Malware payload", "value": "e92602fb83160b19ebace175461d32cd5b6b91678892a54df3d161167b0d5ba2b16770e0e7db257f947b184ed7946bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149085, "uuid": "3dae9a7b-1d50-4c93-978b-c0dea358915b", "value": "T10D136D52BD388913C1554A3DE123D5126B70CFA2334BD71F7427AFA6AC66382FC1A51B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149085, "uuid": "4fef0be8-e840-45c9-8ba0-4adc454f4cf9", "value": "768:sWv/7t0f3dpIYYsfMABuDmrV2za4LYeWq4rs1zvCtMQd:s4/uOmrV29LYeeRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149085, "uuid": "c3291bca-49f7-451f-8dfb-fb557ef794da", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149085, "uuid": "c3c1c4cc-c002-4973-bb8e-0d598ad7587f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149085, "uuid": "555c3e0b-c534-4b49-b179-cd5e86236598", "value": "9d767186acf12fc3bf93dc990fb32b2ae011922ffe319bb08651bd1613a5985b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a421a073-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173250, "uuid": "3a61bd10-7f5f-40c1-ba7a-4780b4992a56", "comment": "Malware payload (Amadey)", "value": "e43e6f6c05c8dbfbf96251a2df15ada2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173250, "uuid": "cdaa8b1e-951d-4c18-9514-65020ccf4f31", "comment": "Malware payload (Amadey)", "value": "9e8d1578ab3c7426e3b892748fc05ae18abe299d06791c07ca1ac9af9ec2c32d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173250, "uuid": "850270ef-8e28-4022-aaf2-406cba9d9b0a", "comment": "Malware payload (Amadey)", "value": "1a4f0dd324868f889036d8022c15fbcdbebdaa66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173250, "uuid": "9a27bb43-0d19-4416-a101-40d0bde160f1", "comment": "Malware payload (Amadey)", "value": "5c17d260f88fdb4aa4274a42e6e497f358e51308e5873401b937e0ad02d5e303dcdafe82bdf3af7241db5e9c386a73f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173250, "uuid": "0331ff20-68a7-4105-a1b1-c952e207ce33", "value": "T1B5E41207ABE99077EC7067705CFE03931A317CE19AB88257339A994F1CB2594A5B133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173250, "uuid": "d9e68ca8-7e16-4734-8c50-677f5a4f23f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173250, "uuid": "252ae78a-5703-4891-b93e-2458c60964d9", "value": "12288:6Mrgy906xtm81X1j+sudgt52KM1tk5d9O7tBIhKsSpywHbpuc2obnzGwWLFXk:myLjjluCtw1tV7tTlVd3GLNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173250, "uuid": "31dc5b63-b74d-4743-84c4-b108598a7ddd", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173250, "uuid": "9411cc60-4993-4c66-9a39-abbe6f819589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173250, "uuid": "5676099f-b54e-4b61-89db-35c8987e4142", "value": "e43e6f6c05c8dbfbf96251a2df15ada2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc1cc3d-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124383, "uuid": "09ed0dbb-f60c-45ab-b9d2-3747f18e0487", "comment": "Malware payload (Mirai)", "value": "e8c1c4d6ac455f0728ca33fbcb8d814e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124383, "uuid": "9d123874-0592-4028-8b57-7f667d7edf35", "comment": "Malware payload (Mirai)", "value": "9f21f6fa3ce702e665df2bf31f2624dd497b610534878c9b3da5187b3b15825e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124383, "uuid": "cec3bf3b-92fe-43ac-9951-73a92f5128d0", "comment": "Malware payload (Mirai)", "value": "459e3a320026ef4fafd538dd51a0c1ac8081713e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124383, "uuid": "3b40c07f-2d3d-4d2a-83ab-9d818623f646", "comment": "Malware payload (Mirai)", "value": "275b0534d05aedb8eb5dbfc504a002a25fbd58e3b935599527e05a9cd6f2ee3690949681dde752afe14e876dbccb1650", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124383, "uuid": "df778105-7181-499d-9c8d-29d05f731981", "value": "T193E2E109224D66E0CFEA32FF9713582532E279237FA85B24BE5ABC77B2697D514A0041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124383, "uuid": "1538edd8-bc3a-4ae4-84e9-259c2ead4259", "value": "768:2IrHMB1vlu9WnVZOtakI4xobUR07QgWzKcAhjm7KBP9:hHulFnVZhSQUq7QgWWJjm7W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124383, "uuid": "f7e3efb0-c7ec-4335-b238-780f94c8878d", "value": 31208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124383, "uuid": "bcc4d393-d01f-4ed3-a55d-8839fa2bf08c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124383, "uuid": "57bb08a7-84a6-4cef-ae75-89277b5ebb0b", "value": "e8c1c4d6ac455f0728ca33fbcb8d814e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac390cf3-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173264, "uuid": "b8ab3fc7-5b27-4e48-b366-c1f133212d53", "comment": "Malware payload (RedLineStealer)", "value": "f14dccc8754eafabb69a5266a2e1343b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173264, "uuid": "2b7ef5e9-0e5a-4063-983f-9f928407019a", "comment": "Malware payload (RedLineStealer)", "value": "9f5258b4b6faed9662798ee589e1a925b1b2c03112f20315da56d77f2a6ba2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173264, "uuid": "c563a67e-904d-4d08-9b78-d6a76c132557", "comment": "Malware payload (RedLineStealer)", "value": "0cb945c87327a82f4df47a83d2ce7a755b7901b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173264, "uuid": "c4740cc2-afda-4794-a2a0-1b4b04e49188", "comment": "Malware payload (RedLineStealer)", "value": "4c73d0a81b0e38df288cc128261d386df92742452e156f24c718bd52203c0aae1f421994f88b7dbfb0a17b7759bb9ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173264, "uuid": "f1d15f6b-7c75-41bf-b580-a02e7197d12e", "value": "T1ACE41242ABDD4033E9F927B458FA03930B367D600E65836A1798998A1CB36D06D7973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173264, "uuid": "dadacd47-3c80-476a-bf0d-e71fa4a9f65d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173264, "uuid": "0d76323b-4e79-42ae-b820-4cc5dea43a2a", "value": "12288:YMray90cqFOrimLyCPOEcrzydjIsqSSUFqHSkQuvlvbJiaa:yylKOOmWCPOB3ypS3xvdbwaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173264, "uuid": "0f469da5-4ffe-4b57-9e25-eb8bad6c2d8e", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173264, "uuid": "441960f3-691b-47ef-899e-4abc1438d20b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173264, "uuid": "da1f9b10-21cc-4d0d-a3a7-1fd4f4e0143f", "value": "f14dccc8754eafabb69a5266a2e1343b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b59c60-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130083, "uuid": "9aa626cc-3229-4761-a211-692e55a1e3a6", "comment": "Malware payload (AgentTesla)", "value": "4f984c1bec73fd3bbfd77ec9b249baee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130083, "uuid": "bd02652f-a11e-4454-9da5-74691270f04a", "comment": "Malware payload (AgentTesla)", "value": "9f67e7fe9d42fd8fdb38ad26d81b93a2d6bf143e3ca5b7ca72733605b2dc2f5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130083, "uuid": "a37de930-a612-488c-a322-a1db47339f70", "comment": "Malware payload (AgentTesla)", "value": "ff9f72b549f5241cdbb42e9fea5bcace4a65369e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130083, "uuid": "1982a004-ffec-4729-9805-1be5147175d2", "comment": "Malware payload (AgentTesla)", "value": "bbc0372a2dbd1d9c37e735587e6ef57af3ad6cb9b2a718bdb3c548ef1e9f5810ad1ea1ff1bf8e02d6452e41439aa54a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130083, "uuid": "33e5c83e-8f4d-4b88-b1be-5786cf99cba9", "value": "T131E4230920C9AB36F57CC7FA58E3D53117B8BA158921D359BCDB27D31A36F860892E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130083, "uuid": "cdbb4bfd-75f9-4363-a070-4258b7d9e3fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130083, "uuid": "f0f9bc45-d87b-498a-abca-fa0229d4745e", "value": "12288:I+1BYQvjOl3PjxzH6GBAtiq8Ol6ev1Py4tF+SpsohquUH9eACv8NWb:I+1POlB1BTq8cLvlyI+aqBHQACvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130083, "uuid": "6e97c967-d406-4227-9410-57d514d0ebd2", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130083, "uuid": "d97dbc1b-8c65-4a2a-b2b3-8e7ae3a0260f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130083, "uuid": "c6d693e0-4239-4652-84f4-152d383fbea1", "value": "AWB DHL 7214306201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a8fd58-327c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691121946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121946, "uuid": "7d023508-7ca3-45cf-9e15-0cc8970bccdf", "comment": "Malware payload (RedLineStealer)", "value": "746793d5060783cb434fb65de6b03a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121946, "uuid": "a6e273c6-184a-4ac3-8710-3c1446c930fe", "comment": "Malware payload (RedLineStealer)", "value": "a2d9276de8eff1ca461030a60999e260b81a156b6f7674ec7506a68735341a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121946, "uuid": "a45b1f63-f62c-47e0-b487-209e4820ac7e", "comment": "Malware payload (RedLineStealer)", "value": "a808db74a546d9feda5c9f4419f5437aca96677f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121946, "uuid": "1f3092f1-c637-4744-adab-1a715c01e4f8", "comment": "Malware payload (RedLineStealer)", "value": "e0eed1b7b1500e893a1bba99dc4b1b907cbdba0e5fca3788643023fcd39a2246ff8ac52b557ce2489835d0665cfce173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121946, "uuid": "20a47fae-fb12-42a2-a1e0-d9a3d11770a7", "value": "T1B0963348A6E79C32F25E48B230FEA00AF6665CA3914FE14660C9F3614E777979C35F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121946, "uuid": "8919c5ef-1208-4eaa-9172-40fbd56c9d47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121946, "uuid": "0f73b347-9ed1-448d-9f09-4efd40414709", "value": "196608:5KCfce3k4EpZi9HVCoUoWmc69/2aVwYPzKgZBPUyymmuloZ4ZEp:ECfcyrEpw91COWh6oan2oRn6aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121946, "uuid": "256471bb-b68b-41e7-b7c5-29c8e41163eb", "value": 9314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121946, "uuid": "aae20426-cbe2-4093-a7bf-a90df20487b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121946, "uuid": "228feb40-f0b6-475b-8029-22b9308ad062", "value": "A2D9276DE8EFF1CA461030A60999E260B81A156B6F767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f003cb6-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178369, "uuid": "d635955d-e468-4467-ba9c-9bdd6bc8b2ca", "comment": "Malware payload (Amadey)", "value": "cb22278120447527433ac7e9067851fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178369, "uuid": "0ca1a44e-260e-48f3-88f2-94d5921fb3c4", "comment": "Malware payload (Amadey)", "value": "a3477d48c41543bb1fd63ba933e0f481253e0717f474266388daedbd95b247bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178369, "uuid": "daf2b0ce-9e48-4157-a95e-ced39f9b9ea4", "comment": "Malware payload (Amadey)", "value": "a4bd09e7f9dc430a1d740995ac1979d8a061748f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178369, "uuid": "f091f77b-db86-4aad-97d8-76e148a36d7d", "comment": "Malware payload (Amadey)", "value": "f2924e00b8151ecf30b587d5e29aa161d1d2042c977750dff3f7f5eebcaddc9c35da5985c3c7133361c493caf6a4aa42", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178369, "uuid": "8d96fc3b-7f43-451c-bea2-e790dfa8d668", "value": "T1EBC41212BBD81036DDF53B701CF613931B363D71ACB887A6235A694A1CB2580D57AB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178369, "uuid": "39191aec-6bd4-4449-baac-e1d9ff9be5fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178369, "uuid": "677247cd-7f16-44ec-b517-3b1f02d1c542", "value": "12288:GMrzy90o4HSuH8yAZHP3ZbvVmomtS2SA/RA+RGygae86:JyCHSQGZHfRVmoaP8ygN86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178369, "uuid": "f1cef0b4-cb12-4778-9905-e9df73365003", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178369, "uuid": "b153a79b-4e58-4d0b-bdfb-3ee15f4c7b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178369, "uuid": "8ada1fae-52a4-4251-92b5-1e29c446ad47", "value": "a3477d48c41543bb1fd63ba933e0f481253e0717f4742.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed1c2fa-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184381, "uuid": "33394c8b-2c24-4d30-aede-1bf5b972db00", "comment": "Malware payload (Amadey)", "value": "51e259df5be0677ec6be843065bfb1c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184381, "uuid": "2790af07-afba-43b8-932d-93da91c79e12", "comment": "Malware payload (Amadey)", "value": "a4a286c51fe32712f6157c0e6a21eb464c4405036790ee25e0729ad4d3d51792", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184381, "uuid": "f01ba3e6-93d4-4091-b646-a9e4204b4b99", "comment": "Malware payload (Amadey)", "value": "b9dd9a91fffea262dcbb9706b64c5d994a473b87", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184381, "uuid": "7949406e-8e04-434f-9ac3-3a62e5754ab7", "comment": "Malware payload (Amadey)", "value": "0dc481be38e1a59d29ca5de822de005a7660a04ecc7a3c8deb32a32f457b26ac0680320b4bec9baee74181860bffcf4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184381, "uuid": "4c78761c-69af-49d6-ada5-038f7c1cbea7", "value": "T19CC41243A7E98072EDB9177058F603D30E36BCA1E975835B338ADD0A4C72694A9B1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184381, "uuid": "e8c0edb1-3add-432b-9b64-c0444e743f2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184381, "uuid": "44e61eb3-ad12-4ef2-a384-cbfc2f0ed843", "value": "12288:3Mrqy90ouZemzMTvkpH9EV4bzcRToyQdQ6x:JyYZcgpO4cpj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184381, "uuid": "0801eb4a-101b-45eb-9ef2-da1ded8551ff", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184381, "uuid": "dbc4e38f-58ab-4a05-85b6-2d66cc42c065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184381, "uuid": "b884e4cd-c2f4-44c4-9af6-b183f0db26e6", "value": "51e259df5be0677ec6be843065bfb1c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a205d67b-32ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691155637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155637, "uuid": "d179fbd9-f405-496f-adee-1af03f645b80", "comment": "Malware payload (Amadey)", "value": "095780f846dd9bc1cbd28f42c2b7d1e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155637, "uuid": "a8134ca6-4989-42bd-b84e-38a4e9c84827", "comment": "Malware payload (Amadey)", "value": "a4dc810cd79df4b2cd220f2d9051496200b80da4efeb45e4255fb60f46c88bf4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155637, "uuid": "beaf0444-3ed9-40a6-aa0a-3e6004c358bc", "comment": "Malware payload (Amadey)", "value": "96d610f0d5b0f6c8999964079ea1cfb91dd56f76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155637, "uuid": "a42d8d69-c9f2-4e67-8e24-64910ca31b0b", "comment": "Malware payload (Amadey)", "value": "dd8af76267c3d5ef8d231af691b16ba30cf0d0908dea2fae57867ba38731eb3ae43d7d722462d256bfeb916c09a4ca03", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155637, "uuid": "7361192a-61a6-4efa-af56-b5af43edaaf1", "value": "T1AD84F212B7E94133E8B517705CFA12D30F37BCA249B883572786A85E1CB26C4A57276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155637, "uuid": "2a1b1386-9fe2-4def-9520-d92af9df427e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155637, "uuid": "127a96d1-5218-41ed-b390-901d76bc4fcb", "value": "6144:KDy+bnr+zp0yN90QEioeJ9t/RS5KRckVwZy+4rcd2/KwiyZpx4JYoE9IBZ26Ymc:tMrTy90c9tM6cjyKd2SzyyiT9+Z26Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155637, "uuid": "9fcbcdd4-6cde-4504-a57b-fb69126e90b0", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155637, "uuid": "e535cd9d-f494-4270-9364-e79d2ff3f051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155637, "uuid": "636d637f-fe61-490a-afa4-28f8ce54f200", "value": "a4dc810cd79df4b2cd220f2d9051496200b80da4efeb45e4255fb60f46c88bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497613a4-32ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Empyrean)", "timestamp": 1691170951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170951, "uuid": "ebf1e44d-f548-45b4-9677-aabc458696ca", "comment": "Malware payload (Empyrean)", "value": "cf3cd9b8fa245b0073b03c250a6c2620", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170951, "uuid": "e1c3025b-6b4e-412d-bde4-63051d9e1a4a", "comment": "Malware payload (Empyrean)", "value": "a5248efeb27d5fbdb9c887ca60197e123d60b42fb9f84c2c1b43dd9de97b99fe", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170951, "uuid": "7da2e27c-9684-450c-836f-06d7fca62c2a", "comment": "Malware payload (Empyrean)", "value": "b4d6705577fa96e98aa53adcde56669ffe6d129b", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170951, "uuid": "c0bf2a1b-3e8e-43b5-b37d-d7171f2f2d54", "comment": "Malware payload (Empyrean)", "value": "1f35a2244233a01ea9b4a49d8339f48bf4807ed59e356b55c492e1785e433c2e9bdf5a931d9d4f2ffb5771311aa5c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170951, "uuid": "0afca869-1cb1-490f-8ea3-9dc932cf0395", "value": "T1491733E4525809A2D8E2653E5C1FDCAB157BF84223B4EC8E43F096288F63B551D7BF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170951, "uuid": "e6e1f0f4-bfa5-4011-92be-2253876c1a72", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170951, "uuid": "3f9f1420-2bb7-4e80-8129-6dd98286584d", "value": "393216:KqPnLFXlrg3AgQpDOETgs6afGAMgTnYvEYv/6DxCLX:fPLFXNg3JQoEiMnRA6DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691170951, "uuid": "f4742025-c1b3-4b78-bfa3-37788c5a3591", "value": 19424169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691170951, "uuid": "5d65a7d0-e90d-4c5b-9ef7-f68687a7bea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170951, "uuid": "bda41f2f-87dd-45ee-82f9-ec69ba52e314", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34eb7a4-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691114945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114945, "uuid": "21c4caae-54c6-450a-9daa-ca6bb5a3e522", "comment": "Malware payload (Mirai)", "value": "21343a764c546aee50da995066410c2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114945, "uuid": "15109dbb-77bd-4ce7-895b-5a82be418293", "comment": "Malware payload (Mirai)", "value": "a5ddbe2b2a5245db63bb746865018e40fbc25ef9a3f0c4d62b3ad8275c7eae94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114945, "uuid": "1311ab35-002e-47d9-8b78-caf7d405b2c1", "comment": "Malware payload (Mirai)", "value": "fec14a85221ecafb43d018188d3ac146b8f93879", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114945, "uuid": "25db1594-8880-477d-8855-804c2315c773", "comment": "Malware payload (Mirai)", "value": "21ed2e9cea84dac8b08faa39e76bade3dcc50709cb55a3473815ed31511fd6e11646d8ceb3dd49f508236a5eb66d4c4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114945, "uuid": "b305abd4-bb07-44b2-bb6f-ca793b594384", "value": "T1AFC32B46FB418B13C4D617BABA9F42463323D71493EB330699186FB43F46BAE4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114945, "uuid": "65b523d4-3d19-4baf-ad28-72955a864fd3", "value": "3072:yKVf1vhY6f6C37JD10H0aHu28g0IvYTQzt7sM/9d6rlw:Nvhtr9B0H1Hu28g5vlztIM/9d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114945, "uuid": "a9010ef4-3582-45dc-ae23-dac094ae03c0", "value": 121990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114945, "uuid": "8342961d-70f3-4334-a576-f01280f0cf01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114945, "uuid": "69add4bd-d9b2-4f41-8a85-c08f2e3c165d", "value": "arm7-20230804-0209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c711303-3306-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691181371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181371, "uuid": "aec60cbc-d836-42f8-b3a4-04c16470805c", "comment": "Malware payload (RedLineStealer)", "value": "11c3a66128f48424b0a4964fd630450d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181371, "uuid": "6e501350-c32d-491f-9b97-795fa8d18a45", "comment": "Malware payload (RedLineStealer)", "value": "a663b8fa07d69519e22de27896fe3eca18ee8ac44168651f1b6ac283a434ca49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181371, "uuid": "55042506-efbf-4b8c-9bde-68e5d909d500", "comment": "Malware payload (RedLineStealer)", "value": "f9f74cae3af2d392034afffa5f7e8ae79f9ac6bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181371, "uuid": "3488e18f-dc0a-4b50-9755-0a467aa43f4c", "comment": "Malware payload (RedLineStealer)", "value": "6219f173959f0af5a9a1924611a084f2a81b622a1c2532d6bb1bf1fe1b39323b5c9d9c038c98b5a97d4f87e2aabeffc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181371, "uuid": "f800ec27-0134-4bdd-a56d-1b0b67ccd932", "value": "T1D6C41283E5D9C531D9B427B058F706870E357CB289B9DBA63749A45F0C73B94A13232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181371, "uuid": "71db9124-4978-4ea5-9897-557e9b33e387", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181371, "uuid": "1dc8203d-5b79-43f2-b2bc-1e7bc962cb31", "value": "12288:1Mrny90NjiLW8rALOEfW0WtLXeWgBYCPOfLdsZ9rim8s:myajaW8XFbCzmfLdsZAmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691181371, "uuid": "eb7fc556-fac2-4487-b7f6-145ed646f2e0", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691181371, "uuid": "c7114bad-9825-4658-9df3-e33b08e052b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181371, "uuid": "e87a47ff-b9ac-434f-a2f4-5dda856334e9", "value": "11c3a66128f48424b0a4964fd630450d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66feebf9-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691114736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114736, "uuid": "3d7630fc-5a95-44f3-9e6a-33dfb16e38ce", "comment": "Malware payload (RedLineStealer)", "value": "9e7feca9fef30b1dec6a77503c49d338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114736, "uuid": "88e5aaa6-4c74-4b41-a331-0e4c5b0d50e1", "comment": "Malware payload (RedLineStealer)", "value": "a75b49e7169c29b96fa49c1706e3afa08c1adb96ffe21d1f822232f72920e422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114736, "uuid": "87017ed4-24d7-497b-ac8a-71bc3c3caf91", "comment": "Malware payload (RedLineStealer)", "value": "43d9103c0bace76f2444650881cae0cb6334e3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114736, "uuid": "d118df4a-cdda-4abb-8ee8-48904cdc29be", "comment": "Malware payload (RedLineStealer)", "value": "f4760306d893b22fd68ea8c3b4d95a3e103eede456b3e9e1335f2e2e637b3564aac90a8c0aea8fe0061b36250a3d6ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114736, "uuid": "adc0ae17-a8a1-423e-967f-6dfd70f4b65e", "value": "T1F5C41253E6E85077C9F51BB028F617931F36BDA28E38439F2246991E0D73688683177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114736, "uuid": "0236c126-9cd4-4f6b-9185-72f18ebfbc26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114736, "uuid": "fd6801cc-6f4d-4fb4-b01f-a8cd46af5354", "value": "12288:rMruy90P2hh8U6zD6fmHEc3Uh/GyK7nio7IodSi/BO:ByX8qfmHx3uGy4nzrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114736, "uuid": "3c56ffc2-ef07-45f6-825c-c2ba91cbfa5a", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114736, "uuid": "5bbacdd1-c3db-4ac3-b698-e5f8d5e98dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114736, "uuid": "c16a247d-0bfe-421e-a047-bee353d636c3", "value": "9e7feca9fef30b1dec6a77503c49d338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096ddd97-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691184587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184587, "uuid": "ae72f071-988a-4f52-a62a-99ede25e98cd", "comment": "Malware payload", "value": "9767ef1f8c9049b5e24e21d4addb6227", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184587, "uuid": "8811c3ef-73c7-4527-8920-36b34f813026", "comment": "Malware payload", "value": "a7a7547910af724e612d2d2d2bd57abed661cf7e22f243ed6c6ebbb492e534fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184587, "uuid": "db2c5dbe-3b1b-4a5d-a5b4-adf9906e51b2", "comment": "Malware payload", "value": "0d765e69fb794cfa431190009e3ad03c3435189a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184587, "uuid": "5cdefbae-b423-4e07-b424-11b0a2092aa9", "comment": "Malware payload", "value": "03c0a4135e6949ebfbff4a847a1e150af96a97c29f8d1037817d25239898ef337150d515997b4bc911b44344d61e8941", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184587, "uuid": "b3cf7d0c-cf2b-4f04-9bb3-da07751c847e", "value": "T1B5723A1753414DF3FBD906FA8B3F502A3669D95183E140EB0EC05C4A8E29BDB1E724DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184587, "uuid": "88b74508-207c-4b74-ac91-f96d383a8b0f", "value": "d29dde7b8614d77cfe4ef17799473c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184587, "uuid": "c2205ad2-1a87-4e51-acdd-8ffc890032a7", "value": "384:Q20Q8oKFYfJGetqkPecwbnRphFa+qthGYsimSKVO:HQoKFYfJGyqkPuRKKVfBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184587, "uuid": "3d3ecb2d-dd74-4771-97fa-f8ae5396aab3", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184587, "uuid": "5442d641-3f5e-4645-ac5d-2e61463a5ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184587, "uuid": "5986700b-1092-43dc-a81d-22731aa30f55", "value": "SecuriteInfo.com.Variant.Zusy.480095.16720.5023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740f3b44-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124207, "uuid": "d9531e6f-3275-4bc8-b92b-37ca05235812", "comment": "Malware payload", "value": "ddf406eef9e267656e499eec7043cead", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124207, "uuid": "8c9d368a-084e-493a-9651-1da1f9949d6e", "comment": "Malware payload", "value": "a7c0070a2fb2bbedc30267e0bea7bced6134082efff2eb09f383a00e1cc6e605", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124207, "uuid": "8bf980c5-ea47-4f73-b351-1b1c5286494c", "comment": "Malware payload", "value": "c630c6f93e2b6fece8d7c5780df5b700677029b8", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124207, "uuid": "f687a80f-80a1-4c26-acaf-4db4d88567c9", "comment": "Malware payload", "value": "c6445bb058c7bad37f9daec53cbcb5a5b7796323c23aa4bf3820cb7d2a7f7fc256bd4f955827e06de6dff04985459eec", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124207, "uuid": "5b4da21f-ec8e-4706-9d76-26f04dffc24e", "value": "T111941210364CE9AEF18A97F92DB2B14F000CFD726AE164D73A8CF30A9575FAB6217145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124207, "uuid": "44b920dd-bc44-4803-a8ea-9ada84a7a384", "value": "12288:8o7hDWQmmme6v3QLQuE+8V2WR+2dQdpsAporEAf:VWQmmav30xyVM2dAy2orX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124207, "uuid": "89b78543-c9b2-4f47-a678-ac334d6650e0", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124207, "uuid": "1438899c-636b-44e7-963c-3c3792c81789", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124207, "uuid": "84efd0ee-6068-4a6a-a347-885766eb31a2", "value": "Swift ACC Credit CS Reference A19000478.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dded1883-3313-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691187091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187091, "uuid": "66b4fca9-5ec2-4fdc-aa1a-242e4894c798", "comment": "Malware payload (RedLineStealer)", "value": "8d1496a37cc443a1936ad6a6d61c3c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187091, "uuid": "04dd8e30-477c-4ad5-9d73-aeb4e831b30d", "comment": "Malware payload (RedLineStealer)", "value": "a7e037f2b7c77e6c2c35e4fffe71c67579cb905c4580b99cb7127ae46462c1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187091, "uuid": "79f3ae4b-e2e2-4d19-bc5a-63fd5b59cbb9", "comment": "Malware payload (RedLineStealer)", "value": "029f3d40f0d79f6495424d0159383f9205c4dd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187091, "uuid": "0ba495b0-04ed-4a6c-8891-47c097de2445", "comment": "Malware payload (RedLineStealer)", "value": "a6124969813093f9c87a2f8a50fd372f488a2c6e0d0d43eaedc9fa687437716139d24882121a2e26adbd07d38e5f8c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187091, "uuid": "b89481c0-7083-4c8c-a524-9d847f8a6337", "value": "T124C41213BAD861B3C4F50BB018FA43E31E36BD719D78524B2792989E1C73684A535B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187091, "uuid": "1db453fd-29eb-41dc-bf44-4ef961baedab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187091, "uuid": "bef7d19b-0ff2-4a5b-8af4-975233c0e353", "value": "12288:MMruy90veWb6g466YAv1am06DUd6Nym/Ni8RLA9f/wqD:Kygb6y6YAv11xo6NyUNRLgHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691187091, "uuid": "f6dda895-7956-41df-85fa-194cf34efa6c", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691187091, "uuid": "8fea6d0b-6a1d-443d-8627-459e316a93e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187091, "uuid": "30a32fdd-918e-46f2-8087-ba71d244bc9b", "value": "8d1496a37cc443a1936ad6a6d61c3c47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddc2190-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691130129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130129, "uuid": "1efb675d-b9f4-4652-8c9e-68e447d2652b", "comment": "Malware payload (AgentTesla)", "value": "5079643cd274fe763830087aace8fd3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130129, "uuid": "938eedec-8950-4bcc-a9e5-788ae0de7a7e", "comment": "Malware payload (AgentTesla)", "value": "a817fbe25bb9b3639e41779dcf3942b65685c66ef69eacb99f528a4bf8953b7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130129, "uuid": "102137c1-4a9f-4057-bcdb-7ba3b626aef3", "comment": "Malware payload (AgentTesla)", "value": "45d7d5c5958a8f6e3ae72108236f5d36f2f875be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130129, "uuid": "09ba0a8b-5566-448c-a8ef-de0807ded14c", "comment": "Malware payload (AgentTesla)", "value": "30eed23726ae01777337aa9a00693682de0811126cdb57fc97b9890a8b529cdc9b347539dec61d84a3e94d827c6238ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130129, "uuid": "6a5a3ba3-7ee9-4673-86b5-46a9aa8c6a33", "value": "T194D42322D273C35EF195D820FD082A70929F18CEC375D1C8BA8586F5E595EEA9E970F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130129, "uuid": "57cb85c4-d708-4d86-a0cd-82373b73a74f", "value": "12288:u7DKWSOToDdgrSGOZg4FJDJr6q7Y48mh8oaeXLkzQP:SRHydB5DlJrtM6DXYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130129, "uuid": "131fac6b-84a0-4546-8e12-5b22c56f3b64", "value": 652606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130129, "uuid": "3c70db6e-3ad5-4878-8134-031cae0967e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130129, "uuid": "25c9fd34-0dc2-4b62-9a70-aead815333a1", "value": "scan20230717_16422889(1).pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe09c289-32c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691154074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154074, "uuid": "4d9f99dc-e234-46b1-bf08-ad1c68067133", "comment": "Malware payload (Amadey)", "value": "2fbc802c6cfe88b166edacbbf7cd9e17", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154074, "uuid": "b42331d8-dd20-4eab-992e-9f75de342df2", "comment": "Malware payload (Amadey)", "value": "a8a1f4fda61f798434e16d9470bac0681e6b5e669848da93963cc51f1d13bb97", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154074, "uuid": "9490b0a6-2378-4162-bc26-e5aabe1b577a", "comment": "Malware payload (Amadey)", "value": "941aae15fcdf1b976558b76b4d97bd74b232e035", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154074, "uuid": "665f8c27-3625-4e01-a397-c02ba254fdd7", "comment": "Malware payload (Amadey)", "value": "35d9adbc187594dbf8d6f9e8592870c8f7d12b0482dcddabeb0669aab1052d1cdc4cefcf1fe5919a163e3c983fdba078", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154074, "uuid": "114862c4-ea4e-4ba5-8354-fd39841d17c5", "value": "T1B574F113ABE88073EDB527B458F603830F367D545C78826A2399695E0DB26D4E47633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154074, "uuid": "34944d94-f4d6-4b80-82d6-eb281094f1b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154074, "uuid": "0c0db1b9-2855-4b0d-93f6-5a28bb31b2e9", "value": "6144:Kay+bnr+qp0yN90QEMu9Z9lCkWxjZNqQRWf9laafR7n2Vztm0VPusBHnN4fnjDcY:CMrSy90OYlaaJD2VztrHNjyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691154074, "uuid": "2daea270-cb1d-41d2-881b-24c845866c8b", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691154074, "uuid": "18eb3a26-5f60-499b-9b98-896af704aa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154074, "uuid": "93cf2dac-2d8c-45cd-9ca5-860c8543de31", "value": "2fbc802c6cfe88b166edacbbf7cd9e17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e6dc8f-32ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691169468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169468, "uuid": "914c2331-ad32-404b-9755-d88fa31f07a9", "comment": "Malware payload (Smoke Loader)", "value": "827aad781d220096aa002e2ba97f3745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169468, "uuid": "67f5e22f-884f-4a2b-a031-c352fe31b848", "comment": "Malware payload (Smoke Loader)", "value": "a906b89c9c6d6b6d9478a54d027101b701fbb5b06a33a71f077278dbbbfa907f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169468, "uuid": "423c9f4f-168d-4e98-8259-048a6ef1aa64", "comment": "Malware payload (Smoke Loader)", "value": "be344d5c676c02fc07a554dc64b2a05a8fbbd154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169468, "uuid": "39c90b61-4385-4e7e-bc16-23e4c470b604", "comment": "Malware payload (Smoke Loader)", "value": "dbf3c4fdbdce1f0c17ce9893638c666333891c1f4b5b478f985c140baee8f21f9e095feccd01a9bf9f2b538e7b73b319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169468, "uuid": "d418a405-6f94-4eb6-9dd6-cc9855038b10", "value": "T12A54AE22B2D2D472E52745358D1AC6F46A2FB8708F595BF737441B6F09313E2CA72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169468, "uuid": "04484245-6dce-4110-b8c9-4b194784bd5e", "value": "3eccd6ea5d292ac4efda985924dfa212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169468, "uuid": "4059fede-5119-4d33-a422-b4bb5bec6c4d", "value": "3072:cIs7TMD7dqA0tKLywacK8tObRx6ZaziGtJUX2itASPTxzSk1TmpiVexVV:aTqdp0tKL0/8tObCauioAGR2ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691169468, "uuid": "86e65d7e-ceef-4d67-be75-d24f24bbd9c8", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691169468, "uuid": "aadaf551-4d83-40af-8870-20a2c372fe25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169468, "uuid": "1c23f3b7-23f1-4d74-bedd-b18c06a12a71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d481d59b-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124369, "uuid": "f0f48ad8-e2d9-4a96-b8e7-b8868549cbcb", "comment": "Malware payload", "value": "e7d2292130915d37117d2eb55b590854", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124369, "uuid": "d00d2610-8f9e-4786-853f-a0201b250075", "comment": "Malware payload", "value": "a99e0d793f7849c50944a266aa8e3a48dbe4ad18920db71931c07e00734b4eaf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124369, "uuid": "5d801874-1799-4c6e-8503-b414884cd34e", "comment": "Malware payload", "value": "28a1b3b7563943ecdbfe8dc6e9bd0c1acbaf6b71", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124369, "uuid": "bb3a8267-2ae0-442d-a841-bc2848b6ccd1", "comment": "Malware payload", "value": "e7de6393436df625821646f03e48611e36594399935865b1303da2ebce01a5229438870dbfba120b7f0c96bb24a0cf2f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124369, "uuid": "59e8e466-4474-4947-8ab2-209c8a6fd245", "value": "T1FBE4233F986F125867628D201E498DEFDB73710CF05A6927F426D22DF7689A0603E53B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124369, "uuid": "5d1d309a-87ad-4b91-bc1e-af643cc10f84", "value": "12288:OMEWqeq1txQpgOngfPn4FT0zDBska5031tlnlKeKVE+aGTDQ/TiEPlgN:OrW0QpgOnEPn4xGBskagEeK5xDQ/mjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124369, "uuid": "2b47bc76-b363-455d-9c07-eeb67ea7c20e", "value": 716082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124369, "uuid": "0bc56e8d-3b17-45ee-9b8f-e0e8981c48b0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124369, "uuid": "dc4fabdc-5eba-4ada-9ffe-44233c610661", "value": "comprobante.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928a3736-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178375, "uuid": "3be27b8d-495d-4e9f-a462-466cd7020753", "comment": "Malware payload (Amadey)", "value": "4ca5ba30868f0e19c800573346379c2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178375, "uuid": "14fcdd3b-6741-4155-8df7-b3c3a8e968c0", "comment": "Malware payload (Amadey)", "value": "ac5ea6883414c71723eedde6f19876a433f90687d874e8e75118ac0ab2ea11bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178375, "uuid": "1cf2941e-054f-4bc9-bd66-77e475a9493a", "comment": "Malware payload (Amadey)", "value": "52e0ac62f356e754ac34f05d3bce9f6092ca1613", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178375, "uuid": "ad56ecf3-77e4-4e15-b911-4ea6ab791910", "comment": "Malware payload (Amadey)", "value": "a5d2b959320594318d4131fd8f625abb7168b13a16e5e064aed5b3678b7c63c1ee87fe5c29e5897b66ea366114b82a92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178375, "uuid": "8ec799b9-379b-46c9-bcc1-96427df70853", "value": "T1CAC41386B7DE4071DCB5277029F602C31B367CA15E79822B269ACA4F1C727E0657273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178375, "uuid": "24bf56e2-eb1d-4f3b-896f-ef99d582c840", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178375, "uuid": "35d56079-f401-4d8f-8e41-0389b06c92e9", "value": "12288:FMr1y90JfadCaitHlw2d0yaLz1RiFgUgq2g:kykCdvIlA6Sw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178375, "uuid": "9a9ea7a3-2c1c-4cf3-861e-79f57db23c14", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178375, "uuid": "7a00650e-c214-4831-a0d4-5ecb15374798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178375, "uuid": "36e1964f-7bb8-4979-b236-64d4d63fa793", "value": "4ca5ba30868f0e19c800573346379c2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6654b0-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184376, "uuid": "4a7ea3ff-0f7c-475c-81d2-819409b2d2bb", "comment": "Malware payload (Amadey)", "value": "137b0899c658751eff9b1126b5347356", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184376, "uuid": "488d4603-2c9b-4a9f-9802-2e6bbd7575d2", "comment": "Malware payload (Amadey)", "value": "add1a2d3eed69d184da257f8a9959f9697442b5a49e038472a57d8e3ed3b752a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184376, "uuid": "323505be-9db5-4d86-ac46-62e8e35a1b15", "comment": "Malware payload (Amadey)", "value": "125007b0a857955456f6ccf28842298525606b6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184376, "uuid": "e45c3e0d-22ef-432e-a7a3-97a91b249bb9", "comment": "Malware payload (Amadey)", "value": "82fd66155f4333bbca7b8e411283357a0c255c45da5788e103d3503f4705ae6805b67115a8c0a012380c6e464de70305", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184376, "uuid": "24184f36-6899-46d8-8671-522f5af24456", "value": "T16AC4125263E94572E9F52BB04CF202C30F3ABCA6487947AB3355A95F0CB25C0A53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184376, "uuid": "a82a6fdc-5574-4658-8ebb-57e305ddc867", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184376, "uuid": "c33724a2-19ad-4ea3-9a81-e24111223c59", "value": "12288:8Mray90of2Z/P/Y5yxf85G1SKid/j11PFNc8BhLB:my6/x05CM1TFLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184376, "uuid": "f4104ad8-29b8-4721-8d24-346c62519598", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184376, "uuid": "f5b9f5e0-726e-48ee-b293-8281adca9e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184376, "uuid": "535663b6-240d-40f6-85ac-29a450109e1b", "value": "137b0899c658751eff9b1126b5347356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee654628-32d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691160060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160060, "uuid": "fb488d70-5804-427c-a926-a133aaba639a", "comment": "Malware payload (RedLineStealer)", "value": "1f1046d11d911a4d5b9f17e198868d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160060, "uuid": "458314b5-3618-415e-be7b-5adf3e7d80b2", "comment": "Malware payload (RedLineStealer)", "value": "ade147d4f269ba0a0548b666b65a5921fc1006c911914fab368025ef7faea23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160060, "uuid": "3060a6ef-1266-4a0a-9ef9-f7bde7d6f335", "comment": "Malware payload (RedLineStealer)", "value": "2859616f38f71b33d33e26c0d0784d093b2cc06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160060, "uuid": "9c6a4e4d-3baa-4b93-8a91-dfcff1ced2d2", "comment": "Malware payload (RedLineStealer)", "value": "d83bba45217d4f315ebfc2d8c4b2cb328a030ecfa4bb582f54553f925e2a05ab89eadbbfb5fda9e816808c4e596396e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160060, "uuid": "103fdb39-3ba2-4508-a69b-09330bad1482", "value": "T1EE74F212EBE88433E9B56BB068F707C30B367C615974836B2786AD492DB32C09675737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160060, "uuid": "e828eca9-610e-4743-bd5e-958b5e43db89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160060, "uuid": "d7d50964-38aa-41ca-a92d-da254223e849", "value": "6144:K4y+bnr+Tp0yN90QE2tTICnBykxYWqm0Gky9OeQzNm8QH312VZNf:QMrTy90YtTPzxYu5E3SHl2VZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160060, "uuid": "dec867ad-e44e-41b8-b03c-49337884a113", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160060, "uuid": "80935282-89b2-4110-816e-8dbca9e490f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160060, "uuid": "03b2e406-4a9c-4f74-bdf7-5f91bda3764e", "value": "1f1046d11d911a4d5b9f17e198868d60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b220d1-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691149282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149282, "uuid": "d3b3539a-ea43-477e-8096-3c890d157707", "comment": "Malware payload", "value": "7bc158071de9a94451298877fb2d37d8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149282, "uuid": "f757e496-a994-45f5-848b-1ded6d67bdde", "comment": "Malware payload", "value": "af162e684068ed41c801399033249b99aa7c2a4426f1a0ed4adab6d610cebe59", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149282, "uuid": "b9efa8e3-fad4-4a8d-8b4d-ea9c62fb901c", "comment": "Malware payload", "value": "fd4c247f07c6461d0829735e811a276886f778c3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149282, "uuid": "3c825c0b-e31a-4935-bf26-bf0e1180c84f", "comment": "Malware payload", "value": "5d08a019546b9ddc0d92a317fa8a3f5f7b1cc74ffcaf7d50f34e28122f6c8847e4a43cc0b642d1c6e5bba96959b99202", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149282, "uuid": "f412f291-3424-406d-8341-f69dc1f45a4c", "value": "T1CB61FBA5C7048DA6DA93D5F6C97E3CE90E54F2730AC911D8B0F4E8F804631166DBB85A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149282, "uuid": "3992c634-2cbc-4a80-96fb-878539150958", "value": "96:2+NBHLzBPMpyx76XF9UPVE5BNIoq1hK5/gyIzndg:2ElLtDx0UaNIoYhK5/Czndg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149282, "uuid": "c75d2740-75b5-40a0-b501-bdf5f9c38036", "value": 3265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149282, "uuid": "35cf1f20-673a-4bab-9d2c-87f1b1ce06df", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149282, "uuid": "683ffdbe-73e6-41a1-9477-6ec15dc24955", "value": "POXN8070622.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567cbf7c-32e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691167536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167536, "uuid": "1fb05b0a-9353-4f47-a963-8bc360793329", "comment": "Malware payload (RedLineStealer)", "value": "4914eb78ae32d51c8ad3c9ca33a2d690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167536, "uuid": "319895d2-1890-4290-af49-5c219e903f8b", "comment": "Malware payload (RedLineStealer)", "value": "afcff971caf935a959a0421232184f4c5c99dccb00aeb5045b5decdc6055d0ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167536, "uuid": "b6eb8c10-a25c-4a47-be53-3ba6ab59a7f7", "comment": "Malware payload (RedLineStealer)", "value": "34513eb6369a3322015d4a425ec733a6710f515e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691167536, "uuid": "7b243c76-d4c1-4a6b-9557-f32d0ca3fa06", "comment": "Malware payload (RedLineStealer)", "value": "71cd45752d788f7ab4bab37c10b97d5314eadcc67dc06981f828aff80150c6f3c80e9cb57e275ae59a6bd1a825ed1518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167536, "uuid": "604712f5-cbeb-46a3-b1b1-796a8d49ee7f", "value": "T144D41253F7E8E112C9B92BB084FA47D31B357D418C78C26B23465D4A1DB3B84A536B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167536, "uuid": "05a2ac12-4758-46ad-93a4-ebff8215b3a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167536, "uuid": "74a12f01-b65f-410e-a381-15ce9e4b32b7", "value": "12288:ZMrzy90arOv1zbVG+t9Le7125TxrOqn30qTpjSHSO/ccM0Lqcd:yyuzbVJe71ATxbnLoRXEcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691167536, "uuid": "d89afb9c-1172-4350-8336-d8f844a0dd52", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691167536, "uuid": "efdf05a8-b7f8-4098-9c6d-c18883180adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691167536, "uuid": "2735150d-f61e-485f-a399-a8762c9d3459", "value": "4914eb78ae32d51c8ad3c9ca33a2d690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102c7173-32ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691170425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170425, "uuid": "ff08c838-c0c1-4ef2-ae9b-f304a3c8bcc2", "comment": "Malware payload (CoinMiner)", "value": "b1a9da59f749d1214f9a40ac038b4c63", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170425, "uuid": "6c76e591-9276-4af6-8157-cd6e1050795c", "comment": "Malware payload (CoinMiner)", "value": "afd7ca67a1b6aaf9cf9109061d0261885f6433253c9e12dcd89dc009f3efabea", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170425, "uuid": "23e531f9-6756-4a4c-a0ad-9aec04d1fed6", "comment": "Malware payload (CoinMiner)", "value": "d2be540fcf6a65e4301c47048e3ee4d3387edb92", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691170425, "uuid": "2d615ee3-60d7-4550-9c04-c9df6355bdc5", "comment": "Malware payload (CoinMiner)", "value": "16d586f08ab4f0dea0f9ce3ce571a4b765a8d7467619aabde3b6090591343250ad06ed6a7da2583043c68c5e7607da3a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170425, "uuid": "e8e88c48-5061-4547-8304-d4dff2b91739", "value": "T172643B0352A17C51E5324A369E2EC6E8761EFD91CF597FAB2318FE2F05B11A1C672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170425, "uuid": "835b0008-aef8-4e35-940c-ed197d31ff05", "value": "e9d58d04128ce66edda6debd8a6afcde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170425, "uuid": "78d153f8-9c0f-4530-9ca8-b36d316f9676", "value": "3072:4Xoti8R3qyb37mJYprRMLb1rExPGu84YpDP3nNER6Jod9J+xOzk:25O3/zaJKREePGu8hDP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691170425, "uuid": "4e18d553-677d-49e3-89b1-e2d6b39617b9", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691170425, "uuid": "125dbe5a-6c23-467a-8fb6-103da92bebb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691170425, "uuid": "0de5f794-bfeb-43dd-b29a-4d3d1b83d924", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20de9617-32fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691177754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177754, "uuid": "7981a20a-60f7-4e24-be21-fb8340689fc2", "comment": "Malware payload (Amadey)", "value": "252bfb67d95b7f6e9126b08ad6f08072", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177754, "uuid": "c22ff2a5-2d73-4a27-9010-0054616726df", "comment": "Malware payload (Amadey)", "value": "b233a851a746c6f04df98eaad45a43d13efc355e73064f066facc2f5f59ca4b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177754, "uuid": "94895ced-a96c-47a1-95c5-614aa4240010", "comment": "Malware payload (Amadey)", "value": "796c6d19c1726c1a9cd5250a9f6eb3fad81e4f79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691177754, "uuid": "d2de0bef-4b06-4053-bca1-bcce22e07355", "comment": "Malware payload (Amadey)", "value": "462c0696ec8f9610ed2e2e6a2e3e84bdb854bfc6f9a4b736dbf13428b5b1834736843258629db93a4e8abf1452be0be1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177754, "uuid": "1290f310-dd7b-4afd-bc64-a0d452f4b162", "value": "T1F2E413429AE99477FEB517B008FB13C31B3A7D61183406BF2B54994E18B26D0B47A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177754, "uuid": "275d0b00-3d02-46b9-82c4-fc6f69266ea4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177754, "uuid": "ec35f597-d841-4e37-8e9b-4e7e854583a7", "value": "12288:TMrJy90BsHm8j7YzpGEaomBHfuOkWogZW+9MQADAHd/fsa3j2IRG:aycqZEakWogZFY8Zsi2IRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691177754, "uuid": "32059d3e-06a4-44ea-98db-6365c3fa0311", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691177754, "uuid": "37835187-948f-46bc-910c-81b4bfab1412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691177754, "uuid": "55b72357-2a47-4406-a318-3c91b6b6bacf", "value": "252bfb67d95b7f6e9126b08ad6f08072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58405533-32d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160668, "uuid": "34d8f8e3-e210-429c-9782-96c5ca349eb5", "comment": "Malware payload (Amadey)", "value": "c75802c71e10a1542018bdf1f4afed1c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160668, "uuid": "6bf1c1b2-3c58-43cd-b862-cfd4b15da83b", "comment": "Malware payload (Amadey)", "value": "b2c9b1e0e5db64148f35a8c1c2b9dfca08ce61a26c22e66e4474555595d7463f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160668, "uuid": "54df4b2d-3773-4b5e-bd40-dab3850a61d7", "comment": "Malware payload (Amadey)", "value": "dca5886fb060e8a1c9079b3ba7c3de7b5dc295e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160668, "uuid": "b157515a-551a-4195-a692-1bb742b07c58", "comment": "Malware payload (Amadey)", "value": "5f9059cea591543decfa08b949d02705ecb43ee3bedb23bb98f7bafd1c45a30422abaca9a2206fa3c7ede1f82fbd4470", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160668, "uuid": "6371fe90-5970-4a8c-850e-fb4ac9affae5", "value": "T180C41216E7ED8072DCB527B058F607C70A397EB19CB8436B2355B89A0DB26D0A47532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160668, "uuid": "b7b737eb-7643-442a-8ff6-2c0295d335a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160668, "uuid": "5821acbc-1e8f-45c4-9895-3e862bb0c3f9", "value": "12288:oMrxy909AVFiy0t0hxXIoBqSizL9gBYC46ZxSRK0ox1j87v15g:5yxF2MZtkSiHWzliToxt8x5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160668, "uuid": "71038b9b-9a3a-41d9-807b-1355ea4ab431", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160668, "uuid": "317e4a52-3fce-4f00-b3d9-6aab504c09bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160668, "uuid": "e53f3227-caf0-4fa2-935d-9dc4151a6768", "value": "b2c9b1e0e5db64148f35a8c1c2b9dfca08ce61a26c22e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1160410-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124390, "uuid": "7996c006-5e7a-4120-a56a-ff2611c91772", "comment": "Malware payload (Mirai)", "value": "ea26f17662efbcb2fa6c2a4ab6230958", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124390, "uuid": "f746305a-ac91-42d8-9f2c-765c95b87e1f", "comment": "Malware payload (Mirai)", "value": "b33ec4e447e662b1d5d091d138535224cd99e34cd129212ba06b6ad282d25337", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124390, "uuid": "2d2467d6-c203-458f-864d-b96df79cb997", "comment": "Malware payload (Mirai)", "value": "d122c82b3d6a4513e591ff5eba5443b5c27a360d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124390, "uuid": "99fabb7b-5ae9-4583-b14b-6292634b392b", "comment": "Malware payload (Mirai)", "value": "d6df80f915188c157e22533f73b587388380bccef118f8dba29a16b1e71d9fa77c5ca8712f2e199bdfee4a4bbe81e080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124390, "uuid": "a551a9cf-8aa2-4e02-9fd2-23a409f26ff4", "value": "T1D2F2E1D195A2B6E0EFB53C76FC78009AB3441DF5D3A738F0BD086250E8DA50B6239326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124390, "uuid": "cd0dea63-dc9a-4abf-bfb3-213f963240b0", "value": "768:IHQwa/BU7hKmme3WocfqEyi0lHPkQJKmXi3fgJq3UIxK:IHrCBUkmEo5wEAfgm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124390, "uuid": "77033b77-033b-454b-b8ef-a78da02e2307", "value": 36024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124390, "uuid": "6c6b03c1-ebb4-44d5-93a8-a457747fb457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124390, "uuid": "51c8a578-4de8-4d67-9aa8-61a0f713ee87", "value": "ea26f17662efbcb2fa6c2a4ab6230958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07940abd-325c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691108134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108134, "uuid": "ee71f9b5-0d9b-45fd-a351-1e23714ee9bc", "comment": "Malware payload (Amadey)", "value": "550d833f70c45aeb0e6271aa8b65bbef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108134, "uuid": "528fae3c-af4f-45c5-9411-510c2bf24202", "comment": "Malware payload (Amadey)", "value": "b3a89c0045d7b2451bdde11247e497fbcb5390367dbb0c1d310cea76d878ec2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108134, "uuid": "a9b48f8b-1ee2-4242-9bec-253b0cc58738", "comment": "Malware payload (Amadey)", "value": "ed9280785597ac60717f047ea354fd2bf0a0a8e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108134, "uuid": "7e125c4e-f437-40dd-946c-025508e0ae1f", "comment": "Malware payload (Amadey)", "value": "0e43f821b7b74430dd3d0aad6f11fea9223f307d89b009ca4a4789ea056839eee2a9e33cbddc21e667f9c9cedf01d94f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108134, "uuid": "0a50346b-8c08-4227-bff7-4d93c19acc52", "value": "T1DBC41293F2D89037DDF117741CF603E30A39BCA299B8535B2215896E0CB3695B472B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108134, "uuid": "f7ef4f59-0ae0-4e6b-8144-cedf31e48cce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108134, "uuid": "06abf0ef-6d32-4fdc-852b-0466a9674ab4", "value": "12288:BMryy90CfUut0plvh3i2myddsi/FPSXt:DyNUJhh7myrsqFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691108134, "uuid": "6877aa0c-0d23-4f80-acbb-fdde1e7a9a2c", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691108134, "uuid": "d0d15417-ee0e-452e-90a1-2859e404644a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108134, "uuid": "a1242a6f-f3b1-4232-b786-0c89ef5f7410", "value": "550d833f70c45aeb0e6271aa8b65bbef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348f4720-32c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691153736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153736, "uuid": "2896f4cd-a1ea-4460-a983-a66d7d606563", "comment": "Malware payload (AgentTesla)", "value": "d8fd920b04b3e64bd6cd690edbf18a5a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153736, "uuid": "8548c4e6-e3a6-4564-aa18-7d3c5f940fc8", "comment": "Malware payload (AgentTesla)", "value": "b3fb3ea182da19c8e66b870740d3e954b709c507d2dabee80f5f6975bc4fafe5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153736, "uuid": "8489541b-acf6-49ab-8cb9-f63bd5e77aa1", "comment": "Malware payload (AgentTesla)", "value": "47614db6190e6962ff3a328560b0c06bc50e6995", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153736, "uuid": "86b781d6-f798-4aab-9142-5999895d3c8c", "comment": "Malware payload (AgentTesla)", "value": "ccc4f046efdf28c1d8358ff3501dba0b0805bee07228c7cd24d08d63c50932ec338aa1bdb4dfad851f80605dec860b98", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153736, "uuid": "8f013034-5e04-4964-bb02-091fbf2062f5", "value": "T1672533EE61907B0900F1D045C0E29CFA4EC4796452ED62BE6C64D3175F98BED3DA2DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153736, "uuid": "9f3f4bac-b7dd-470d-a2b7-3a66cd8006f0", "value": "12288:b/dARE9F5h5Zcqn6TdRaVvAtCS5ohtWok1PKaWXlAnT5OvMd/bf1wA45H6MhmDt4:bl55lYTGhtWf1PnT5OvMZLKItiKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153736, "uuid": "debe86b2-c1f4-4f00-9574-69d27360c2a8", "value": 1049456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153736, "uuid": "2aa5b533-5475-4ef9-ba5d-5d630469c86d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153736, "uuid": "01509d56-9877-49e5-94b5-21f58b8d904c", "value": "IMG-02873009pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4188da4-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691149333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149333, "uuid": "5efee376-09f9-4d4d-aee2-1d2c215bd664", "comment": "Malware payload (AgentTesla)", "value": "ee60b722a04cee171d80e81183d7a2c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149333, "uuid": "56cd8e61-14eb-4f9c-87eb-cbf678552181", "comment": "Malware payload (AgentTesla)", "value": "b51bd97cffc17c646bf7a7fe17879d7b3bf1504ba1da5af379f301058e530a83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149333, "uuid": "5d79d0d5-7dbf-4e14-9238-cc8f9ea56ebf", "comment": "Malware payload (AgentTesla)", "value": "6f079a616330b9c92f7bd2a192bf3112fef92877", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149333, "uuid": "3402164c-73fd-4594-9436-2b2e26129ada", "comment": "Malware payload (AgentTesla)", "value": "d8381fbe48813c33a050829194031962af595b7933cb8a4dc1d3689885e52b4e1302ab05f1fea247295d2d25e52af929", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149333, "uuid": "f281bab9-5dce-43c3-80e4-3f73496217fa", "value": "T154F423E2D8A609D7FA614D5FEF3884744A90EC5B686067BB4221D3533F283862DE3764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149333, "uuid": "96fca3f9-5adf-4c65-a8c0-a254e5365b07", "value": "12288:Pm2IR2t6lzgDmduopwMun6eiNhDxgT2VWhmVXdNFyfrh+adYJR+yz8sk6ofEOp:O2IR2g8DmQNd6e8YT2VW6XdNFk6JRjTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149333, "uuid": "492dacfc-d9b9-4ef5-9867-9aa43517d65d", "value": 751697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149333, "uuid": "6f10ef40-1377-4256-a73e-ef60b730425a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149333, "uuid": "846a9e3f-7374-4181-aab3-a856b8eb80fc", "value": "Order N\ufffd TM23-08-04.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbe11a1-3313-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691187089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187089, "uuid": "1240607e-88eb-4851-b442-b47631cb9506", "comment": "Malware payload (Amadey)", "value": "1c2782c187920b85dde7418a2bbaa3f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187089, "uuid": "800d7abb-c585-49fe-9986-03fb7861cbd7", "comment": "Malware payload (Amadey)", "value": "b54fb51aea174c5933aec6b9964fd7f01c0f0029d743509e4acd72e245be14db", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187089, "uuid": "3d11c6bd-4f2a-4cd3-b2b0-57d679367a8f", "comment": "Malware payload (Amadey)", "value": "99c4dc55f1e39cabc159e378c150e9740d301635", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187089, "uuid": "3d5609f2-52e4-4561-8cd8-91e6b4cb6361", "comment": "Malware payload (Amadey)", "value": "3425ee159dacc61c3c393201b99363184196fda2a163761706c0d9d9d6ce6eddf6f63855085e7d942f6ee723301722b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187089, "uuid": "c1b27326-fd0b-4fbb-a88d-4e56b759ec7b", "value": "T13403F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187089, "uuid": "c1fda7f0-f4fd-43d4-9d36-0e81a875b2e8", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691187089, "uuid": "9f954db9-57f9-44e5-9fd6-ee25908771de", "value": 40341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691187089, "uuid": "621bb1d9-6315-4eb8-8953-7c4d6f5f8fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187089, "uuid": "244381f8-5391-4544-a0f5-79a4e00c64f2", "value": "1c2782c187920b85dde7418a2bbaa3f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296298a2-32c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691154146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154146, "uuid": "88676c00-2f20-4a29-a20f-fca7adda3347", "comment": "Malware payload", "value": "b7c9ec7874351ef148c403cc2c36ac12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154146, "uuid": "1efeb2c3-d6c2-4809-8105-4794683ad189", "comment": "Malware payload", "value": "b5b7a45b2146589fbf696c13967f6d35c66f382e981ca6d4b9612ea6ff2252b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154146, "uuid": "210d5f0c-4d08-44b8-ab94-ef5fb24315e3", "comment": "Malware payload", "value": "02fe1b7ee6467775bd273cacc86a0f8cfa4d639c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691154146, "uuid": "47259cf5-1d1e-4c8a-b5f6-ca48b0845945", "comment": "Malware payload", "value": "14d410e3c2e6b14680e8bb4df7f8a7d7921c79485538d490a33bbe2e274e88b4dd3b3b1f3e153fb46e07afcd75466a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154146, "uuid": "6488c833-3ed1-4302-94e2-ee85173bf471", "value": "T1DD7412A4A69084AFEBEA47F030761C16CEE66D3514904247F7487D2E3677D83B82BE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154146, "uuid": "52ded7ad-af27-45d2-95ac-561de3997e7b", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154146, "uuid": "9672dd98-9649-46ac-a15b-87fc2b84ad7f", "value": "6144:2QLFhJTon++vSyp3qC62ydW+ng0X7uy4G99GXX9sueYv+ELUpeW6OVe//+qgVL:bFPToKu3qCJcW+gw7kBXNsuRvV1WZW/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691154146, "uuid": "190aff51-200a-404e-a993-9c6c24e12f76", "value": 369504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691154146, "uuid": "f1fd1504-1249-4894-9906-ffa5df8f0a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691154146, "uuid": "da4e915d-f9dc-4745-9c77-6f0bf5a8c152", "value": "Updated List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472e8a4d-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meduza)", "timestamp": 1691124132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124132, "uuid": "c5bfcb2c-24ff-42f1-97ab-9f4600e4053a", "comment": "Malware payload (Meduza)", "value": "a490f1848b792df4dc37c9e1b200578d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124132, "uuid": "f81e3c7c-f64b-4924-9224-9dc4ce06f84c", "comment": "Malware payload (Meduza)", "value": "b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124132, "uuid": "e6ae63ca-75ea-419a-b3be-06a2f11202cc", "comment": "Malware payload (Meduza)", "value": "f862b1f3460aafd54b1159b2a180f70e6b3d8d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124132, "uuid": "30ed73d9-1704-4b03-98c2-9cb2e360d0d1", "comment": "Malware payload (Meduza)", "value": "8ecfdc15865abddcbf5d2c7a194522e7a931eaabe7a407a53082c12af6a82396c521f98dd98d4b19fd117a4015b96fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124132, "uuid": "ec988bcb-e29e-4476-9897-f39ab71b438c", "value": "T12E35CF88DEB608A4F6D65AF75C7B49029730A90D1B609F8F0B2C523E9F631D1DA17B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124132, "uuid": "fa0392ac-f094-4a4b-b112-3cb2a8518e8e", "value": "4dc7a7765a97318d45b0210b0d408b04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124132, "uuid": "17c28b4e-5a67-455e-aea3-c30f1ca150ad", "value": "24576:mDXdMCbh0lhSMXlPFN3RFEuHhra2oQfKhBdY7O8gz/7:mBMPt/G29fKhBdYy8ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124132, "uuid": "00df3314-80a4-457e-83f3-a4ed7ed4191d", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124132, "uuid": "597cbfcb-fde4-4f5b-8acf-a6598fa3e7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124132, "uuid": "bf6bbcf2-77c2-4a4a-9be8-6b21bbe3b023", "value": "a490f1848b792df4dc37c9e1b200578d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a2cef7-32c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691153550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153550, "uuid": "0b7bec8f-3e23-47c0-ab4a-0b03b1cf0f87", "comment": "Malware payload", "value": "fa9b47b581c61a13ca234c73d153017a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153550, "uuid": "174172b5-e10c-4b47-bd3a-d0ecce4fffb3", "comment": "Malware payload", "value": "b6189bf75961f24005c8a1b4921a2dffdadec6cbd7a047ee722e3429fb33b361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153550, "uuid": "0a0b1feb-6eaa-4800-8bb0-4763b4609f95", "comment": "Malware payload", "value": "11bf5965bac649ce44e91eb03a9ab8fdffe78a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153550, "uuid": "df92ee03-dfb6-4343-9666-c713a182af59", "comment": "Malware payload", "value": "0df7d13f26c3903390e39b135dd523cf4d6c1ed741fb226a4b5a6b9fc9718f9b5fd843e4e16307dccded9aaa962942b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153550, "uuid": "c22a7855-b4c9-4f10-8b27-74e0b63ffcb1", "value": "T11F742406251A656FD7AD3278CE4B268F0FB2D74AE3D04387B548A8AB4961527DC0F3CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153550, "uuid": "dd5fbfa4-46a7-41f8-93ef-e78dd462a9ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153550, "uuid": "a54aecb4-3d4f-4f9e-b728-5445b8b1cc9c", "value": "3072:pxrU91powwfyMhOskC6EhUUWhNQl13i9pxNTF4vzX55e:pxrU+n6E1WhNuApfqvr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153550, "uuid": "e58be0f8-fa6f-429d-b6ba-d2e8f04ef6db", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153550, "uuid": "587472ab-d8ec-4a4d-ab1a-eb0e1d278bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153550, "uuid": "611178d4-2543-44bd-8ff6-a4c57e0f5229", "value": "vt_b6189bf75961f24005c8a1b4921a2dffdadec6cbd7a047ee722e3429fb33b361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7633a844-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691124211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124211, "uuid": "425112b8-92f0-4c74-9b3c-b07f0c11cfaa", "comment": "Malware payload (AgentTesla)", "value": "dfc61c4f031345d5c793a864d44f8506", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124211, "uuid": "d2f8991b-3210-4c17-8c30-cca17cfd1f6a", "comment": "Malware payload (AgentTesla)", "value": "b651dc641aa8f49807d8427371d1896f700382a10826f04d4451d244b1112185", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124211, "uuid": "5a74a49c-6f34-4466-bb99-6e2c4dea5a1c", "comment": "Malware payload (AgentTesla)", "value": "17fbdec5b22393f96205835555c0cd6059bddc5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124211, "uuid": "7f621434-81b9-49ce-b627-97c307a93acd", "comment": "Malware payload (AgentTesla)", "value": "e8ab21db9282d7b0201cb6f06e96489f53aaf8cf205f49a8de7dbc7d33b191a73afbb21cfcfba12a0e2e2baf3739009a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124211, "uuid": "c31f819c-2f62-42ed-a79a-264f1c2aca21", "value": "T1BD850103D8048B86C50D83F87E533DD94A0D7F26B4DA7DDB06527F9B3A32A67892A50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124211, "uuid": "df61234f-7710-441a-a632-8c45ebd7106e", "value": "49152:RQmmQ30tupp6VJQmmQ308506VkiNhv3tK4X/nxgk6K/0:RpmQktamJpmQk3mkMhT/D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124211, "uuid": "1c3ee875-a1c5-4da9-813b-ce20e761826f", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124211, "uuid": "e70e870f-813a-45ce-9ec0-ed479b5335b8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124211, "uuid": "5824f8a8-a892-4040-afc1-67219639d063", "value": "Inveho Lista de orden.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570eade6-32d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160666, "uuid": "c0968825-9f0d-44d3-9fec-5b75585c8b98", "comment": "Malware payload (Amadey)", "value": "0c89847e84335b61558a69555d37d965", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160666, "uuid": "55c2daa5-769a-410f-8337-fa983fe487bf", "comment": "Malware payload (Amadey)", "value": "b8fd2eb2fddf1cf0980311b8fc6479b409b231ff5e65b2c9599f4ca885220e7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160666, "uuid": "111dcc9e-6d49-45d8-8a6a-f5d8d604c7b1", "comment": "Malware payload (Amadey)", "value": "abae2420e321a935798cfd76cc8c962462ed3267", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160666, "uuid": "bd03cd86-100c-43f3-8091-23036c4fd73b", "comment": "Malware payload (Amadey)", "value": "237242c7be19d97bbc4a7cb98b165f00fc2cddd24102f0df60f4528fb40f7d70f54f67a51974fea4878e90727d4f9230", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160666, "uuid": "ac0492af-861e-4188-895c-ac65007702d4", "value": "T1C7C41256B3E88172ECB11BB018F703C70A367D66DD39C3572396A81D1CB3298697636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160666, "uuid": "b77d5fbb-6899-42cf-9135-6ac7a1c193d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160666, "uuid": "17264115-be8a-4989-9eab-4b27506d6daf", "value": "12288:bMrsy90FOUhEV9frKxCrFIf44bgBYCUf+leyFsYRBjO:XyEKWxCrpzzplxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160666, "uuid": "5f9acf62-19a6-4bba-803e-369695f7d7bf", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160666, "uuid": "c50c11a2-3462-44f8-ac29-7f2e9e09e43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160666, "uuid": "51424af6-ff3d-494f-993e-b5db1918489c", "value": "0c89847e84335b61558a69555d37d965.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25232ae2-32d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691158864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158864, "uuid": "57ec2ba9-b6a4-47b8-90de-bc20bf68fd49", "comment": "Malware payload (RedLineStealer)", "value": "05eab9942632ec70d5e94c4028fb4a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158864, "uuid": "f758c002-0bbb-40f0-b65c-feff3b774cc9", "comment": "Malware payload (RedLineStealer)", "value": "b8fd3283514925165f9d0bd7739e5469e9862d3af6b7b1ef39019ddf4e8c84b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158864, "uuid": "7172f055-8393-431b-9527-cb548c59c5c1", "comment": "Malware payload (RedLineStealer)", "value": "469f58388e6d525c4ebf56a95f3832b5f5c2e852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158864, "uuid": "c0730d61-9c31-4668-894e-7cd68ff98306", "comment": "Malware payload (RedLineStealer)", "value": "d6733a107590a32c864600f12240b290f2548c5bcb3f78f80e7a05e96890b8eaab088a2c4e8a553b78ad678a7e8f0018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158864, "uuid": "556ad5dc-5625-4613-9539-5763d66f039f", "value": "T1E2E3E428279F8930D6BB4E3D6CB19CD076BCEC526942D74A4ECCF1593A73B809B116B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158864, "uuid": "6c2c1e03-e83e-4261-a3e8-ef668332cde9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158864, "uuid": "58334d0b-9d6d-44dd-b55c-4b97359207dd", "value": "3072:PV+m5chQmRSZ0TzdZOa7tnyrhtZ58e8ho:PjE/DGrhtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691158864, "uuid": "4062815e-bfb2-492f-9b16-9a2d190948f4", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691158864, "uuid": "ad8b98f6-fb59-4810-b9c7-575efa14ae45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158864, "uuid": "75d4483f-e4c2-471b-a8b3-b8850bd88515", "value": "05eab9942632ec70d5e94c4028fb4a56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4212ca-3322-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691193398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193398, "uuid": "e1d59de3-893f-4ec6-8946-96fc44fa8301", "comment": "Malware payload (Amadey)", "value": "1523cfd7446a8c3602043d582b036a8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193398, "uuid": "bf3b969b-cf08-4a5d-9a5e-5fefcae8c6ab", "comment": "Malware payload (Amadey)", "value": "bab29d219904207c2da9aa73a26eaa3cabe573da7457a871046ae49b83dff7da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193398, "uuid": "85933cf4-0f49-4027-b491-4a691ca01dd0", "comment": "Malware payload (Amadey)", "value": "f04e9ea24aca321ae8e2c8f7d3936701861908b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691193398, "uuid": "28c25050-4c98-4c71-b8aa-1d58df968b66", "comment": "Malware payload (Amadey)", "value": "56c747c5e3d1b8c8fc51516bde5fa02579eade3d5a7549da743b1b2579f9fb0ed05b975d698029f8bfbf2bea45ad9119", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193398, "uuid": "9eb481c2-a0f9-4f0b-9fb5-b54691a4330a", "value": "T1A303F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193398, "uuid": "f3da295a-60c7-47c4-aac0-53cf2b3eb7ad", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691193398, "uuid": "97a17156-98fc-4637-95f3-3e270156f48c", "value": 40153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691193398, "uuid": "a7e3f1c8-5208-4e33-a384-7beb08e7d92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691193398, "uuid": "d750b2a2-1dc5-446f-95e8-d918cec8b65d", "value": "1523cfd7446a8c3602043d582b036a8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cce996-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124401, "uuid": "238a79bb-2122-4abc-bc31-16b4d0f3972e", "comment": "Malware payload", "value": "e6465dacad68e26c0ba5c351b6643619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124401, "uuid": "fbde55c9-b758-40bf-ac51-b0607846de1c", "comment": "Malware payload", "value": "bb0b1164e605e4ce71e7a1f9ddf5bf91221c93ea86ac166e3b1918efa617c117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124401, "uuid": "2ae753da-7360-4869-975d-f3a63153903b", "comment": "Malware payload", "value": "d91962038fbb120c2486daec81fd70f775fcb99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124401, "uuid": "b56ce71e-94d0-4064-bfb5-0a682a1a342f", "comment": "Malware payload", "value": "6f1e9f2246c06a8bc1dba74e055038fa1ce726ed9afbb6f13f30a70618b9db7ffa941cf459a31b0cccd19e8e371b1f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124401, "uuid": "f3d8bf17-3dae-4c09-be3f-249f3cb9a84e", "value": "T1F0E40128736DC927E53D96F594F2A66803F2788B1C2AF2EC5CC125CE21FAF445601B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124401, "uuid": "d7ac5585-6a11-4849-ba91-22dc41116e44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124401, "uuid": "cefff7b1-4b2f-4ef4-b9f2-a5317c00f4e7", "value": "12288:InjOMxnVhS1rmbQLqgBmh6rK96A2OQXmnwTpWISdBlk/hrtg+DY0T:IjOMxVhSBmcXBtu32GwlWISLlkXg+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124401, "uuid": "a04df942-5290-4ffc-9557-e401210416e7", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124401, "uuid": "a9712745-41f9-4b81-ae31-e0e832275471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124401, "uuid": "68dfb96a-985e-49a3-bee8-0206590a4de4", "value": "Especificaci\u00f3n de pedido (0094-20230803).pdf(58kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c316d415-3318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691189194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691189194, "uuid": "7aa8b45c-3177-412c-a578-49f5c6e6cd5c", "comment": "Malware payload (Amadey)", "value": "6cb6333d70d00edfd6e30d9e61056095", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691189194, "uuid": "86cf18fd-3b96-4114-aa72-09a18b0f4c53", "comment": "Malware payload (Amadey)", "value": "bc676ec8cf64524d0756e2bb1d6ef4518dd2f4a66d6a35147282779f436707ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691189194, "uuid": "1fcdc320-0000-4d11-a48b-b9fa6a2caab0", "comment": "Malware payload (Amadey)", "value": "91053382b3f43297845da49495a90b5997a843da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691189194, "uuid": "e47a36d4-9bde-482e-822f-d036147e87e9", "comment": "Malware payload (Amadey)", "value": "2f6b65ec57a3f40329ff4eb0b65a0a42c2ae662958e47d069e8a1becc500cb0ee79f08ca861b8c71fce77154c8f914b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691189194, "uuid": "484abbc9-bd54-414a-97ef-32f032cdb37f", "value": "T11DC40222E7FD5077EDB42B7058FB12C31A3A7D20D874876627966D064DB2698E0B132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691189194, "uuid": "039f6303-c5ac-43f5-ba47-a85b96c3060e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691189194, "uuid": "b9fa28f1-e5d1-4941-b49d-dfa6bc6b8c94", "value": "12288:6Mrqy90cOqkmwjHw0mAoS6A/cHVGaS0SY/CMO1PqOH7alOGAkT:EymbjQx3SvAps71yqi9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691189194, "uuid": "8c6a279c-db28-4046-bc9d-deadd54097e4", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691189194, "uuid": "034131a3-31ff-4546-b934-c160d7eb772c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691189194, "uuid": "cd8353a4-484b-4983-99db-971d0c986c8e", "value": "bc676ec8cf64524d0756e2bb1d6ef4518dd2f4a66d6a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d4003a-32b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691146247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146247, "uuid": "149b2904-3627-4f31-bbdf-4bb6acf739f7", "comment": "Malware payload (Amadey)", "value": "ad432d876fc5ecf72d966ef81b6323fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146247, "uuid": "893c9a3b-bf63-408b-ad87-af3499d77436", "comment": "Malware payload (Amadey)", "value": "beb58f87013fde5b6791ce6200a5cc123dd67a8129e643d6dcf6319c800b203a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146247, "uuid": "2b286474-5175-466f-995f-5be77b70752a", "comment": "Malware payload (Amadey)", "value": "6149760173988a6a85e1ffbc7a193ae4d27621d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146247, "uuid": "7ea0c728-547a-4229-bf25-b143231138f3", "comment": "Malware payload (Amadey)", "value": "83f45ef9a50a8147b5cc27b7c70e56a8cf42d3436d0aa9aa1b86d1fccdce510555ca601a68902976f4d2f9ab7f4e6075", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146247, "uuid": "fe2321b0-37a4-4230-b564-8303a8a23a94", "value": "T10EC41257A6E980B3D9B117B058F602D31B39BC969C60934F27899E5E0C72BC4E43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146247, "uuid": "441463ec-bc8e-4194-b22a-7c86913d5afb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146247, "uuid": "0d449bfd-f273-4dd8-97d4-0ba1e3f65939", "value": "12288:2Mrcy90jOLwRs2UdinqtLDDdbiImWV6wW:WymOLCUUnkvJb/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691146247, "uuid": "f022b31b-9e0d-4ebc-8a84-b196125dcb17", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691146247, "uuid": "65268fad-ffb4-4b33-ac99-abdb6ed4bd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146247, "uuid": "1bcac138-6bcf-4e30-8e73-0f38dda0a6d5", "value": "beb58f87013fde5b6791ce6200a5cc123dd67a8129e64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7839308a-3312-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691186491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186491, "uuid": "cef0618f-fb9f-4928-a90d-3ec008df4c2c", "comment": "Malware payload (RedLineStealer)", "value": "5393a146f9c3dadd50591613f2201e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186491, "uuid": "97dbafbb-f623-4d19-9d22-ed0f286ce5be", "comment": "Malware payload (RedLineStealer)", "value": "c1667bdc914e017fc8e903bdf65efe7f194a78d9d031d8af0640f9bf689bb999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186491, "uuid": "15c1bd3d-3462-4692-a79d-36832d0ce60f", "comment": "Malware payload (RedLineStealer)", "value": "b3d7cdbceb826263780454a146a1c74504a89336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186491, "uuid": "9aba89d8-c43b-4c71-be28-e8df73f2b376", "comment": "Malware payload (RedLineStealer)", "value": "0d766fe047a23edc1a25ca80eb6c4a96ba3e3574dfb3402b5b2fa48cc76b59cbaf1a7402371453237a424e7537d9ff41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186491, "uuid": "fbb021e2-b30c-4ef5-961f-cceffab20ab0", "value": "T1A4C40212FAE8813AE8B133B0ACF702931E36BD619D7492272781594F1DB3795A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186491, "uuid": "ab799909-b3c3-4378-bcbe-f488a8fff1c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186491, "uuid": "8c86890d-a595-464b-8976-430117879571", "value": "12288:wMrey90IadtMS8ggHD07w45PACtKbHPgrz5BJ1xw/c:+yop8ND07w239z5J+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691186491, "uuid": "7706117e-11b3-4644-8857-e5fef33c6342", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691186491, "uuid": "43deaf5f-ef50-419b-9fdc-818a8eccc410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186491, "uuid": "b1dc123b-ffcf-47d7-96ca-8fb08c245fca", "value": "c1667bdc914e017fc8e903bdf65efe7f194a78d9d031d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9279d6-3300-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178662, "uuid": "44b871fc-c121-4e18-8632-65e57688f48d", "comment": "Malware payload (RedLineStealer)", "value": "3357f1bcd5b20ea8fe592410318b0621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178662, "uuid": "aa01b04f-4e24-40f5-acdb-259d3237556f", "comment": "Malware payload (RedLineStealer)", "value": "c3a7bf760ea0be8543861c70bea5a5b7523cd243e0e5fbe1a573ab476422d5cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178662, "uuid": "b8a990cf-ebd3-4ac8-99f1-442b19103cf1", "comment": "Malware payload (RedLineStealer)", "value": "4722afb03aa7a255c8d9cfb29445516dea93b3e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178662, "uuid": "6bb9f093-0c50-4bcd-8269-54a609a9943d", "comment": "Malware payload (RedLineStealer)", "value": "6691bb27b9b194bb54c7a493d2ddbd45a9c019c2ceb1ee5c6a43011bd7a763d7fe54fe95c78d81631832b5ccd0daf301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178662, "uuid": "7155f950-543f-4c67-9d5c-e45e72664ae4", "value": "T19CC41211E6E54473EDB52B7018F613831B36BDA19D7483AF2341AC5A4CB3681EA7237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178662, "uuid": "8449f371-802d-466d-8ccc-3f4cf89cf462", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178662, "uuid": "113823a4-545f-45b6-a634-afb869a39d0e", "value": "12288:RMr2y90GJSEvDZI4suW+PhctBq9XHSPVJ/NC9xuoF5tLsuNs7dpwT:nypJSEbet+PmkUlkuU5FKXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178662, "uuid": "fe975375-9e16-49f6-87db-5d15522187fb", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178662, "uuid": "c88ce0db-e079-4057-8e46-eb0c431ab6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178662, "uuid": "cf796aff-5d4a-4d7a-9001-d56ec6317447", "value": "c3a7bf760ea0be8543861c70bea5a5b7523cd243e0e5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47428bc-3285-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691126140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126140, "uuid": "be08dd38-c787-4f4d-b94c-8348a294a82f", "comment": "Malware payload (RedLineStealer)", "value": "8c410a147798d5f12237b593d50cd63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126140, "uuid": "a3187869-ceed-4a34-92a2-b43aaaee457f", "comment": "Malware payload (RedLineStealer)", "value": "c3e7acaec9f0c86e50fa5f6d688b4df4c71a972aa5bababbbd2812f3473460aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126140, "uuid": "f1b100ff-8d83-49b5-a01b-e39fe2db2469", "comment": "Malware payload (RedLineStealer)", "value": "e69b16d1d1799908e9d8c34c48c8e9ab1dedd98d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126140, "uuid": "2579444d-4d0f-4410-9fbc-3fabf2b54cd3", "comment": "Malware payload (RedLineStealer)", "value": "1e0c5d2d42654e60b84a26bd63ef600ce4a24c233df86c50fc1f7f27619c8d6e7bc47ae6d504855d8cf20f7b0aa20819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126140, "uuid": "d8587897-0d3c-4fc6-a86f-d450dd66652e", "value": "T19FC41223AAE89473C9F5577058F613D30F3A7DB18934432B3698991E0CB2B98A436777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126140, "uuid": "80f9e4b9-48ec-4596-be2a-5ba851c90c10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126140, "uuid": "b47b23db-78f2-4358-a640-1b0b17cc5ac7", "value": "12288:cMrsy90BYxeIkHizKJDh0Qi7sNiUTXqAq6RM:AyquevHIKJDFi4NvTRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691126140, "uuid": "a6b360cc-9bd3-4955-b037-8cc5f4782bfb", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691126140, "uuid": "c8a42f20-3eb6-47bd-98bb-51c12fdba621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126140, "uuid": "81606892-155b-421f-a873-3f5f2b2b151d", "value": "8c410a147798d5f12237b593d50cd63b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86e6b4a-32d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691162171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162171, "uuid": "016535fa-f55b-4d43-9c4d-114dc49cbb20", "comment": "Malware payload (RedLineStealer)", "value": "339e43e2c62eb8b40ed5d4f7ac2a19f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162171, "uuid": "bd78b343-4885-4db0-9cdf-c15cc44a3ed2", "comment": "Malware payload (RedLineStealer)", "value": "c4361b458fbf494fee0388aee7fe581ffb9d340a56c6314f9053a54d3b81cb04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162171, "uuid": "c80f14b7-667f-486f-a7ac-e7998a36b672", "comment": "Malware payload (RedLineStealer)", "value": "9d349bc2f7639b4e63ac57056b3431924267ffef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691162171, "uuid": "7c1b9b71-8016-4c80-8f98-21f3f182bf35", "comment": "Malware payload (RedLineStealer)", "value": "813ac530129679c2d114d28b7304fbcca274f69712a90c346607841ce766d4c9c860238c7272d5343daadafe9e4c88e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162171, "uuid": "e6ca0add-8869-4af6-95e7-f3b664d6bdba", "value": "T1B3D41207F7EDD531E5B557B048FA03D30F397DA59978071A2362684A1CB36A0A07AB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162171, "uuid": "4a1fe2ad-42a5-4e8d-9dfb-0c42ca3b8359", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162171, "uuid": "91e0a299-5b0e-400f-ac29-ec49da683141", "value": "12288:IMrry90wDXywfsJB7+uOkspuXXz+tYwS7eh13o1w5WZ6SHJx9bChWyBRF:DyX5fuB7+uOtiKtYBwmfZ6Kv9bCHBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691162171, "uuid": "2c830c41-255a-4b17-a26d-39e909702fd4", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691162171, "uuid": "747b19c4-1b41-4b0d-b47a-7ddd0b5d07d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691162171, "uuid": "f0f424dd-dbee-40fe-9b26-bab2cab395bd", "value": "339e43e2c62eb8b40ed5d4f7ac2a19f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc749b7-325d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691108733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108733, "uuid": "ba524aca-f1ce-49bd-a57b-2f26dd23ff02", "comment": "Malware payload (Amadey)", "value": "6cfa9204221a829fb26bdd351c9680cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108733, "uuid": "39de691f-5bac-425c-9fd8-aa3963b2babf", "comment": "Malware payload (Amadey)", "value": "c500dce7b0fadc2e18f56a0f2d1bcdec4cfa9e1369c5a7eb162547e9d3c4cd7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108733, "uuid": "88038246-c7a7-4172-a578-073ddc20c043", "comment": "Malware payload (Amadey)", "value": "78b5a81da0f86de63ba242cacbb5a1f3bdc0d7a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108733, "uuid": "b843dff1-3577-42c8-9a30-e00d6afd1c8b", "comment": "Malware payload (Amadey)", "value": "77f9d80a00daa4cccc9b45318851665a1be8e76d3305d7497f23e08e317c0f74ee2dbe44416caa81513f567e8d852492", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108733, "uuid": "92c0765f-5b80-4c48-b78e-568a43d3d5fb", "value": "T12EC41213FBC84073D8B527B028F606931B357CE05938936B3746A95F09B2B94A97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108733, "uuid": "00f10703-e7c6-4f03-8286-581351f419b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108733, "uuid": "68ddb093-1b3c-46c4-a1f5-f7bcf1ff96e3", "value": "12288:gMrmy90xJNKWjyX50toJxYEW4qV2mWy0C4iiIe:WyWVOpeoJKEWR2Byb4Ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691108733, "uuid": "5a60de3d-c60f-4634-936e-903da975fbdc", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691108733, "uuid": "60815839-d3ef-4123-9719-438bcbfb7b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108733, "uuid": "9176b9d0-7158-42cb-ae72-19986629af6e", "value": "6cfa9204221a829fb26bdd351c9680cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2ceef0-32f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691172938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172938, "uuid": "2af52337-34b9-4044-b87c-4d989c0e1e8a", "comment": "Malware payload (RedLineStealer)", "value": "1b6ea5ad00a575e92393fd992e387458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172938, "uuid": "28af3ca5-bf68-4b69-8898-690f632ff7e4", "comment": "Malware payload (RedLineStealer)", "value": "c539e9540f3ae37d3ef545845cd0e9ecd0d05393d708a86cca4d1d12413e64cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172938, "uuid": "286d85eb-5144-42e4-b0e6-aad014ba9327", "comment": "Malware payload (RedLineStealer)", "value": "523893b316e42add49da1d4807c9b1c8c4c65c30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172938, "uuid": "0526f187-31cc-4f82-9720-b21def2db0a8", "comment": "Malware payload (RedLineStealer)", "value": "044289d0f84ce6d253d832f61351672a65ab7a349cbb6b58db6cecbefa03546e0c4ae6690bb32b362b8269ec3c6e4866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172938, "uuid": "19f8114d-4d90-41ce-8e43-b92d887fb835", "value": "T103E41213EBF55537E9B12BB024F607C30A35BCA0A9BC876F2385598D18F3280A5B5767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172938, "uuid": "0ef07bfe-f8e3-4ae5-bbf9-e0a216a84c40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172938, "uuid": "6e966b7f-b045-43b5-82e6-99e5033c95cc", "value": "12288:FMrMy90JAP5dgqKjntLaG8tYCQKlTyoeV3KQ60yW946OIXUHqFF/ElADNDutC:5yN5d5qRaBtvtVyoEH74AF/cADcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691172938, "uuid": "7aa2ecf8-4e27-47e7-886f-231f3c8a4b0b", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691172938, "uuid": "e5d29552-8d9e-4e5b-a25e-3e8e28a2c422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172938, "uuid": "099e1b2c-d4d3-4f44-943f-4034a3b3bdde", "value": "1b6ea5ad00a575e92393fd992e387458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aabf2c3-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691124111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124111, "uuid": "12d10e4c-f0d0-4311-b8b8-1cc9dfda061b", "comment": "Malware payload (SnakeKeylogger)", "value": "c580578c2d1d9203d43537f6e71a7c99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124111, "uuid": "31e04faa-12d6-4666-b48d-f7490e68ec2e", "comment": "Malware payload (SnakeKeylogger)", "value": "c545399c898bb75310af8f052aafc91e44893ff82905d80f3b449321b6c61489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124111, "uuid": "7790e5e8-ae43-4ac0-afbe-33d89d677965", "comment": "Malware payload (SnakeKeylogger)", "value": "ccff8d607eef5159e44fa349fb8fa7e8560600ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124111, "uuid": "97ae067e-fece-4126-92ac-085697ffdfcb", "comment": "Malware payload (SnakeKeylogger)", "value": "025feefe089a2e4f7bed5f61afd9cbdc6282539b171cbce5297c4ffae9f2d832411fed8ee3e53fbc3fe08d5802391972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124111, "uuid": "2d582cf2-ef6e-4c79-87ac-3339d0497d15", "value": "T155C4126962C5EB33F53E83FD64D6D9300B782D2A9401E70CADE5A2E72572FC60681E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124111, "uuid": "228899c5-61f6-4523-9b74-ec993ec37e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124111, "uuid": "80c8126d-0821-4876-9185-88fd9d09fc79", "value": "12288:2+15YQvjOuVfIQ3e97weN2LhB0iXmVDW0MDhYm5:2+1XOuv3C92LL0iXm+hYm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124111, "uuid": "27981ef5-1e02-4cfb-b2e7-10f105c70ca6", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124111, "uuid": "7770f270-4faf-46a7-b120-17c9c9e092c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124111, "uuid": "85b77525-0c8e-4165-ab05-4b3689ce3f02", "value": "TKSC2310596000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1413f369-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691130059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130059, "uuid": "7871fc4e-51aa-4773-9344-99ebd40d9474", "comment": "Malware payload (Loki)", "value": "a13ff4e61a88f566d2a00e087c69abc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130059, "uuid": "64fca2b7-bd1d-4ebe-8b40-e8a671df20fb", "comment": "Malware payload (Loki)", "value": "c59deadf5939e5ac8398383b8f160efcf44514fbdb08a06251a8bd4bd2fb2842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130059, "uuid": "fe9617dc-7966-4e31-9cec-3ddf3b900dfe", "comment": "Malware payload (Loki)", "value": "cdd45d9abec0bf88cc0d56a6871ecceeceed69e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130059, "uuid": "41ef83fd-f605-4ce7-b62c-417628b83f3b", "comment": "Malware payload (Loki)", "value": "6ff7d1984f91873bb43d48a29d4c29899c1459e2574a98afc68ceef17b11aeba0817ba484c7035f297927ae7b1e546d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130059, "uuid": "d2c93176-2a8c-497f-bc0a-81ff18370123", "value": "T124B412545088FF2EF12C83FA64D2E9327BF25D362815D3187CF7A2E599B2B860441E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130059, "uuid": "8f067d8f-a95a-4f54-886c-e6d9e6269bd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130059, "uuid": "7044745d-0ab4-45ed-8393-0b98c257cfb1", "value": "12288:9+10YQvjOOnWmmFemT3ngFueQ68JKpsCGUwsxzF:9+1KOOn4FeuTw8JKp3GUp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130059, "uuid": "396fd125-f234-4474-810f-6281111e0d70", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130059, "uuid": "d2edc384-3f92-4eac-926d-09b92795060c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130059, "uuid": "ce77e931-2caa-4abb-b41b-003861b46c71", "value": "AWB#2334578903123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5c65bd-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173241, "uuid": "c158b0c3-e5c2-4d63-87dc-d98f57b8c485", "comment": "Malware payload (RedLineStealer)", "value": "cc3baa5c7a16448cd1236eff73d947e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173241, "uuid": "b25cf453-d747-4ef6-af6b-4a99bfd1c127", "comment": "Malware payload (RedLineStealer)", "value": "c6176a82234cb105f7b60aec586c985596ac4bb0ea7f15bdf1e5f74821ead959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173241, "uuid": "5f902991-76b0-4f50-b32a-81ac22c78cd0", "comment": "Malware payload (RedLineStealer)", "value": "323880b68bd9ff9c8338256fa5a20052287b7b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173241, "uuid": "0f76832c-9007-40b0-9542-c7532386397a", "comment": "Malware payload (RedLineStealer)", "value": "a54100ced8b3b9ebecec1b69a6248b978112f9cf7a0d5f4d5324bee4d5c35a651f55121a7f87bcffa39489ab6f32f25c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173241, "uuid": "9fbe9dad-9770-4565-83b2-9303961565ef", "value": "T151C41216A6E84432DAF5677448FB06D30F3ABCA5CD74C2AA6781950F0EB3790957233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173241, "uuid": "e8db8f71-6183-469e-b515-3f0de7d2ccd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173241, "uuid": "b512887b-ba4d-4005-a6c4-53942cd1bdfe", "value": "12288:kMriy90D6KGfbkVp2PTrMT3EfkNSwoXidRLCQBnJsw7:+y66KG73Y0sgwoXOldJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173241, "uuid": "4bc6ced1-ac9a-4bab-beb3-9fe837c7c14c", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173241, "uuid": "d17a77f0-5f13-4201-a33e-24e0e3dbf74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173241, "uuid": "00e3e285-e293-4f92-9adf-b090ca4ca2e3", "value": "cc3baa5c7a16448cd1236eff73d947e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ef2f4c-32c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691153414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153414, "uuid": "bc088761-d05e-447b-ab19-fb50ffc664ea", "comment": "Malware payload (RedLineStealer)", "value": "d88ee271fca9cc237c2c5a8efcc744db", "object_relation": "md5", "Tag": [ { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "hiqsolution-com", "colour": "#0FC705", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153414, "uuid": "39268808-019e-4c7c-a74a-48550c84d508", "comment": "Malware payload (RedLineStealer)", "value": "c6a12db1ccea2fb030fd79dea7d4862425c84e8fbd898a7612cf2b3763cf5ad6", "object_relation": "sha256", "Tag": [ { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "hiqsolution-com", "colour": "#0FC705", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153414, "uuid": "1ea90032-de81-45d8-95d8-2a414c95bbab", "comment": "Malware payload (RedLineStealer)", "value": "e802cb7661b2cce0c8fa3092cfdab3f8a57bfd92", "object_relation": "sha1", "Tag": [ { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "hiqsolution-com", "colour": "#0FC705", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691153414, "uuid": "deae481c-5421-4abd-b72b-f8dd1946ea22", "comment": "Malware payload (RedLineStealer)", "value": "c3b5fbaa537277a13ddad3b8071c3ce8403d980ee4c6abc0770ebbee9711163028533c8be346e26d3458afc852d582eb", "object_relation": "sha3-384", "Tag": [ { "name": "45-92-1-85--10228", "colour": "#D2F77D", "exportable": true, "hide_tag": false }, { "name": "hiqsolution-com", "colour": "#0FC705", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153414, "uuid": "6145ab22-daec-49ad-b232-0e830be51bb7", "value": "T19843F5E30E44AAE877D5672EF65CA93937A11DB7043BEB956052D90B1312804C9EFCF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153414, "uuid": "12af9359-ad04-4aa2-b896-d5e53ba1ab7f", "value": "768:qhfNcM7zH/HMoMsnt8VeKF3s1s2u5HXF/ti6:qhfNcuT/HMozt8VP1qsNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691153414, "uuid": "afb99163-9368-4d2d-8ccc-5d774695a24d", "value": 57002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691153414, "uuid": "ee1d5f26-824f-48d1-bbe2-b030705842a3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691153414, "uuid": "8ce21e4c-6c13-4f64-b44d-011268866fa5", "value": "line.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906332e5-3314-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691187390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187390, "uuid": "d3d6f3c2-5904-496e-9e4e-975179e90543", "comment": "Malware payload (Amadey)", "value": "37bb2f4552a98a79c832395780ecc178", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187390, "uuid": "a1b180d4-9bba-47c4-934e-e27759a21c26", "comment": "Malware payload (Amadey)", "value": "c75011e37825e51e7d884caa4c01e43e0b3fc76d31b92624d83f64aebfbab134", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187390, "uuid": "4e9023ab-95b5-4946-8ff2-071a53bc1c92", "comment": "Malware payload (Amadey)", "value": "3f0cf99e58a9ffe47f1b687963220fe022ad15a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691187390, "uuid": "f4a33f5f-4163-44f9-ba89-5cb1b08e39ba", "comment": "Malware payload (Amadey)", "value": "237d0d29248f19e61da4cc9414ced11790be07d2fe4af3c3e98b4d67865a0418bb2350cb8e6a0e712ba8371208d219a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187390, "uuid": "2d494a4c-90e3-447f-88bb-e73a88f3e8c5", "value": "T14903F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187390, "uuid": "734c5379-28dc-4239-9b94-2b8fb565c2ac", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691187390, "uuid": "f3c1cf7d-ac6f-4438-8517-46a1ec267b83", "value": 40211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691187390, "uuid": "1e4166af-6815-4396-8449-8ef61d4326ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691187390, "uuid": "b28931f4-29fc-41b9-aee8-bb3df5fa3971", "value": "37bb2f4552a98a79c832395780ecc178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d65c268-330a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691182876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182876, "uuid": "13a80be0-31b5-4a54-8e67-3b7e65cb0dbf", "comment": "Malware payload (Amadey)", "value": "504ecf53bb60427e64fa913e98e5d497", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182876, "uuid": "aac4932c-54c0-4ed8-a4bc-30cbb355d63f", "comment": "Malware payload (Amadey)", "value": "c78baa78b2d265ece57d60a6527291ab2610f91a618560746c7f452a9175bf21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182876, "uuid": "be6f0228-0ad9-45d7-acec-a26184bfa78a", "comment": "Malware payload (Amadey)", "value": "0228fb0ce5cb08f69f8db02fc1f4cd4e3817a73d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182876, "uuid": "34e0b5de-3378-42d2-ab4f-b4682fce4f67", "comment": "Malware payload (Amadey)", "value": "c8816b5be6c74c5a01941fea24419576f1f7c0baf7ce8661207211c5dcbfe925ba2bfc1c7ac6fc695055726ee6aab0ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182876, "uuid": "a9d9b84e-bde5-49be-ac60-290350d7f467", "value": "T15CC41202A6DD8133D5B42B7418FB12870E3A7EF399B542A73381991E1CB26D0D97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182876, "uuid": "6de86958-3988-4600-8e4e-46bc57936166", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182876, "uuid": "e1bce2ae-d943-4ec3-8c80-5fb7e2317099", "value": "12288:LMray90SMwxKzuN2A1aBvn8lYPUk2AT9SLCPf:tyXxnN2v8OUc98CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691182876, "uuid": "1c7f9a09-926f-4174-a5d3-69a5121da490", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691182876, "uuid": "6aa8bd89-9947-4b15-a94b-d9e604370a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182876, "uuid": "8b41de64-d71d-477c-821f-2928b06d4654", "value": "c78baa78b2d265ece57d60a6527291ab2610f91a61856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5fa212-3283-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691124944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124944, "uuid": "d1d947b1-4496-456b-b913-1b560983f8af", "comment": "Malware payload (DCRat)", "value": "a1d6e887a5bf96e8f0f1b8ac8e90e88e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124944, "uuid": "6ba5b65c-30bf-4024-ae89-9e6043c2de69", "comment": "Malware payload (DCRat)", "value": "c9e753d95740926f6a2891404844f33d1b88207e145be637e0d212fcd2acc5ae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124944, "uuid": "d8261ae4-8e05-4e43-bd68-1e0e8d13797e", "comment": "Malware payload (DCRat)", "value": "40cb6a8f2e773d4ec280e1a26dd87d82c6d07306", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124944, "uuid": "35319b27-7ea4-448f-a90a-5bafc1b720b5", "comment": "Malware payload (DCRat)", "value": "949b8c5f8ba5aae5f1a6cc9a4b559361b9f2589a54a79c83f86fafab0bd315ee1a7f04b81f7aa1e7528288939211e092", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124944, "uuid": "914f4fee-0629-4372-9bc7-198b3b92de27", "value": "T1BD53B20676C98740D56936F180EF053253E6AAC76732EAD63F4C138D5E01BA29E87BDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124944, "uuid": "46abc1c3-fa8c-49eb-bf7b-d5a1595438f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124944, "uuid": "ae456be1-a6f9-4fa4-b0b1-d02881e2f696", "value": "768:5FCTCaNTsq7XXPuwiN7PxmAoXEtbybtocXlYmoBQwAftgbIl+QAI3AW:viNTbXGLb/t3m9wwtgbIRAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124944, "uuid": "2796ae43-3162-45db-aecb-80dd2f71970f", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124944, "uuid": "73d1cf10-fac4-4255-bded-9cc7fbbecc01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124944, "uuid": "f05684ef-5abe-4306-9d91-6edc88f8c63f", "value": "a1d6e887a5bf96e8f0f1b8ac8e90e88e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ef7eb4-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124205, "uuid": "a1a088e6-cf70-4e4a-8d03-08092c403a8d", "comment": "Malware payload", "value": "4977a0a8b8e0f3df6887b7d7ba7f68d0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124205, "uuid": "8b7ae01d-6354-4e7f-a184-98ce221841a0", "comment": "Malware payload", "value": "c9e9710a55d5cea39b5946addd2180d6d6365a3071a66e2b9175b922c27a65c8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124205, "uuid": "2641d40b-c55e-4546-87b4-c0e5f6a95695", "comment": "Malware payload", "value": "6c7550e83596b45eff457964a6106ab5cf273a48", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124205, "uuid": "c8a420d0-8934-40db-a252-c752a6c12e8e", "comment": "Malware payload", "value": "fd2ee1a934940587262eef0dd45effb228e7de15bb2e0d153dd57883c775a0800428c1f359f219d5ff66e4779ab0c704", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124205, "uuid": "6a32c01e-dd6e-4a02-a2f1-d8c2c2932c72", "value": "T1F985F10398048B87D41D83F87E633ADD0A0E7F29B4E979D705927F8B3A31AA7495E50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124205, "uuid": "331016bb-2529-4615-9935-bcfb41f578a9", "value": "49152:zQmmQ30gupF6V0QmmQ3030e6VViNhv3t0mXX77PBaaD0:zpmQkgmm0pmQk3TmVMhXXJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124205, "uuid": "895a83dd-304f-4890-9508-20f8b7b3cd2c", "value": 1719808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124205, "uuid": "c5ad976f-1266-49b0-94e7-1f3672048f66", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124205, "uuid": "8d5d6194-68b3-480a-94cc-379560b76f23", "value": "Draft import documents .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c701e8-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184683, "uuid": "4831944a-24f0-4e4a-b6a7-4aa05bb94444", "comment": "Malware payload (Amadey)", "value": "7bd5b3f5af4fcb7bca55e9ef945f98eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184683, "uuid": "71cee7f6-1a3c-47ac-bf33-5af22573b777", "comment": "Malware payload (Amadey)", "value": "c9ee6e590206aa82c1fbf029a6743c935ef757e242b12a7a2e3622083da4e440", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184683, "uuid": "1fa025f4-9a6a-49ee-869b-4132994621fc", "comment": "Malware payload (Amadey)", "value": "60ed1fd0a408af873063261a272dd00b95f0f056", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184683, "uuid": "a7b2d275-8ad9-4342-a42e-2c5c1c4cd73c", "comment": "Malware payload (Amadey)", "value": "8422863ddea83e0ef2f9903c791e26f6a2a71e6510095c1ce78235c57528bbac6339151699d1f3bd38bfe3afeab312b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184683, "uuid": "b9c1546c-8130-4cb4-876b-2f84a2372f4b", "value": "T1CCC41251F3D88437D8F1177218FB03D30636BCB1897C966B2386A86A1CB26946E7177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184683, "uuid": "cb8554b2-3dcf-4111-b985-94280c2efa87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184683, "uuid": "0c6d854b-8dae-4803-8dd5-271d25b094b0", "value": "12288:VMrfy90M8mL98bBP9jqU9vAKvYFB0eHCMRXI9rma2ngYm7JlVR:Oy4mZO95hv4FHCMRXI9rd2GvVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184683, "uuid": "91d9e5ec-d961-498f-a775-71e69f890a38", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184683, "uuid": "df99976d-1a56-4b5e-b3b2-cd2cb4285d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184683, "uuid": "e468eb93-2d15-4a62-8ca0-9baf853306ec", "value": "7bd5b3f5af4fcb7bca55e9ef945f98eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54d66ed-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173252, "uuid": "d7e6ddfc-5657-45c3-91df-aa0f2a7c04a2", "comment": "Malware payload (RedLineStealer)", "value": "fda643493035d149d4d780a1ae0f55ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173252, "uuid": "94567caf-7162-4342-94fd-6c55d7e9e126", "comment": "Malware payload (RedLineStealer)", "value": "ca54815d747dd1b2db4e6f525b193f8d45961ba0fb97d23d63c711f615aa09e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173252, "uuid": "63988d27-2b86-427f-9ae9-461f4773c144", "comment": "Malware payload (RedLineStealer)", "value": "5d57e1b52b49ac42158352431e520365e629af93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173252, "uuid": "3fe24e58-3615-45f0-a8e6-7cbbc760884f", "comment": "Malware payload (RedLineStealer)", "value": "cda34eeb4e76a9ffb6d45d2e0825f20043227e7d22af0684c848af5eee31767a562d5f04f9bfea931a5baa80289a959b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173252, "uuid": "087d79ed-683b-4274-b501-8c2fa9f5792e", "value": "T104C41302BFE89472DCB62BB158F706930A337CE19878865B135A555B5C736E0E43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173252, "uuid": "62e2e440-1dbd-49c2-bdb1-23214eaaaa07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173252, "uuid": "8687d53d-84d2-4edb-a8c0-d17c0de4fedf", "value": "12288:cMrOy908SEpw2PP+xTU7NmgBYCr9V2J9nP19dR:Cy3K2PPSTmNlzWhpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173252, "uuid": "97bed698-81b9-4d18-a9e6-6122bf0de241", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173252, "uuid": "4e0a5778-7595-41c6-83b9-131f62850704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173252, "uuid": "31c257a8-cce5-4fe2-bc96-3ab3320700bf", "value": "ca54815d747dd1b2db4e6f525b193f8d45961ba0fb97d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b19e0c-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691184983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184983, "uuid": "10a664d5-29ce-474f-b009-484d476403a6", "comment": "Malware payload (RedLineStealer)", "value": "252465583002a47abd62bc1e1a2fc545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184983, "uuid": "c5898063-5717-49cc-8c08-acd74e186738", "comment": "Malware payload (RedLineStealer)", "value": "ca83488b0ce0fe013555de362f276b8bce843818a4f229f6184e25afce6b5ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184983, "uuid": "f8341a5d-0a40-407d-bf8d-3759883360ee", "comment": "Malware payload (RedLineStealer)", "value": "f63c2a23746a53df103e563935b92c55f1241f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184983, "uuid": "e844b656-8df0-40e1-9c9b-22c0a9dbb059", "comment": "Malware payload (RedLineStealer)", "value": "f6b8f6de2287683e223715644be7ea3562f5ec9fbdcc4f87fb5c0a882d240030a8b52657242e4cc945db9342bb38a529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184983, "uuid": "83b2bf0f-12b4-4875-b0ce-4b0ca0eda5d1", "value": "T1A3C41213ABD85073D8B523B05CF602D317327CA3ACB4976A3B91594A2CB23D4D87677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184983, "uuid": "510ddc52-2ef1-4c53-b49c-1574842c63ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184983, "uuid": "695a65f2-e840-4bfa-845e-37b7e22647cd", "value": "12288:UMruy90T84iihMIcHKyhTEgBYCtBCQv10ydLsn25ni:SyaZisXNypLzGQv106Ls25ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184983, "uuid": "7166e521-a073-4bd3-bf34-b7dfc6abb996", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184983, "uuid": "e902f188-c3ab-42ab-a79b-3d6bf29759ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184983, "uuid": "c5d697e3-878d-4568-8e5d-9b90c815ae6d", "value": "ca83488b0ce0fe013555de362f276b8bce843818a4f22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd1d708-32eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691169775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169775, "uuid": "dc55a548-f7e3-44be-98f3-e8e604f3976a", "comment": "Malware payload (RedLineStealer)", "value": "9df176e9f8d4d37d406b40a040f926e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169775, "uuid": "1faf8dcd-5c52-4259-bba8-8a88450b2ca0", "comment": "Malware payload (RedLineStealer)", "value": "cba138ffdad33e869e8d0e775243b79706ce03f12efe925d0fcdc0a749b73899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169775, "uuid": "63c9fcd6-c416-4750-9284-988c7892e480", "comment": "Malware payload (RedLineStealer)", "value": "e3fb67413173d524783285426cd733f8594be1b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691169775, "uuid": "cfa39704-c677-4341-bcd5-14a8e05cdd1f", "comment": "Malware payload (RedLineStealer)", "value": "eb78268f5165e3731bb1f78d9fa3373833f0c3af71337cff663cb8f5c3c97d3b1defede256c68d0d11385a3aced0c340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169775, "uuid": "db639a59-48b4-4b81-ad99-dc0a481ab82f", "value": "T113E41212AAE8A537DCF66B701CFB12931731BC619978C74F2399684B0C73294A27573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169775, "uuid": "5ec6e49a-243d-4555-a0b4-07ad7b4311d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169775, "uuid": "e9d99165-8e1d-4b00-b4af-933c8eec8809", "value": "12288:sMrKy9068k/7bUWcJBXYr+y07wSPSA/r4Hi3gQJZF7bZno:uys6XU/X7pTV0julG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691169775, "uuid": "fb4b41f7-edd8-442f-9864-c6fbb01cdc9f", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691169775, "uuid": "182037b4-42a6-4bbd-9f30-48bb73368932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691169775, "uuid": "5265af3e-6867-44d5-9dd2-eb17ea0528d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e546f957-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "3a0dcbdb-d70f-44e3-8ba7-501abfee15f2", "comment": "Malware payload (Mirai)", "value": "87ef2c125cf80c41280d75f57403d396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "545e7d45-26f7-4d45-9fd3-481e40b87d0e", "comment": "Malware payload (Mirai)", "value": "cc277f04d0f104a99204500fdf513f373321989293125248ac997e874903d600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "b8714d5d-53d1-47ab-99b6-3e1650d999da", "comment": "Malware payload (Mirai)", "value": "3a27a8f0067c444dac46dfacf6a3f74ffe3f1b97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "57c7eefb-a994-4cbc-b440-a9e397444182", "comment": "Malware payload (Mirai)", "value": "5c27a75d15d62b8fca75c0f22693345c01347f64e744044959e8b6b78c6442b017bfca6e72b44ea4e5e6e9e0583ca62e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "1a7ec25b-4a0a-4982-89c2-bc7d01761f85", "value": "T16AF2D1EF635934CECACC2CB991A97B70BC4AFA80261E579D770468C48637447BC960DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "332ec88a-64c7-437e-9c80-6a686e3bfe2b", "value": "768:c4KU+fiHpoqhlN/JUDfn8Ntd8fhpYyO7FVPeAWMt:S6xH8n8u5pFOZhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124397, "uuid": "551cf8eb-5c92-4af7-8fa9-0dfd50b19d65", "value": 34320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124397, "uuid": "b6186095-5a5e-450c-af5a-7e809e87c800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "e2cdbe2c-e015-4d09-8696-2daf00dda105", "value": "87ef2c125cf80c41280d75f57403d396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c031ac-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173258, "uuid": "16a19973-9cff-4f83-a73a-7629c638b0de", "comment": "Malware payload (Amadey)", "value": "ed71b18a4f355d1e7daaed42612bfcdf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173258, "uuid": "c387b97f-fc98-4e17-a6d1-b58a306288af", "comment": "Malware payload (Amadey)", "value": "cc417dfbfc983974a68d67e1caec7725205bfd743248e729acd6257e2e3c5987", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173258, "uuid": "b0e71705-2ae8-4e21-b47b-12b0d76adec7", "comment": "Malware payload (Amadey)", "value": "d018441c1d9e5c582dae25b8bdbe0021b117c6d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173258, "uuid": "e7f5bd92-1faf-482e-90cd-2c09ede6da19", "comment": "Malware payload (Amadey)", "value": "605ddbdc3585628a5401286d8c6ce70737a54c09031517298c6b35c6366fb6ee30625401c05d34be0f448558fca58572", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173258, "uuid": "12af79b7-162f-446f-88a8-4174d88ca9d2", "value": "T1D8E41243EAE99473E8F117B448F603D30F3ABCA14978866F3792195A0CB2698717572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173258, "uuid": "ad158433-4dbd-4dec-aec7-866ddfe66bf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173258, "uuid": "1884a983-ba85-4d11-9475-3e2f66de590b", "value": "12288:BMrOy90nlIeSKWxldfg98S4yRHUBykHDMWAzjud1HCCPwl1YupLhqqGuKm:ryol5S++Av9x0JYl1YQhqqzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173258, "uuid": "6fc75b79-f3a1-4b0a-b2bc-b886ba73937d", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173258, "uuid": "3f81ef41-78af-4608-b43d-9d68b3ab9392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173258, "uuid": "4dca3586-e25d-41d2-8b96-97183a2ebe97", "value": "ed71b18a4f355d1e7daaed42612bfcdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e906ef0e-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691124403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124403, "uuid": "25c4a1de-7f5d-4942-9fb1-141b990879b0", "comment": "Malware payload (Mirai)", "value": "c0f4084a93813473da8ddeff4fcde87f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124403, "uuid": "4e44d8a6-7dc4-4745-ab61-333c8e5d9d5f", "comment": "Malware payload (Mirai)", "value": "cd0ee4b2ad5f091697da578446d2f193b4aceb22d52587276dd48a995e33e0c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124403, "uuid": "adcfbdc8-d5be-4df2-9c68-90e6318566ab", "comment": "Malware payload (Mirai)", "value": "5d25b726cd4920668c8c9e8528b4a629372af43a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124403, "uuid": "a7198e5f-a907-40cd-96cc-b397642e0890", "comment": "Malware payload (Mirai)", "value": "6fdcd423bbef826f9d2011e8d78aa61babcf1920489072f41b996492b52fcf7682a4677fbb3c4115bb9023954bdea041", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124403, "uuid": "5aa2ffe3-392b-4d26-b6b8-4f3efc51dc85", "value": "T174E2D081A45111A3E6880E3BF2FD528BE71D8579F1D221675304127CDFD3C22A9F8AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124403, "uuid": "f53e0e91-d3bc-426b-b969-80a173b9900a", "value": "768:pkDMh+ywyZ3kLQa8XmCgbH+UaNL65ln8KhOAC3U6:pFH7Z3Xa8XmCgA90ln8Khi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124403, "uuid": "50776482-f0a2-4045-b82f-4dfb4497ddb2", "value": 31544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124403, "uuid": "a2bb5469-76ba-4584-8876-6261fa4ed5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124403, "uuid": "2f6bfefa-9696-469c-8ab3-121ba10b934b", "value": "c0f4084a93813473da8ddeff4fcde87f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231a707c-32f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691174752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174752, "uuid": "2878ad1f-97ff-4b07-8f7e-10bef8f809f0", "comment": "Malware payload (Amadey)", "value": "2c071d778bb47b11fd4858af834ecca0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174752, "uuid": "409b9ed4-895f-4d1a-a906-b1d899668fbb", "comment": "Malware payload (Amadey)", "value": "cdbdd07a270d1d907798fabe6c680b677f98f119cd93987de5b6a2db7597d5b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174752, "uuid": "aaf0f480-5614-4391-b2e3-45bdff8db569", "comment": "Malware payload (Amadey)", "value": "60246bebacd35324850d3133b64ab95d4de482b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174752, "uuid": "8d3e16b1-ea57-4886-b6c2-ac74e75e14ae", "comment": "Malware payload (Amadey)", "value": "c69becce4ccfe1a140b5743d679d5b453074451cae72195c5b43bd0da6c29203929c93c57154a12ee4a9a90a57836c60", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691174752, "uuid": "09c41060-6db7-4efd-97aa-a73ebb54bfa9", "value": "T1D9E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691174752, "uuid": "7037db0b-f315-4a5c-9ce5-49534cdf8884", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691174752, "uuid": "fa3d6a1d-34cc-48b3-bb7b-20b1b050b91b", "value": 32756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691174752, "uuid": "40ceca00-5cbd-4b14-a4a7-381551c7063f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691174752, "uuid": "d1a967c2-ceee-46a5-9546-4c29cdd888d9", "value": "2c071d778bb47b11fd4858af834ecca0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53db361c-3295-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691132743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132743, "uuid": "58e87813-3b9f-478b-8c6d-ffd752a29750", "comment": "Malware payload (Amadey)", "value": "bd6f12fcd2ad59da13fd6ecb9afb550e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132743, "uuid": "7bf1fe2e-a855-42c3-bab2-a25b9ab61488", "comment": "Malware payload (Amadey)", "value": "cf1c0066d35898aa144a3535b6f892bdf344ec5f48b3546929414da7b725acfd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132743, "uuid": "1932746a-34e0-4c47-bbd8-6303558576f0", "comment": "Malware payload (Amadey)", "value": "a5935fd498f1899db62696fce0f5d95ad359fd56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691132743, "uuid": "c5a357e5-62bf-4943-a135-46f17d601a8f", "comment": "Malware payload (Amadey)", "value": "d1ea0170cc34bdff5d0956fa7f5957a66144dac06f73384ddd5ba8deef32f19ac2e44640d309d6769e4efb35e7ad5738", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132743, "uuid": "0715f5cc-d805-427f-81b5-447cd0157a55", "value": "T1B8C40293A7D840B2D5F61BB008F703E31A367D615DA4431B6BA5599A0CB3688F83673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132743, "uuid": "cee98236-32cb-497e-928c-7158072f3055", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132743, "uuid": "95f1d9e3-7cdf-4339-a87c-b49911205984", "value": "6144:Kyy+bnr+4p0yN90QEiaKhjps1smbsu9YwgWP2+qpvs7oAwaiq80sxK6XqaTTUgzi:OMrIy90ihez9DgoqskAcV8ITzZt732d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691132743, "uuid": "efc54ac3-e451-45cd-bb00-f55e3c2551d3", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691132743, "uuid": "190dbe5a-b759-4c66-b8c4-519096d0a805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691132743, "uuid": "44667dd7-c915-42be-b358-826306ab9cc0", "value": "bd6f12fcd2ad59da13fd6ecb9afb550e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9153fd77-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178373, "uuid": "6f0ee0c9-e8ec-4cb5-9cf3-383ce2c5db79", "comment": "Malware payload (Amadey)", "value": "cfec7b5080a90d66852ad02e843cf742", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178373, "uuid": "3cd3ce05-7e2d-45fe-982c-6d86bc7a0b7a", "comment": "Malware payload (Amadey)", "value": "cf275b65696d933fad26015c028240dc6ee7e02d740e675cebfbe4672c4c5f40", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178373, "uuid": "b91468d5-d925-43a6-8b07-ececbcb416b3", "comment": "Malware payload (Amadey)", "value": "55b566f37283d0aa9797f79e3da9f16d2334f97d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178373, "uuid": "39f3076a-249f-4702-b6c9-db2883c41c36", "comment": "Malware payload (Amadey)", "value": "1759a51a63de6d426af568a765bb42b89af832825c137c3f89a25d52bfdaaa8439f4ac18e8e8d1fe1792cb964ee84e62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178373, "uuid": "b3be30ca-2b8b-4b90-93cc-80cfa497a87c", "value": "T18FC41202A7CC9033DCB02BB058F203D70A3A7DA65D74D767278AA9A95D732D4E17173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178373, "uuid": "621d3a0c-cd7c-4c2b-999b-71c37450861f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178373, "uuid": "268f392a-3b97-47bb-aec6-ee2d5dbb1190", "value": "12288:WMrdy904vf9RO0ib/vz5Mw/lB0wSTucgBYC/BKQXYmkmcG7/7NzFqB:PynLibt//+KDzUQX/knG7PqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178373, "uuid": "3739ed01-a31b-4c2b-9860-50007d6da1cb", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178373, "uuid": "f6a26697-8022-4f12-b304-66dd11e9ebc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178373, "uuid": "8ac155c2-b027-4b50-a408-12b8fa223a2f", "value": "cf275b65696d933fad26015c028240dc6ee7e02d740e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af18ddcb-32e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691165538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165538, "uuid": "126a64e4-ee1f-4086-b06a-2482a89892f2", "comment": "Malware payload (ModiLoader)", "value": "ae5ad2efd8a9cf25ad9eb00ebe24eb92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165538, "uuid": "f8c29b95-588f-448f-b1fa-f22642f5b278", "comment": "Malware payload (ModiLoader)", "value": "cf39a14a2dc1fe5aa487b6faf19c63bc97103db670fa24c62832895e3002eca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165538, "uuid": "7a24f770-a94c-4397-83bc-20a42158545c", "comment": "Malware payload (ModiLoader)", "value": "2eee8f21d06a2602ed0cd3e5dc3a8a0dea8157d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165538, "uuid": "d61dc906-9df9-4bfb-8a12-f8eda23e0771", "comment": "Malware payload (ModiLoader)", "value": "c65bd8708f97affd8ddd10c18e474d53fefffa80ef4cb76019feffa2b03f247b2f8b1955f7f7e2578c1582faa19eb3bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165538, "uuid": "8193150d-c931-43a1-a319-222deb1a6891", "value": "T14E35CF27A3E50573F127363548A7B279DCAD7D2428293C816BE63E88BE376417F081D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165538, "uuid": "9bd082e9-0f85-4a19-bbdb-ec4f49f058b6", "value": "051f371797f6e597d48d110e8ed68eca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165538, "uuid": "b54e16c1-62ce-43b2-91c8-b756056d77df", "value": "24576:+GBEKQCWCWF4bH7yT+YLWPP7/NCo6LboxSYVuDpa7Dfavrjnpi0JN:rDpd7/NC3LRYwNa7mvrjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691165538, "uuid": "2009f071-e2c5-4280-8e79-e1e202559314", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691165538, "uuid": "c650156c-756f-4755-9df8-7632b73423db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165538, "uuid": "ee2c998b-a476-48a8-8b7e-641c79c256ed", "value": "cf39a14a2dc1fe5aa487b6faf19c63bc97103db670fa24c62832895e3002eca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db178f5-3310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691185587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185587, "uuid": "c94f8914-0ce9-4fad-9ad4-f02f5694a989", "comment": "Malware payload (RedLineStealer)", "value": "5aaa5eb1b474ea2cd68cfc88ae17e0b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185587, "uuid": "8d17eb7b-15df-4b14-88b0-9732a55d8ba5", "comment": "Malware payload (RedLineStealer)", "value": "cf8e20a486051bcd647acc5269e708deb147088d20f47f0fb9358a368f4f648e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185587, "uuid": "18f67389-5043-469a-93d9-6e605740189c", "comment": "Malware payload (RedLineStealer)", "value": "ef90dccc97fca202fce3529d2c529e70aad69d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185587, "uuid": "098ef2e7-7c17-4f61-b1c1-9a1b69e80eff", "comment": "Malware payload (RedLineStealer)", "value": "841a75583cc621137cba3abe2e856263c6d81b23b13d098b028b8452fd8810cd9c6bc497d0109508bea861c0e584668c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185587, "uuid": "b8511dca-6457-4139-93ab-64e1195c4190", "value": "T160C40252EAD84437D9B427B06CF603C30A3ABDA19DBD536B3245594F0D73289A83272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185587, "uuid": "1abc41f8-8a7f-496e-848f-893cdbe0c36d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185587, "uuid": "b3612ec0-9229-4548-8401-fb28843a7214", "value": "12288:xMr+y90WRN/vyRi7Nd+7mvWfeGVoXryibfjAad+pE83XZnAG7:vyLy8Bd+GqjVobTjV++cnAG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691185587, "uuid": "6ad35e87-269f-47c9-9108-760472ff5aaa", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691185587, "uuid": "f7da2617-1d06-4603-91ea-a939983137b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185587, "uuid": "b19971fe-507f-4202-89c2-16460c62d9ed", "value": "5aaa5eb1b474ea2cd68cfc88ae17e0b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e059d197-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691114940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114940, "uuid": "f6639174-5d8f-481c-95e3-5b5073421781", "comment": "Malware payload (Mirai)", "value": "0a2f23837953cf32ec824c758211d79e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114940, "uuid": "87ba91dd-476c-44d8-9d5b-f96274b6ae29", "comment": "Malware payload (Mirai)", "value": "cfd43bea431abcdf8ce5a26db61cf11e87ed904f4d8094c95197d60a913dc930", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114940, "uuid": "9294f578-6484-4ed8-8a82-190fcda50252", "comment": "Malware payload (Mirai)", "value": "6de4df1efb46088a024edfb058de0eb53437c7b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114940, "uuid": "9b8a230a-15b3-4620-9df5-5b5d48796b6f", "comment": "Malware payload (Mirai)", "value": "5f9c7e299e2b50b6a7ed4742d01510756d1212e38d2838f5f394419f1130625667e95b881c57ef995f3360b1e971606f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114940, "uuid": "2154168f-c3d2-4b7e-bf02-e619363a291d", "value": "T1E2136CC1C543D9F5EF1502F03132FF361736E43A506EEAC7CB5AC936A802991A69A35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114940, "uuid": "66e9e77a-2fbd-42f4-b81b-247d777368a6", "value": "768:Z8PHtvWaiKFKcextDHT5rtYECXsBle+gQdWSw1G:aPHV4vxdz5rt4uleBMBw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114940, "uuid": "d43532be-765f-410a-9fe4-b5ac8818c0eb", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114940, "uuid": "3b2165ba-a874-4180-88a4-543b67ae18cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114940, "uuid": "4a8c0843-d7dd-4b74-9d07-815056145190", "value": "x86_64-20230804-0208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e0f7bb-3300-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691178566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178566, "uuid": "0fef8c25-97be-4ce0-be2e-aef2e177d147", "comment": "Malware payload", "value": "bb4e3b588aedce8e203361b0879d9113", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178566, "uuid": "9e86ac95-c6ae-4f0e-812d-b99fd3414d10", "comment": "Malware payload", "value": "d0861b2aed04474e7e0f524c0cf6f8495494fc509b0fb8dc94d89dd1dcbacc5e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178566, "uuid": "af195b89-277c-435e-a619-0f1ffd8e8c6d", "comment": "Malware payload", "value": "1b7161fe8b076b9bd5eea6652a5b7f9e329b242e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178566, "uuid": "f907e126-d249-4faa-8e10-b16ca3ddfda3", "comment": "Malware payload", "value": "11748d883807ab340e1769da665adff3915141b11fc34a3a119783316362b780ea5eee8a0342714dfb97bc2baa1eb802", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178566, "uuid": "71576e35-0420-4796-97ba-026bcd7c5ea9", "value": "T1405622AD518C379CC02EC4B48833ED56F2B6561E47F8E4A9B1DB7A80B7E7824D902F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178566, "uuid": "5fae0bd4-1ca1-47fa-9b6b-032b2fe56548", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178566, "uuid": "ead6a8dd-0d11-4a34-af2c-bdf3740977c1", "value": "98304:hqxMdwv65XzQ7bbf2ptVi58VQV6mS+O17/8s7WUpi7epveUN97lU0EpE7rbTgQ:MSKStQ72pPVA6L+DsqwiBsuaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178566, "uuid": "d851b202-2943-453a-96cc-8b578e0b873c", "value": 6116352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178566, "uuid": "3a2d205d-e7e6-4c9b-9fce-1cc52db6f2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178566, "uuid": "366a5a8f-5296-47b6-8166-c0a927707660", "value": "bb4e3b588aedce8e203361b0879d9113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40b4ef3-32dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691163372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691163372, "uuid": "630bf564-8ce6-4a43-a447-ef889d5b1f29", "comment": "Malware payload (RedLineStealer)", "value": "b8b7415ca354f4ad092bb58939abf799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691163372, "uuid": "7bcf7f57-6ab5-4107-8468-5bbe2100187a", "comment": "Malware payload (RedLineStealer)", "value": "d27c0cdec6be373d5dcbfd38d8bf413a691baea8603f7d7d9f1989408fb6e947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691163372, "uuid": "17edcddf-9556-4ef6-91cd-d3009479a166", "comment": "Malware payload (RedLineStealer)", "value": "af2c0bb13a1e927ff2d7d4f277f521294db77e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691163372, "uuid": "245e05c4-b73d-4452-8fd3-b23d94261d1c", "comment": "Malware payload (RedLineStealer)", "value": "ffa4a9b746e1f8c4d47e6935c6f68636fc27334a10f00b77a76875d08904f9385183dab712166ad827d1b1001388d605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691163372, "uuid": "5090c548-d03a-41b4-a5ab-2cf74beb531b", "value": "T1F1C41212FADC8033EAF1277059F703971A367CA2DD74837627D5695B18B2A80E531B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691163372, "uuid": "7afa245b-aab1-4be8-a317-56a3a48d9493", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691163372, "uuid": "b7eac95c-c115-4ba1-9bd4-211f1fb86a04", "value": "12288:eMrSy90fOeYMrctOuyBN3xL8vOV5M/qXihNDBDf+ISXzqychdriY:QypVDyH3xFV5MyXqNDB67DCdmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691163372, "uuid": "4af0a1c4-28fe-4479-a496-68429edea385", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691163372, "uuid": "e8d993a7-5b44-4523-aa81-07d7711e4130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691163372, "uuid": "25458808-4d73-4e30-b8ca-de031dead521", "value": "b8b7415ca354f4ad092bb58939abf799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59613760-32d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160669, "uuid": "8921e9d2-813f-48d6-8b25-250ddc6d4e3d", "comment": "Malware payload (Amadey)", "value": "e78a1eb902ab9e2c0393c9b3f802a9ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160669, "uuid": "845b4bd6-3d79-4407-b8fa-c2d06a9c5d07", "comment": "Malware payload (Amadey)", "value": "d2cc945fd5e00d998307bd729a8f39e6e6b6626befce0af2fecd07cf51267c47", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160669, "uuid": "d5718cb2-2fc5-4719-81fe-1f941748e38c", "comment": "Malware payload (Amadey)", "value": "c3c988b26b6a952c519689cd3be334034895f2a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160669, "uuid": "cf89bd35-fac8-4567-bbd6-5952460a9fdf", "comment": "Malware payload (Amadey)", "value": "e3087460753d06249afae291f8d451060adfedebe658719e349b42f1b723a19e5218a258b921e7bfb5df4439f70c4dcc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160669, "uuid": "e3abbb2d-d74f-465f-80aa-f4ab17767bda", "value": "T10CC41253ABD89633EDB5A7B018FA07931B347CA24C7493BB2785584D0CB3694E53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160669, "uuid": "732d5f98-fb7a-4eac-957c-d054f18387c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160669, "uuid": "a4b2b1c2-5852-481a-9351-23626f73aa54", "value": "12288:HMroy90OPFo31J+4zgG9JmBU6aFphdKq1jRDfVfTT75rI314:vy5Fo1J+EJm+3LK4RfpTFrIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160669, "uuid": "40a50fe8-b454-4be1-8923-11fa69dfa98c", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160669, "uuid": "256ecb36-a2ac-43c0-be80-ca27e3fbd8c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160669, "uuid": "dc6b85d5-8961-4657-b0b4-42fb99a7f5b6", "value": "d2cc945fd5e00d998307bd729a8f39e6e6b6626befce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b54b3db-32bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691149398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149398, "uuid": "89cb90bf-8385-4a7e-a6b9-655417aedd83", "comment": "Malware payload (Formbook)", "value": "2b0ea46162011d71dabc5f7b41e4bb33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149398, "uuid": "404370b6-bfbd-44f4-9ad4-1afdbf4978fd", "comment": "Malware payload (Formbook)", "value": "d32a2995531b8fb3a8836f10e5239219715488a71d6b83bff5c9dad615ab8fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149398, "uuid": "bba0c60b-56b4-4c03-a3b4-b6ac6623a825", "comment": "Malware payload (Formbook)", "value": "4c53a78fb6fa54e4e758cd7ef37776df59744d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149398, "uuid": "98e91010-c6b5-49c8-9332-f5b2e4ec08bd", "comment": "Malware payload (Formbook)", "value": "75b457c8f9b7901fc603c47b93c4202fe44a722c8c9130bcd27085335458441663d688f1d572720805c4e09af60a5b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149398, "uuid": "d28ec7c0-de1f-4369-bb74-7a8eccd5a9cb", "value": "T1F4459203BAB799B2C2491737C5DB141443E4DBB17333E61A798B235A09437AA9B4B337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149398, "uuid": "bcb412f7-d63b-45d8-97ff-cb65a140e93b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149398, "uuid": "b583a417-fe7f-4b8a-8fc9-0a6330de76aa", "value": "24576:BU+iDJtfBV+bTJy+O8GbF12dUOA46B0dwj2jHy:mf+ADtSjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149398, "uuid": "1bd96c64-a163-4e9d-a413-114bfaafe774", "value": 1251328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149398, "uuid": "469c6a29-d1fb-4eed-987a-90218f770785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149398, "uuid": "4683d016-002e-45e3-b29b-34d7de990020", "value": "Ferlam Technologies August 2023 PO pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bd7b0a-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178377, "uuid": "34ec245b-8b54-4d2c-b571-e833390c8ca4", "comment": "Malware payload (RedLineStealer)", "value": "c266267bb029c569d034e9e558394a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178377, "uuid": "fb502513-28b5-4175-8828-3d2164046b48", "comment": "Malware payload (RedLineStealer)", "value": "d35b76babcb17c692a4d7c044f5bebf54165c717c8e78c40911b429d74c3ba75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178377, "uuid": "ac24c76e-98b7-4ee6-b731-7377d88d1eee", "comment": "Malware payload (RedLineStealer)", "value": "d7583561ba9eab071ba72b9ffa5b39dc752cc505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178377, "uuid": "00f0e8d0-a1a1-43a4-bf95-eb54a9fd3ccd", "comment": "Malware payload (RedLineStealer)", "value": "7b8d1db570c98c46d044bb9dbf2a228130d2bca414e62a525c306db03ab888a992140be76e2949f43383673652dcb66b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178377, "uuid": "6d944cd2-89d2-4666-94c8-9aed814ae82e", "value": "T15AC41212A2EC9072ECB127B04CF702930A357C666D78536F2745695E2CB27D4AE7273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178377, "uuid": "286021c4-58db-4bb6-8d51-97fd9c72a546", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178377, "uuid": "9e274e87-adca-410a-9164-a87eb575bfb9", "value": "12288:LMrky90TrydUgfDUQMc+MWVQLLxgBYCcTawWi2PPt6:jyjdBDvV0VQXaz7i2Xt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178377, "uuid": "f6cfc1ce-4f9b-45fa-9818-97643acda44a", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178377, "uuid": "ff52861b-821d-4139-8502-755e3934a246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178377, "uuid": "e5f897bc-3d34-4c28-9bb2-e762e93ffcb5", "value": "d35b76babcb17c692a4d7c044f5bebf54165c717c8e78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c773a6-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691114734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114734, "uuid": "0c09b6be-ad5d-43ee-b6e7-c3288ff04010", "comment": "Malware payload (Amadey)", "value": "594d5dcacd4132dbdbc27227ad4dcc20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114734, "uuid": "0cec01b3-9ebc-40ef-bbed-9b7142160d03", "comment": "Malware payload (Amadey)", "value": "d35c05591a8c257a3823601385f469d0b8da6c5ac7b276c2882dfe1a8168cfef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114734, "uuid": "581d57e8-c6a7-44e0-a66c-1dcbd75dcdeb", "comment": "Malware payload (Amadey)", "value": "1a15cc15445b8e3064fad2fd069db26c60434680", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114734, "uuid": "c6fa1afc-a26a-4f66-9fe3-17e058cf5657", "comment": "Malware payload (Amadey)", "value": "b86eaa8af0f764d23374ee45bf0960a11a28c51440c16f909af21b04e58943e0e06359f5751a39e199f5cb644c1dc1bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114734, "uuid": "c128db93-0f0a-41d4-bb5a-c8b53a78a2bf", "value": "T12CC41212E6D840B3CAB65BB058FA13931B3ABDA25978531B2781885B1C737C8B53537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114734, "uuid": "31a651cc-eb0c-404f-ae3f-79e1df662dfa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114734, "uuid": "deb2e8d0-85e2-4d8c-9a57-40c9128e9272", "value": "12288:PMrRy90PmV26yR7MN/JmvSUzJVLy1N4iOx6aM:yy+agIhZkrLyv4gaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114734, "uuid": "4976ebf9-d55d-4f2f-a1f4-646cd0e505e5", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114734, "uuid": "e3f3d6e7-2689-455f-bd96-54d76649d577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114734, "uuid": "d62ac694-5260-4248-9919-d3b5fd5094f7", "value": "594d5dcacd4132dbdbc27227ad4dcc20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46746633-32bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691149900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149900, "uuid": "99d4e964-c2ee-4a6e-8a57-5b1319240d7b", "comment": "Malware payload (Amadey)", "value": "952d825a264745bb52b6977ba5983568", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149900, "uuid": "25a3c21d-99cf-431c-b8fd-8c1f23f69d45", "comment": "Malware payload (Amadey)", "value": "d35d55bb74a7cf4349e2fa4a92839e2a88f17a1fee9725801d0d97b2bf0d311c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149900, "uuid": "54946d5b-911f-46c0-9986-c536274878ae", "comment": "Malware payload (Amadey)", "value": "627a0a841c2fe194dd54f9ec6b0c1231d7da135f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149900, "uuid": "933a676a-97f9-4487-9e5c-6dbdff5265ba", "comment": "Malware payload (Amadey)", "value": "2f8dc3ff8c173ac6807e5050adcd8839c5d0711015b3fdc71dc2acd6c36ab6020500b8f57684700ffd9ef6e87d6657c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149900, "uuid": "ae2ef75d-e841-4d95-a139-2b5c47f714dd", "value": "T11485025535ACB525E3B11271CEF3916FE32BE83373326A0636DC239A5B729A4184336D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149900, "uuid": "dfc1fc1a-e340-4ffc-9baf-1e62f49dbea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149900, "uuid": "f2a6c0c4-2d08-4e76-bd7e-03345cce354e", "value": "24576:vZNFBKNlMaSOHEB2eXSbSgAaCOHOpxeRpeJphGf4F3xERjf7sI:vZNKJSR5iAaDaeRpeJpof4F3xERjTsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149900, "uuid": "ce90ad25-5fe9-4777-b4b9-57c16eb85441", "value": 1717760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149900, "uuid": "deaf8fdb-897b-489b-b954-0b1b3439a79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149900, "uuid": "8942b12d-ceb6-4c8a-a9ab-fc77d4f353a6", "value": "952d825a264745bb52b6977ba5983568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77686d0-3261-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691110549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110549, "uuid": "4ce69718-e644-41f3-b917-5abd0cb265c0", "comment": "Malware payload (RedLineStealer)", "value": "72582461f2cd9a054fe31c77329a167e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110549, "uuid": "a8ce15de-2dd2-4904-93c1-9a48862e621a", "comment": "Malware payload (RedLineStealer)", "value": "d3b263390aa7cf0254f9bc38b954b45ad49daa6e799a64aa4621f665e8cdebb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110549, "uuid": "4c258149-521e-4e27-8c1f-d5575c8c1965", "comment": "Malware payload (RedLineStealer)", "value": "55366a2074914133624b5699f2c9e5b4e22ab4fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691110549, "uuid": "bf998738-22a0-4af4-a3b5-2ccc17704f9c", "comment": "Malware payload (RedLineStealer)", "value": "a7490194dbef38be00b4ebd82d1a3b8392bf12b07d7a2c04039d267711a815238f12564989269e171db45902317bb157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110549, "uuid": "226d6bb6-4091-4687-8b82-637afb58424c", "value": "T177C41252F6D94072D5F60B706CF713830A36BCA0AE74826B2395956E0CF26D0B97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110549, "uuid": "8041697f-ca45-4300-b42e-1423c8090452", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110549, "uuid": "74ce0414-2806-4de4-82d8-1ed01263d1e5", "value": "12288:ZMr9y90WFq36HGY1WCsGEcnWyiU4i2dHFR7n:sydFcMGabWyj4rdlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691110549, "uuid": "06164a9f-4298-4979-acdc-7385b13250bd", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691110549, "uuid": "a65e0979-84f0-44cc-a776-b43d76f0041d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691110549, "uuid": "967b6eb1-29ec-43e0-82f8-887b1604ebc6", "value": "72582461f2cd9a054fe31c77329a167e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a836048a-330f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691185283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185283, "uuid": "f4d3f3a7-a21b-4709-8b28-1dd9d6d91e15", "comment": "Malware payload (Amadey)", "value": "7d36d3d2a02dfd13def812f8bb00636b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185283, "uuid": "0c1d10cc-2e1b-4abd-902c-ec472e738390", "comment": "Malware payload (Amadey)", "value": "d55a3288338d2f658a815ab1d0630ac38be31681bada1806f57bb4855b96f9a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185283, "uuid": "f6aaf681-2abb-488e-8494-57461d9b0c10", "comment": "Malware payload (Amadey)", "value": "ad46da75235435166fff180228e03dca43801216", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691185283, "uuid": "b06c64df-f18d-49fe-a330-d07cc17e4ca4", "comment": "Malware payload (Amadey)", "value": "619dd8761383b0b98d7e91942c59e2f25da716f5731156a67833a6072e6e3153bc9fff3e94e4b43eb6cc86dcd926ba8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185283, "uuid": "e42b2b63-1214-432e-873f-ab29f67c37d8", "value": "T147C41212B7E84073F5711BB56CF102930B39BD6B493882BA2759AD1E0DB3184A97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185283, "uuid": "d411d6d8-5111-4797-ac0d-3f8ac78ada2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185283, "uuid": "75a7038b-b86f-452f-a744-8c93c8ef10be", "value": "6144:Kry+bnr+2p0yN90QEJGecqWyShdYRxlMBQ9r2oMBVp8SaWAWSEnmSLkVELRzcGrY:FMrSy90zLGySivRSaWAWAVwIGFy93ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691185283, "uuid": "019ed379-bbe8-4b80-a036-92897ca40e36", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691185283, "uuid": "2daf29bd-4bfb-46a8-b175-be3cb0f05023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691185283, "uuid": "615d47f2-7120-4d56-a096-32a71dacd4bf", "value": "d55a3288338d2f658a815ab1d0630ac38be31681bada1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab11c616-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691173262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173262, "uuid": "162a281e-1b5b-482f-a90c-2b31de6179c9", "comment": "Malware payload (Amadey)", "value": "cb18c6b58bac59df1672ae8671221678", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173262, "uuid": "88f15345-5090-4f75-ad16-7da818e449d0", "comment": "Malware payload (Amadey)", "value": "d6a7af743c7b160a813c17c16dd688d14ba8e1ebbff092c6bd8caac0899db762", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173262, "uuid": "edc8f375-9469-429f-b9c5-913dbab33401", "comment": "Malware payload (Amadey)", "value": "7c6cb2a3aeff30088f3f42b0e1408e7b34ba445c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173262, "uuid": "c0c8cebc-eb29-49eb-8060-c5e2baebd753", "comment": "Malware payload (Amadey)", "value": "6463f8660d2fbcdacdd9b3dfe508ea153418c9c90b3cd6e7235ff665cae7203396cd402e426bb66dd2cb897ae7324bae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173262, "uuid": "3c57684d-cf6a-4efd-bc72-546bedafb7d9", "value": "T129C41213B6E98073EEB55BB058F202C30B36BC619978567B234168561DB32D4E972B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173262, "uuid": "8d7e3cda-924b-4e0a-99a0-cd507bf7a22e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173262, "uuid": "cb4da481-4ce0-4ead-affe-c6004c23ed13", "value": "12288:rMray90SbxMRK2sEBPCtGAMTVASaKjHZ71OQRIDI5/HRv:RypyRKrUqtGFVKY7reDIpHRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173262, "uuid": "f4f51c79-7752-4912-a5be-d9c42eea9504", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173262, "uuid": "f224ad3e-c966-45d3-8118-dced0abf0dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173262, "uuid": "aa147417-4593-45ac-a674-8f2bfb999c9e", "value": "d6a7af743c7b160a813c17c16dd688d14ba8e1ebbff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9992fd53-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178386, "uuid": "310ac849-bffb-41e0-99a4-c6624e7c8503", "comment": "Malware payload (RedLineStealer)", "value": "3c87548933a1de41bae11dcdf48fb1e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178386, "uuid": "eba23775-bf8a-4792-be68-59ea40efcfb5", "comment": "Malware payload (RedLineStealer)", "value": "d6ca8aa45bd34c85d7324ed59fe242f4f30d82703c5399602f21d01312edbaf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178386, "uuid": "535ce956-25e2-42a9-9b08-b4ea106dece5", "comment": "Malware payload (RedLineStealer)", "value": "6df7a1318fdcb0aafe900617f8555ff2dea9f9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178386, "uuid": "4a0d7062-c353-4586-8abc-32698e0a5adb", "comment": "Malware payload (RedLineStealer)", "value": "1b01b7858ed70d4fad9e036093560a9b038eb4aa45759834fa836d4e9054b30792abee565a2564579695f5d1b23dd052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178386, "uuid": "20fa3d50-57e8-424f-b20a-d90badf226dd", "value": "T1A5C41213A6F4C177CDB927705CF912830B3A7CE18D748266338A6A5F4EB3AD4947136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178386, "uuid": "f6456255-85c0-41d9-87df-f12e76169582", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178386, "uuid": "17e3a8ee-762d-44a5-92d6-e91878928f22", "value": "12288:5Mrzy90kf22YMhbtQFSvoa0PwVLwoMRuWwX:+y/2295RZmwR8uhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178386, "uuid": "4232f57d-22b8-4fc7-a2b2-7386a97a4ab6", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178386, "uuid": "8fb422c6-6252-481d-b90f-1fa496b735b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178386, "uuid": "929bc8f1-b76f-4594-9109-851cd8f31bb9", "value": "3c87548933a1de41bae11dcdf48fb1e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab45e293-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124729, "uuid": "9a89955a-372e-4544-9f7f-3a8a18928628", "comment": "Malware payload", "value": "8eaa011010a7c06112c785299400d574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124729, "uuid": "4ccee8f0-f82e-4879-994d-ada8b06576d7", "comment": "Malware payload", "value": "d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124729, "uuid": "d1855a2d-19cc-4f7d-a2a7-f4ccede9fe07", "comment": "Malware payload", "value": "18e008fcfa7707a379624f9edec00b96c43e3537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124729, "uuid": "bd674eef-020b-47b4-9664-cae3149cd7d5", "comment": "Malware payload", "value": "96ec679db4f9ce795c87f990914bc05c2f579388bb42da6fb8fecbca76be85d0d0eb4ddc4af4b1f13ba16387bd9a3a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124729, "uuid": "3185d21b-9b29-4606-8b6b-0a9ae9ab953b", "value": "T15AC4027266B2C872E53602318D1AD7F86A3FB4718D55DB573384CA2F1A723A3DA23701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124729, "uuid": "cc3251fc-3fe4-448a-ac61-4baa925c8ebe", "value": "242d7fcf794500079c92bb6f2a532781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124729, "uuid": "40af8945-95e4-4dca-8a80-69130622999a", "value": "12288:i9PQhLdBT28h3eqCmzKJ5NOhXZOHaQCs:0IdrTR3eqJONeX4HaFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124729, "uuid": "06349af5-564d-4976-835f-a0e633aee131", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124729, "uuid": "98560fd0-4491-4bdf-8636-ff9fc302ad3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124729, "uuid": "72a24ace-017a-4e35-ae18-d71fdc7a56f0", "value": "8eaa011010a7c06112c785299400d574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe196c2f-32e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691165241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165241, "uuid": "ef8a3b15-974b-4e3f-969c-eaeeabdc0b19", "comment": "Malware payload (njrat)", "value": "5fae1fc204f85528336f435f2af78c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165241, "uuid": "a0672f7f-0073-4c22-9007-49db77d82f55", "comment": "Malware payload (njrat)", "value": "d7443e8971985f4cbd75219edfdedde221be125432c421d6b0d1537f7d8b36d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165241, "uuid": "64656089-8854-4802-a29e-cbc9586d0d01", "comment": "Malware payload (njrat)", "value": "6e8b3b6064269f4d8c98375380232e736842eb7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165241, "uuid": "13506d5c-64ad-404a-b0f3-eb2618b765cb", "comment": "Malware payload (njrat)", "value": "3f6cb4ac935dc527b5b3c751f301d7a35f321d4c83532174d38b42ddb12deacd2015d34b33c6951b9ae5c89f8a2311a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165241, "uuid": "59925526-2d92-45d0-ba46-7567198522de", "value": "T103E2F74A7BB94129C2BC5AFC8CB313114772E3478532EB6F5CDC88CA4B676D04251AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165241, "uuid": "7226ef49-9874-4ecb-a8d9-3a27cd562f57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165241, "uuid": "edf2f79b-c3bc-4f15-a5a2-b503ffcb54a4", "value": "384:00bUe5XB4e0X+OSSCixBr/QZWTGtTUFQqzF5Obb+:RT9BudS9ifrYPPb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691165241, "uuid": "d0531903-f173-476d-9190-9f327652ea4f", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691165241, "uuid": "34d13ad1-524d-41fa-89b1-c3941392e332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165241, "uuid": "5cf40126-808d-49cb-a5b8-fa03856b8558", "value": "bOEU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ef2308-328e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mekotio)", "timestamp": 1691130003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130003, "uuid": "ed7848c6-0be3-4d23-95d7-dac979ce846c", "comment": "Malware payload (Mekotio)", "value": "fec38d0a1e6323441918022769407d66", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130003, "uuid": "b964c502-33e8-49e3-a3d5-80232c2dc72c", "comment": "Malware payload (Mekotio)", "value": "d78e0fac60b63ef8d2fcbcf38d5c3caf95657c0c095611b46c4b7ee73c5d9638", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130003, "uuid": "e0b4ba4b-ee04-4854-b204-ab041fe91c9c", "comment": "Malware payload (Mekotio)", "value": "4d11770dfc98968febe9fe1d891ee51c2aeb4f34", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130003, "uuid": "932d2178-dd74-4a81-82a9-d4aedeecfca2", "comment": "Malware payload (Mekotio)", "value": "de3704aef3165d49be5b414d56391c94bd74b8203f2a21869c8a66ed29447eb1d3cfc83615b9baa45e198da8997e8f66", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate ita", "colour": "#9F13F8", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130003, "uuid": "85a361c8-a74c-4563-9151-f039bd7cbd73", "value": "T18356235176C68235D1EEC3740E17FBAE75A62A2843B240EBE6C41BDF35F269016B1D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130003, "uuid": "afd4ae7c-02a6-4a5e-a26c-240b1f09d5d9", "value": "98304:LY+P3OtZdlWPDRabO7mev+fRh3/nwvuXD1jNmSER3bv+QSKpa8A2yxHXZUkGFWg4:TmtZdYPgbOi5Ma8b0KRNyxHWkyWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130003, "uuid": "cfd727ad-0ba0-43c3-9290-ef2f66e0b2af", "value": 6395904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130003, "uuid": "dd9bfce8-1a75-4d1b-a5ed-f6bc60c56262", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130003, "uuid": "7a97e306-5dae-4631-b060-54c67d356c12", "value": "FACT64cc9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd6b036-32f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691175444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175444, "uuid": "4855081b-e80e-455b-90ce-59383b737722", "comment": "Malware payload", "value": "11de7138a9df2d5bbfeb112f8d20f2df", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175444, "uuid": "07f2c4f4-0225-479b-9f24-a1c1ec48887f", "comment": "Malware payload", "value": "d7a5b7f6121d2329ea2514ef24ab2c5d48ebc2ae5bbade7affa1960ff5f35c1f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175444, "uuid": "8172f685-28e1-4e78-ab67-a17f1753905a", "comment": "Malware payload", "value": "c46a50e262a1705e21749068386e2029033545b3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175444, "uuid": "703f086d-e97f-430a-8982-70b523efb541", "comment": "Malware payload", "value": "4adc0c3cfe0c2fa6b34b7e72cabfc16659c693887e058b691bf2eb35eb408a6dd52a3feb938f5cda5662393d483abece", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175444, "uuid": "607def95-d91a-4dc9-b4e0-2e329cdce00a", "value": "T150D423AEF2C88840EA1556F4F5C8836A86F4124525BDE6EF7EDC154BCC93710C318FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175444, "uuid": "2f70697a-58c2-4f91-9b45-2989d20882ff", "value": "12288:pky9nGDCcbL4prw+6AVTfHRZ9v12t2zLYIl+9UDqiXf4FmF3pf4rrC7D3hbAPwpg:pkgnGDNL4RB79ct28UDHMm1hArEbhbAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175444, "uuid": "5bd56047-7760-4353-b7a3-38becd2a39fc", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175444, "uuid": "77d2ae1f-1816-4fcf-af7a-363f5c31f061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175444, "uuid": "809775c8-935a-4bfe-bc55-48c5e5d0cabb", "value": "11de7138a9df2d5bbfeb112f8d20f2df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42b6ac8-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691114946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114946, "uuid": "76b456e9-2c17-42b4-a7e3-ba5afe9e9ccb", "comment": "Malware payload", "value": "6abe9b2dea9b77bf6815cd648e00f912", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114946, "uuid": "135f5534-d0be-4c4a-a3ec-fa963ddee9b7", "comment": "Malware payload", "value": "d95c31cabf66a9068477d100b32f43f75e7ea66361d6029d351ebfff66646244", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114946, "uuid": "c82b90e0-c591-4d9d-be9a-518d8ba8101c", "comment": "Malware payload", "value": "afefab569188899051dbf4a742e7308513763046", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114946, "uuid": "7f52ae23-6988-4dca-adde-512862703775", "comment": "Malware payload", "value": "cdee460f02e76e1697d33218f22f63ecb3fb7e72832302142f9e99e88ac46d43ad0eb4bf372427967b6b1fb59c760c9c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114946, "uuid": "589a21c2-7996-40c6-8f70-df925115f148", "value": "T14043F956BC818B15C9E413BAFA1E118D3313276CE3EE7263DD101B257B8E96B0E37516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114946, "uuid": "1f5051f1-86bc-4b03-9565-171c89a782f3", "value": "1536:eZnJgCsrPv60HKK3PUVkTrZ4lUjk/6O7K1vhIcTXJQYMtijpkjTSl3If:4WTvz7YkTmijk/t7KhxjpkjTSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114946, "uuid": "71816b25-0954-41e2-afa6-3dbf312f46d2", "value": 58660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114946, "uuid": "cf10a2f8-3503-4762-aaf7-83ee691a8866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114946, "uuid": "c3625cfd-0543-4926-a47f-f76ba2f3f1a9", "value": "arm6-20230804-0209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3b4bc7-3303-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691179867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179867, "uuid": "c219e326-c5bf-42d5-bf6c-1c83437c11ec", "comment": "Malware payload (RedLineStealer)", "value": "4df0cc6516c1adc6440b65fb8f68ddc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179867, "uuid": "08076ff5-fc43-4b13-8cb4-787ecf548eba", "comment": "Malware payload (RedLineStealer)", "value": "d9c72113c3e7929190256d66194b1cecc022a741bbdf705092196abe8e1dea05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179867, "uuid": "94412e19-7974-465e-b81b-85e83cf8f0f0", "comment": "Malware payload (RedLineStealer)", "value": "bcf265f9e570fcae9c11b0e6ac22e67a3cb7f541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691179867, "uuid": "cb337219-c267-4383-a8b1-765623ead83d", "comment": "Malware payload (RedLineStealer)", "value": "862d820d805cd48eb6fd5c9b42d123bc007ad09120de11fc53838b3a293adb8f719a2a3201f1aa64e84da244fe138950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179867, "uuid": "df780e1d-867b-4343-afb2-05afbe3eeffb", "value": "T1E303F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179867, "uuid": "f5cfc377-45e0-4c1b-b809-49ca9c3424c1", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691179867, "uuid": "6203b1ca-ce11-49a2-8d50-d63234ec11c8", "value": 40176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691179867, "uuid": "1a057f95-2de5-4d3c-b014-5fba4f9aa549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691179867, "uuid": "4835b8c5-ad90-41d8-8e2a-b02e00c6ed09", "value": "4df0cc6516c1adc6440b65fb8f68ddc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c74ebc-331c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691190997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190997, "uuid": "74c28208-dcab-495a-b4d0-25a27c6e2b1b", "comment": "Malware payload (RedLineStealer)", "value": "406913f048652a351220cb0e8fa45225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190997, "uuid": "5075e93e-aad2-4a00-8ae7-49118136cfb5", "comment": "Malware payload (RedLineStealer)", "value": "da0716da61c0ea53ce44a8465c53930e1f9b24d698d64fc739238f4254f19755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190997, "uuid": "70d1b7b3-a1e4-48c5-90cd-dd6388430b48", "comment": "Malware payload (RedLineStealer)", "value": "5e28f310b53c6dd91c7344c036dd71f00dd939c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691190997, "uuid": "23e185c7-46dc-409a-99d1-45a911568eac", "comment": "Malware payload (RedLineStealer)", "value": "5b0247571ce0b04a77e423745939bdf00ec930af9493d92e9a3d458b76b6f3d6385f1d725466a61a36178202bba77d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190997, "uuid": "3a520b51-22e2-46a1-acdb-2be88ecfa56c", "value": "T1E3E41252B7E89473EDF617F009F613830B7A7DA04C68422A2799AD1E0DB2291D4B573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190997, "uuid": "027935f7-8e38-404f-999c-1864e4b4cf47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190997, "uuid": "9879dae8-409f-42fe-ab8f-5e6f1964563d", "value": "12288:qMryy902VHKyLlAtrNG+xeR6ngyeSbSiyFHdaoH7ikp+Wq9Q23:kyweOpjeSPgpHoQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691190997, "uuid": "96915643-1f03-49f0-855f-7837e6bf8ef7", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691190997, "uuid": "dadef11e-1077-43c9-9bf9-04069379d5a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691190997, "uuid": "b324899b-acb2-4db3-8f79-eeb6f9727994", "value": "406913f048652a351220cb0e8fa45225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4dacf4-330e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691184677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184677, "uuid": "74cc5ee7-2b33-403c-bca6-fc71c6fab1b4", "comment": "Malware payload (Amadey)", "value": "4a66edca19871a3c6b3bf89bfbe200f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184677, "uuid": "9b8ea1d6-376d-4f3a-8257-89ffbdf63a5b", "comment": "Malware payload (Amadey)", "value": "da39a6bdfe579948e4358af63686d059e4c114a9c8c828b1e7febd5be352712b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184677, "uuid": "99373861-3686-4929-9a3a-73fc3dc5f612", "comment": "Malware payload (Amadey)", "value": "4ff5ff1230198b9ad2eac9ab030ee1087d63b5fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184677, "uuid": "ef1e7193-c5a7-4d5f-96fa-f09eb4a2ae75", "comment": "Malware payload (Amadey)", "value": "fb753dbd0f1b06d3318da830e20b6b74e287c929c18773d9bc4a90ebb0e8296caf266e664b0349b7014c459b2bee1a20", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184677, "uuid": "324daaeb-1a23-4041-ba61-707a9ea50841", "value": "T17CE41267E7DD9173D8B46BB018F703831E32BC62A874831B3B5A954A0D72780A571B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184677, "uuid": "13429858-98c1-4d4b-af9b-f20f007bd322", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184677, "uuid": "58ec33bc-0164-408f-8ffa-2dfc559f05c3", "value": "12288:dMriy90G4dvE2wBvnnEfy3t+hzwJHJgUPsQMvGoySmHmnfKfCh/qGtRrWQ6bs:Tyoi2w1AaBHkpOoySW+fKfC1tR/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184677, "uuid": "c00f03dc-4c2f-48a3-a990-46a53d8675a9", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184677, "uuid": "f5caaae7-3f07-4cb5-9542-0753886bd4cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184677, "uuid": "c6ade066-f15a-4af1-8464-089fb83a5550", "value": "4a66edca19871a3c6b3bf89bfbe200f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24a2524-32cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691157060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157060, "uuid": "4e96913c-13a1-47c4-8a8c-25c28bb6dc5f", "comment": "Malware payload (RedLineStealer)", "value": "a63e42537d2d574235f312d0c84e7692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157060, "uuid": "2b1c2450-6ecc-4da1-87a3-1e0be6322ffb", "comment": "Malware payload (RedLineStealer)", "value": "db1964bc95f6b2164000a03e53369775fbc0893813bd6b31c9b4f8475448520f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157060, "uuid": "23ccf313-bfea-4f6c-9917-e2699fb5ac33", "comment": "Malware payload (RedLineStealer)", "value": "5c24f1227de2c41f8242c72c556eee3d1d4875eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691157060, "uuid": "4ffb08fb-3b95-404f-a4b9-f9d1a9a5f267", "comment": "Malware payload (RedLineStealer)", "value": "cbac4b03da9d266b6b9cd3090fbbaf8d047e065fc36e1c0aed999a68feb517eefc3d2653c974e0bd5c066a320bcf2201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157060, "uuid": "14b07ca7-f46b-420c-aea0-55c3e491c25b", "value": "T1F0067C017B9C7A94D0499533D5E71C2487B7ADAA3332D20E25C432DE9AB37884FC9F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157060, "uuid": "bf7278de-6be9-4e8f-8b31-ea3663041122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157060, "uuid": "fd1b4286-74e1-4c72-8da0-83829c163ad7", "value": "98304:3yjw2aiDnttaJu4OiZrq1DfPHNADtV6v+yw:icdmT2u4O7NADtV6v+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691157060, "uuid": "e3bedd9f-3c13-4e2f-a3d5-19446cf0899a", "value": 3702840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691157060, "uuid": "1670f7c3-22a7-4951-b669-9376199b8105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691157060, "uuid": "d7a41444-5856-4831-b289-56d46eea0737", "value": "a63e42537d2d574235f312d0c84e7692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3e2bd0-325d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691108737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108737, "uuid": "b95fce9b-33fe-40d7-9ee2-b1e87fa44982", "comment": "Malware payload (RedLineStealer)", "value": "76c0d4169d73f0841ef08e2e306d238c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108737, "uuid": "64c305b0-d904-4092-9e63-371c624497fa", "comment": "Malware payload (RedLineStealer)", "value": "db87c2af550db1f10a469ff4aad2520103013e4c0a3c81654ae7d4a02e4a3a6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108737, "uuid": "b834af51-c2aa-4e13-838d-390e7a6cebcc", "comment": "Malware payload (RedLineStealer)", "value": "b7b9f6e60fb5d8654e4e872e1fdcfcedff644496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108737, "uuid": "5b19ee05-8f4e-4776-8c84-caeec0212b6f", "comment": "Malware payload (RedLineStealer)", "value": "f23f59f56b329409e0012e8562287b51a294cc5da87e282561a66cd6160db275fed7fb093d84dee4069bb871900b8dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108737, "uuid": "29377b79-5f9b-4e4c-a256-91053b22c6c8", "value": "T195C40213BAD555A3DCF257B05CFA03931B35BCA14D68920F2B81A94E1CB27C8A17273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108737, "uuid": "29be02a6-4c8b-4a9b-b3b2-6a11a99626a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108737, "uuid": "3358b995-c052-4939-bcf3-f8601eda2fc1", "value": "12288:yMrCy90VNrKlqSQPsp3y8yXrdiCz7wUWke:0yyNrKlqVurybd/zxWke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691108737, "uuid": "8cc2e9b6-b213-4483-b808-ce18c1add40a", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691108737, "uuid": "01193440-8302-44de-8402-3227c6f10d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108737, "uuid": "f6c07958-fbd8-4e49-8abd-e5640b0ce5ef", "value": "76c0d4169d73f0841ef08e2e306d238c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb177e35-3285-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691126151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126151, "uuid": "445d0dcb-85bb-4654-ab33-a7c162a17c41", "comment": "Malware payload (RedLineStealer)", "value": "a292c4d5229c28cbd13b93c8b5aa0ef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126151, "uuid": "edf36c7c-7ebf-4582-9053-65ad14eaf221", "comment": "Malware payload (RedLineStealer)", "value": "dc477f02dd4d206254829138039006a17309b453eec83b5134e0e6e5aee67485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126151, "uuid": "e4113b8b-57ff-40c4-8006-4d9480024410", "comment": "Malware payload (RedLineStealer)", "value": "2920d1dd8e0591991850ca3eb5695a089bf70dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691126151, "uuid": "95acf107-c6d3-4787-8886-f5768761eb33", "comment": "Malware payload (RedLineStealer)", "value": "a552d27afabe66dea80da74bf9a14cd280bd7f4876e93b7c7940a50db0c1d365fdd91827dd4476299737fc9ae4562477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126151, "uuid": "3531baef-0612-41ab-8268-194dab0da3da", "value": "T1ED6623E97B54716DC02AC5349433DC06F3721C8F6BA8F5AA73CA7A446F76720D606E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126151, "uuid": "ee84eac4-da74-4b26-8c47-37788dba596f", "value": "713f2679b25b10e65da54bb5dd0f93c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126151, "uuid": "0d16a1d9-1127-40a7-8e09-fc2d9143a0c8", "value": "196608:eHn1pqN6MKlMfWP8sJ2aW5/N6oPiSAKok6DFbUf0uScP:eHJMfSxPK/N7qS7J6DVPcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691126151, "uuid": "dafaf069-3a2f-4eb2-ad86-377be0259635", "value": 7027712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691126151, "uuid": "265581b9-faf7-4a3e-8e44-c299c74bddb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691126151, "uuid": "9dad959b-4617-4242-853f-68e54573a17e", "value": "a292c4d5229c28cbd13b93c8b5aa0ef0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72671e99-3304-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691180468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180468, "uuid": "710fd47a-85bd-4485-87a7-a84780e7089e", "comment": "Malware payload (Amadey)", "value": "936bd2cd6fca6e3c3b961a38c63e02e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180468, "uuid": "e5c30b08-79b2-4cec-95bc-975581e456da", "comment": "Malware payload (Amadey)", "value": "dc4cb6dca531a08a2f95ddadaa16b04badfb3d033dfd4d50f19ed3c663fe656c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180468, "uuid": "930c0d5f-f088-4bf0-91c3-85807add2643", "comment": "Malware payload (Amadey)", "value": "f5970980a8f33ba29f823961bb8e0874bdd51b34", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691180468, "uuid": "5eb63b21-9f13-49c2-8252-1e95fb9461bf", "comment": "Malware payload (Amadey)", "value": "449d234fac0b6c6c506440fed96439a4a3330bfdfc879d6702aece1b6d5012e3d9bed944f08682e26e3c57a1a76e9ec6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180468, "uuid": "0691a55a-9b2f-4f15-8ba2-14453be750ea", "value": "T1D8C41243EBE84432E5B157346DF703C31A387CA49EB8C22B2785695A4CF26D4A276737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180468, "uuid": "6a726606-8391-4a2c-ba73-5a8243d40393", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180468, "uuid": "f8c4e783-f3c3-4bb7-acb9-e245ceb293dc", "value": "12288:CMrRy90kMDf0YVxW47Brr3a0etJKbYJuX:PyDXYLf7hrKvJKbGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691180468, "uuid": "05f88cf4-cdb1-4dd4-9e19-416ee3d18ffa", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691180468, "uuid": "566c133a-cd9e-4b0d-98f2-3a2736136734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691180468, "uuid": "48bc9992-5094-430e-afcd-f0e4215c204d", "value": "936bd2cd6fca6e3c3b961a38c63e02e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb9686d-327b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691121648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121648, "uuid": "5e084c1b-14ec-457d-92e1-c1172a3f02c6", "comment": "Malware payload (Amadey)", "value": "d9fd6522ebdf60a33310d2937cfdf710", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121648, "uuid": "4dc97ae5-3801-4615-8516-d4af3232f7e5", "comment": "Malware payload (Amadey)", "value": "dd4bedd93a95a8f4eaf5e4a924b3d1a226cece0659b2013460f8e9e5dfbb6cf2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121648, "uuid": "a2f1c488-cda1-4d73-ae6d-390e4f39925e", "comment": "Malware payload (Amadey)", "value": "125416f8b2b6ca0b1b73b48277c49fc435daedd0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121648, "uuid": "be3ba4f1-b0a2-4af6-9d64-d8ac4d977547", "comment": "Malware payload (Amadey)", "value": "5975a8c0c37384e05cf7c7b8ac3783e1ef768c21cbac255d6589e9b3625423f0791304d76fd768cddcb802747c8ec368", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121648, "uuid": "dc6d5e3c-6f27-4d34-9459-3e4aa31c0b52", "value": "T123C41217E6C98473C9B60BB158F612930B35BDB19A7C836B3795995F0C72B807432B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121648, "uuid": "6ca59a7a-122c-4fd8-9896-169a2b5fb183", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121648, "uuid": "fd4eaad9-e8bd-49fa-9a82-674696f71cc3", "value": "12288:EMrTy90B2fuJMgHEt3zyyJT4ipnQgkGsjgQ:XycJMf3uy54YQgkGMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121648, "uuid": "8f091f52-0ba2-4452-b86a-e0e0682bd729", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121648, "uuid": "99af2ccd-157f-49ed-9f19-d7e8de6975f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121648, "uuid": "a81c49c4-e1b7-49e2-b23a-8b2632bcc93c", "value": "d9fd6522ebdf60a33310d2937cfdf710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba195c97-325c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691108433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108433, "uuid": "e2f87d02-f440-4644-947a-82444818a5a6", "comment": "Malware payload (Amadey)", "value": "3f08a00227a18122b7fe6de3a798b94e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108433, "uuid": "5af9ea71-ca51-4c91-84ae-c82d1faa231a", "comment": "Malware payload (Amadey)", "value": "debaf7dcf5d1f90f362f901696b335f9644d6bccb725655756b9bcd0b6911e41", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108433, "uuid": "3f673a4e-dac2-4c5c-963f-ed215f2abfba", "comment": "Malware payload (Amadey)", "value": "0799bcec58703c516b60a1c032f403e052f3f30a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691108433, "uuid": "317af0fc-aa91-4858-9347-091320ab41ae", "comment": "Malware payload (Amadey)", "value": "884046a7a99b8a50bd20b274dad38796d5ca8c8b192372f907e8ec38ef1878ad4efb320df888743fe23845a3d57f9b8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108433, "uuid": "154dfa82-4fc8-4a54-a8b0-b681001de165", "value": "T19DC41256F6D98073C9B257B01CF702D30A3ABCA18935932B7795991E0CB26C4F8367A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108433, "uuid": "ed5ab388-bc91-4608-b2c8-9cdce9c50288", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108433, "uuid": "7dc163e0-30e8-4536-b738-bbf0d1415225", "value": "12288:yMrvy90u3ejjNuR9wCIpk2vLLiRTbQ1+pJm:JytRDwtk2DLobQALm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691108433, "uuid": "d2503e31-23b2-4a84-bd62-6ebbdb3c5412", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691108433, "uuid": "6ef99a87-2fd0-4c75-b6a3-651147239845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691108433, "uuid": "beae0630-202d-43ea-bec9-dae484ef82fd", "value": "3f08a00227a18122b7fe6de3a798b94e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e9480c-32c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691152179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152179, "uuid": "6001d296-d611-4725-b0dd-31a03737a9ab", "comment": "Malware payload", "value": "2421abb14a21a9af5cbfd79b4d31453e", "object_relation": "md5", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152179, "uuid": "18999f66-c2d2-445d-8802-403d83ac73d8", "comment": "Malware payload", "value": "df0b57d6c4b7e16fc7dc113c4e947cbc7d867254607d0e5e01ebf6806497760d", "object_relation": "sha256", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152179, "uuid": "1e937ae3-fd5b-4a35-b579-0bedd3124e0f", "comment": "Malware payload", "value": "611bff992073bb75fd4ea03f51ca5140625b39d4", "object_relation": "sha1", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691152179, "uuid": "fdc8ead2-b7b9-488d-b1c1-a40113651d40", "comment": "Malware payload", "value": "f254ac30bfd0dda07c6843dcad561c29556086f3089d42983ef2dfb02d3de74f1f6098be1ea90d7de9c2bd80df5d3826", "object_relation": "sha3-384", "Tag": [ { "name": "hiqsolution.com", "colour": "#9DEDA8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "thanhancompany.com", "colour": "#8D6AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152179, "uuid": "aec96a8a-2159-47dc-b2a4-cb951d8c1870", "value": "T171018848517E9B70A44C55338B2F86F5B1F5EFB98533581A356795F07011128FDD1B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152179, "uuid": "add75944-dd73-4c96-ac0e-23ae1499dc8d", "value": "12:oEOrn6MvwHeGMScG7DtARDo8uc7KApTThudqnzoUpq8unmgY0x+Upz2f7cB/d:ZOrZw+GMScG7DaRUJoKApcon9pq8QRWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691152179, "uuid": "68fbe31d-02cd-46e0-b849-9ee84451534c", "value": 691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691152179, "uuid": "b813ae8c-718e-4028-987b-88dec68f56e7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691152179, "uuid": "a3f009cc-43c7-48af-9939-1767b9ef2d51", "value": "CONTRACT 8375735.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0979c5af-32f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173850, "uuid": "2490c537-d2fd-4c51-8fcb-6793cbd2f392", "comment": "Malware payload (RedLineStealer)", "value": "460f0e93fe94ebe348908edb64c74640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173850, "uuid": "ebbf9949-d586-4182-9ea6-e98b9525fdcb", "comment": "Malware payload (RedLineStealer)", "value": "df711a4a4387539214745dbc880414174cc9341d96ca4f699602f085a13ee56c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173850, "uuid": "31ee3b1c-22c4-4222-a205-f7487cf0e9bf", "comment": "Malware payload (RedLineStealer)", "value": "3e8f139aa4fafda5084badd3498604f89fcc3e61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173850, "uuid": "04e9a860-08fe-4dac-9d2c-f1068ce4af5a", "comment": "Malware payload (RedLineStealer)", "value": "707ea0101965f3d210626774059760c5da7d3c41241ab9d5fdfeb844a49901e2ae764853d306ab04b2e51b02bd9a7bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173850, "uuid": "1f9454b2-2378-4af6-bcaf-7031c338766c", "value": "T121E41203EBEDD127E8B1177065F603930B397DA19C74976723859C8A1CB3AD1A5B232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173850, "uuid": "b063ada5-ac63-415a-819e-09a95c3b57a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173850, "uuid": "5e4f8a05-968b-4cd3-b57c-cf3ad43b86a3", "value": "12288:8Mr5y90lbUO3bCjfM0vTCMxV/y51AH62MBN2wMcWi:9yoo6CjRvTCm/G18to1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173850, "uuid": "f681de7e-1e3e-4938-956c-452ee6b947a8", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173850, "uuid": "262e793d-7aff-4fd6-a46d-70b8d8b5340d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173850, "uuid": "f3ac4373-6959-430b-8ad5-220dc5217667", "value": "460f0e93fe94ebe348908edb64c74640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacc51e2-32b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691146310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146310, "uuid": "0bb555f1-2b16-475f-a458-95da800f2b62", "comment": "Malware payload (AgentTesla)", "value": "4e988640f45cbc7eea4f571cc84ed427", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146310, "uuid": "ae35ef60-2304-4bfb-9d2d-da34ef179ff7", "comment": "Malware payload (AgentTesla)", "value": "e1073b8aba6fae31a51d297541016a72ac1bfb5d201ca385b58d4353bee5b500", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146310, "uuid": "af221238-6184-46af-a8d6-3568e38868a6", "comment": "Malware payload (AgentTesla)", "value": "7a75ab94084fd8ddc5010e2b594ff898ccf03187", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146310, "uuid": "108ecdd2-f922-40ab-ab70-79f6a2a9af77", "comment": "Malware payload (AgentTesla)", "value": "c21cc5ae7c453b83cd6c8a4bbcfe9399c4cc0a535174406676c96a9500c31b2c35bdff913c483eb2735ad424e689b9f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146310, "uuid": "e1e9aa05-0d2d-4370-bc5f-6c8162d75288", "value": "T1AE24122522A0E09BDD7309321F7963367EED651611E8198B4F609B5FBC63243DA4E733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146310, "uuid": "cb145d56-c969-4429-8123-ffddf6ea5d9a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146310, "uuid": "8ca15b39-da22-45b3-9e18-1c2ded2e81cb", "value": "3072:3fY/TU9fE9PEtunbcy15jet+DeXUFSb54CUFWiPqyRnzQPAJScBC2i3GxqHB6xUu:vYa6JcOAPEYb543M7yRnzQAJdWzhgUwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691146310, "uuid": "55a4ed9e-ca35-4162-b99c-91b572c77b9c", "value": 212830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691146310, "uuid": "0c34a619-289f-4dd4-92f8-bf9c35b5b854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146310, "uuid": "24eca0f4-6cb7-48d3-9b7d-609dfb8bd33d", "value": "e1073b8aba6fae31a51d297541016a72ac1bfb5d201ca385b58d4353bee5b500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e245b853-326b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691114943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114943, "uuid": "4163c630-9cdb-44d8-ad5e-d996f5e9432f", "comment": "Malware payload", "value": "d9ddda68db49f969ec57fa5237c42ce2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114943, "uuid": "3d65e615-6c5e-4589-ae42-8161ad1641b9", "comment": "Malware payload", "value": "e1b1dad78fdec2b5aa9054d0a104ef71323bbd3f487c5793772b253a33891932", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114943, "uuid": "03d5cb45-1c85-470d-ac67-3c6076d6af3e", "comment": "Malware payload", "value": "8de9056423ee692397c2ad7d98ed447da99b22c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691114943, "uuid": "6d97f2aa-0de8-422d-aa04-f82020b35464", "comment": "Malware payload", "value": "3565698f93d31c7138c0fc694384ba796a14ddfcd2dd777081d89c08cb33fd830d7ee4ca53dc7b9f6fea9a52375e6400", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114943, "uuid": "fa30f680-bf9b-43d6-95f0-113b46cc7081", "value": "T1C65395196D119FFDF7AC873047B38E21A759339627A0D6C0E29CD9106E7064E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114943, "uuid": "653f1c87-5a06-41b9-812a-abb7a90c368b", "value": "1536:xB4VKWN7mJne5zMr9F1qpELwFKfS9nIrnxyNaYcYT:lYO8pELwFKfprnxyUDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691114943, "uuid": "2dbd21b0-48b0-4a67-a020-2e634d00807c", "value": 64708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691114943, "uuid": "de79bf17-6e23-45c0-ab7e-968de05c7a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691114943, "uuid": "e904b626-1961-4c80-a8fe-ff224869b4ea", "value": "mips-20230804-0209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a27c08-32f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691172412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172412, "uuid": "e0c9979b-1652-4a05-82c3-c141e132bdd7", "comment": "Malware payload (RedLineStealer)", "value": "db5d6e81d896b2da95591afc2ce2b66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172412, "uuid": "a1ce58cb-cd40-49c6-9506-32b88f3a71ad", "comment": "Malware payload (RedLineStealer)", "value": "e58b5a3526a5b42be36a7cdf94d17035f76df9fed7db09d3982330a61986f7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172412, "uuid": "d372f065-3a35-4a4f-9372-c19ede722f8d", "comment": "Malware payload (RedLineStealer)", "value": "93eae3ad9535bfde70fdd9d3658c476af95617ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691172412, "uuid": "39200ce0-70ba-4e1d-bc32-d4cf71a00ddc", "comment": "Malware payload (RedLineStealer)", "value": "dc244052f2a7028d3d5c2949407eecbdb907ef778232bda581409459ef2bcdd710f1a8d14a4cb788228bbbaa92fcbcbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172412, "uuid": "d0a43165-ca24-47f0-8389-1179f2641759", "value": "T19C848D0262E17C60E5265A368E2EC6E8771EFD90CF586F9B2218FF2F15B11A1C573702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172412, "uuid": "60b4640c-1a9b-4035-8cee-704ad6212eac", "value": "e9d58d04128ce66edda6debd8a6afcde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172412, "uuid": "2c20c93c-b907-48fe-ab60-d6760bef99dd", "value": "6144:3LD2rZeB6xuAyTN8/7w/DtUX+da59iJdBf7c:3LyC6xuLgMa59ij1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691172412, "uuid": "3bd05abf-36b4-46d9-93ee-3969dfec479c", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691172412, "uuid": "a5676441-9122-48b8-a69f-1d982c8bab03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691172412, "uuid": "af991e71-2384-473b-b967-00625e750142", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a212d36d-32ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691171099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171099, "uuid": "967977b7-4c27-4a4b-9f58-9d653adbbfb3", "comment": "Malware payload", "value": "d480519a428e4fb030a2e3e0d76b0d04", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171099, "uuid": "d398941f-7364-47b8-a7fc-1d7f83acff1c", "comment": "Malware payload", "value": "e64eb11237cb2dcfb47736f167f281fe0b8c50a0ff1762502b60c72dc9fb0e94", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171099, "uuid": "c941041d-f39c-4daa-8946-9355cc115ecd", "comment": "Malware payload", "value": "3a86cbb847c01a4f69fa52c6afcd240dacd0f6c8", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171099, "uuid": "27c37b0c-32c4-420c-96e5-d35527abbe00", "comment": "Malware payload", "value": "4faf5504778bf888ae056e6ef97a9d5f6f3dff45d8d2e7e1403f5114b34a44e56b902dd394b14d5883e176071dffa0a6", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171099, "uuid": "218d6a3c-410d-4a31-95a8-40fe44f368a1", "value": "T1F852F8296BE44334EABEAF765C72A25006B2BE04D823EE7D09D4E4191D732548DE1F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171099, "uuid": "02868abb-14df-4437-b544-9e943e081861", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171099, "uuid": "0673b817-b5af-43ec-a9ec-73342a7c2c21", "value": "384:KFpQFWA/5z1NMptStJuufchFdsB2krAKHW:+pQFWw5z1NMKyh8lr5HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171099, "uuid": "59cad8ef-b449-42e9-b806-671eafad1d54", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171099, "uuid": "c5dacb18-c976-4523-811e-e90f9120fd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171099, "uuid": "f9144026-fdab-464b-a2c9-2c2ebe29908f", "value": "1691171097ca89b8ec9cd33911271affb372785d9eedf282c31b2ec641f055d41e7702dd6e714.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b62547-3300-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691178964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178964, "uuid": "cc4842ac-84a6-42ef-b0a1-9ef4a54a4410", "comment": "Malware payload (RedLineStealer)", "value": "c9e318adb07ab6632340899a5c12a028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178964, "uuid": "e9f163f7-ac11-4f9e-9571-382d2805e476", "comment": "Malware payload (RedLineStealer)", "value": "e73b6e0b78cfbaf10de179f78ca3bc65d003312b04c6fdd95d7ff03afd3dc3cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178964, "uuid": "b9a131e3-1e53-47f6-ba8d-cab9ef85a59d", "comment": "Malware payload (RedLineStealer)", "value": "bb5c76e3b78469e88f3ae20cf4b7b7d56a0d1c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178964, "uuid": "f371c36d-16cb-44e3-9605-3d2850a4914b", "comment": "Malware payload (RedLineStealer)", "value": "7cb4cdb19ba9694e0de81f8b01a46475f2feae85ad015643dc7bc68398fda2275c7305a22d2d95792279246e7acf47cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178964, "uuid": "400a4c67-ee36-418c-bb07-093726d03712", "value": "T14EC4021367D8C133D8F2177058F206830A3A7DA2AD79D3193352A95A0DB27D4D676B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178964, "uuid": "da83d4b5-7d2b-4b60-b336-abda98c9fe7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178964, "uuid": "efab7f1b-61df-4247-a8e1-c9aa8a207750", "value": "12288:fMrzy90bR/InX5u1t/6RGHQYt24I0r+gBYC3+v2qneTMEhYKPclmND:Ey0R/InoZr24I0rdzE2qneYEYKklmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178964, "uuid": "454b8370-a435-4e20-878c-b9e40c83dc03", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178964, "uuid": "e1dd3b0c-9330-4e77-8366-f48340bb0741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178964, "uuid": "a638c53a-e695-4570-9a36-a5923678c1fb", "value": "e73b6e0b78cfbaf10de179f78ca3bc65d003312b04c6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94893074-3282-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691124691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124691, "uuid": "e190e23c-a552-4e90-b9c4-341f87a1160f", "comment": "Malware payload (AveMariaRAT)", "value": "84fc75d62738624137845bd3c180ebe6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124691, "uuid": "c85b2648-351a-46de-b7ee-1591344aae18", "comment": "Malware payload (AveMariaRAT)", "value": "e75dc39789d3c249b58efe4ba0c25b9087d4c693a082ad8c5ecc4119ea4dbfd6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124691, "uuid": "d2cdb9cf-6bc3-4c67-9352-f309aeffb19a", "comment": "Malware payload (AveMariaRAT)", "value": "abd5d37769d16a7dcd7fc318cb749b4c8685f79b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124691, "uuid": "edfb93bd-5f6f-41b6-928a-27888751717e", "comment": "Malware payload (AveMariaRAT)", "value": "85c7a3780fecb3b76f822ec40b8a32e85978c418a7f2fa206dcabbbbe828991a49e6d7a09de2a8c55aa1bd73f306df93", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124691, "uuid": "f62b55a1-3e2f-4892-b456-12b08db26016", "value": "T17A43376DD38F02A9CF5262779B1A1A4442FDBB3EB38151B1346C533533EE82D91262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124691, "uuid": "002325e6-cc57-4e3b-bd95-9416e4ef0b0d", "value": "768:LwAbZSibMX9gRWjDp+aXhja1ExecNnjDk4MJdPPiN6mb0D:LwAlR+4ada1yeijDk4MLiwmbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124691, "uuid": "95d636c0-f343-4e5f-950a-f4c8a1a086cf", "value": 59528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124691, "uuid": "97ec9357-d04c-48b0-be2d-6b00d6724d11", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124691, "uuid": "23bfdfe4-7219-43ba-b298-863a78506130", "value": "84fc75d62738624137845bd3c180ebe6.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778fc7f2-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691130226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130226, "uuid": "298de41e-124f-4aa4-9d4d-9f5a1869bb54", "comment": "Malware payload", "value": "6a0d23ba6ceeccaaf2eb35e5d7cb15ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130226, "uuid": "95119f90-6add-4f0b-8c1a-56f024eff7b6", "comment": "Malware payload", "value": "e78d279bee32937f649c86b37acca81a85c01e10a5742f4477d0469efe12155e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130226, "uuid": "62c9dcf8-c645-45d8-8f0a-86cae62b5fca", "comment": "Malware payload", "value": "b796d4fdd30e6b7263e55759628a5ab512b79783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130226, "uuid": "a56db431-5181-4af5-8efc-0dfc16da2b2c", "comment": "Malware payload", "value": "cde8cb6feb69d9f30b72722e7ec84b729309934c4af17db5e80e68070aa0209f69931d1fd116fb0191bb8122f9454bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130226, "uuid": "a720a916-4636-4c6b-9007-f172651961c4", "value": "T1B6F4026973BDC817F57D4AF448E2D16403F2688A1A2AE2ED9CC139CE62F5F4B5900B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130226, "uuid": "8e052cd5-86e8-4423-af3e-3d777a9e7705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130226, "uuid": "e9ff25e2-78f8-4189-aec1-51cca72398eb", "value": "12288:OnjOMxnVhS1rlmwKlN9uZ+QT2L/t9SJTknCuQIwtb+Y4BByKQ7hs957hX:OjOMxVhSB0JXCSV9SLvSrBIKmuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130226, "uuid": "fd19bdd6-b44c-4386-9821-8d2de2c12488", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130226, "uuid": "df6a5520-9a02-44b5-9a37-2b5d0032c3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130226, "uuid": "5fd406c0-fe15-4058-9f1c-103e26033b78", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986fb66b-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178385, "uuid": "313803ef-d237-41e6-aa28-38e290d09090", "comment": "Malware payload (Amadey)", "value": "483528e221a25ba69d564b90709c8679", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178385, "uuid": "c7767c7f-0ed3-49bb-af09-a356c565b66f", "comment": "Malware payload (Amadey)", "value": "e79543a6fadc4b5c843a7bee87aaf92c15721b5c17e4b9ae237806893fcd669a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178385, "uuid": "f94aa8de-a01e-4f5e-a8c8-f112305f5528", "comment": "Malware payload (Amadey)", "value": "786cb0d22e1edc538876a64fa605106cbc8ca221", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178385, "uuid": "76c84e7e-9c3c-46c3-bff6-f2d4ef864119", "comment": "Malware payload (Amadey)", "value": "bc9b715da1909d6e6ac09cc1dd80ecd442573e24cc4272997ad9766b569c8ecd1d164a46f16241dcad6d685a651d629d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178385, "uuid": "28f063b8-e851-4046-945b-a08c38fbd127", "value": "T139C41223E7EDA0B2DDB02BB188FB01831A357CA6DD7997672305A4590CB32D4967173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178385, "uuid": "928502cb-93b0-43dd-bfa1-c130ef7dc4cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178385, "uuid": "f4201227-e167-4d36-af3b-4a0206eda90e", "value": "12288:6Mr2y90hYsO/TQD0jJOYZrt0xQpgBYCh93c1XXGvk35hUlat:Ay3sO0DKgYltKQyzf3c1XXSkJh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178385, "uuid": "dbfc514a-34e9-4b93-93f2-503dc846adb4", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178385, "uuid": "3c5d8302-79c5-470b-b5b7-09bcc8d4dcc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178385, "uuid": "2fd2be8d-d3f1-49bf-9215-de7348d115d5", "value": "483528e221a25ba69d564b90709c8679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9530e7e1-330d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1691184392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184392, "uuid": "6e1ad84d-1176-4183-9eb8-d255d3a362cd", "comment": "Malware payload (Vjw0rm)", "value": "d65a553af676282e15cb3ab7cf998998", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184392, "uuid": "32ef0363-ba9a-4ce0-b219-e6ca4d8242a5", "comment": "Malware payload (Vjw0rm)", "value": "e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184392, "uuid": "a78bfacc-b287-442a-9801-8073576fa576", "comment": "Malware payload (Vjw0rm)", "value": "dd76b76df265973b7aea2f3ffaba45123024f05c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691184392, "uuid": "fa770852-b6ee-46de-84be-ad67377e5e22", "comment": "Malware payload (Vjw0rm)", "value": "2532c359b0f7f056f1f99f92090c06ca28ccf002926bdcfc6c6b100316daba95108225270223349d7550475b052d6ab2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184392, "uuid": "2b41b840-c6a0-4794-a474-de341eb9f40e", "value": "T1D781229C284B863C53D27B8A802ED148CDF548B47F28D2B5149CDAC5360E975C7B19BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184392, "uuid": "d4c02863-78bc-4206-9691-30fc5de1466e", "value": "96:SABNo5DLk2c24ZRMHXE6/BIE+Ys+fJHdDdQqR7bJyKUgOS4UK:zSM2c24ZRMlBI/Ys+fJHJfRfCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691184392, "uuid": "6c41aff4-4da0-4f9d-8b92-0db120b95ee3", "value": 3901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691184392, "uuid": "5f96d17d-b08f-4bc5-a1d3-0c7890d35660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691184392, "uuid": "5ed56dfd-ea6b-4c86-94ed-b92c3a32d744", "value": "Scanned.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bde3bac-3274-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691118637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118637, "uuid": "d6a45051-6872-497b-92e3-df064d957a8e", "comment": "Malware payload (RedLineStealer)", "value": "e19d68de55dfc7c81506d9a4965e40c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118637, "uuid": "29ff248c-4de2-4483-9c90-b570c5856931", "comment": "Malware payload (RedLineStealer)", "value": "e9c1ce7060981088f38457a738e12477f9c0c8d1528153dbb3aa39609005b1c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118637, "uuid": "7e4596cb-5a75-44fc-8518-ef78a1e271cd", "comment": "Malware payload (RedLineStealer)", "value": "e4a98b75ccd882f4d29483b462a9542fe3299086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691118637, "uuid": "6c4e33ad-f2c7-41ab-bbf8-200891a3fae1", "comment": "Malware payload (RedLineStealer)", "value": "6bed41ec78c79a1e2f9b443266356b86fb60d9e824c53d819dd893a61768551704eb74bb3bfda26ba8faf9a83fa295e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118637, "uuid": "35cb249a-c338-4c15-844f-ebba271f11fb", "value": "T187C41263E6D881B3DCB61B7098F702970B353DF60974422B2741A99E1D73B98993237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118637, "uuid": "fc0315e4-0507-44e0-84c5-49ca2f50127e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118637, "uuid": "8f718931-c71a-41b1-8ec6-effcbad33fad", "value": "12288:KMroy90N9FPleY9zuLcaB1BiFHb1q3K/:+yGle8SLcaDBGZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691118637, "uuid": "5f9dd78e-b082-480e-b5ae-57bbc62e018f", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691118637, "uuid": "c3b10bfc-adf5-4d15-8199-c045f43ec758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691118637, "uuid": "8045c646-0b8a-42fc-8d07-e5b63e81087b", "value": "e19d68de55dfc7c81506d9a4965e40c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6540e56-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124372, "uuid": "59a72749-15b5-4101-8d7e-659ac32665d9", "comment": "Malware payload", "value": "4ae1d7b4316412476c7dd8c3de5aa9db", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124372, "uuid": "9be08dfb-3721-47c9-8ad8-3ad40e24b9a9", "comment": "Malware payload", "value": "e9cf1ddb7c2301c6001c43358d7a8b1ec1d29563b9898127a205d64d5d8e4eaf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124372, "uuid": "4a821607-d930-42c4-9a1f-c8e7ec77d513", "comment": "Malware payload", "value": "fa6c18f3891221d21c38e4819095ee9d5226a2dd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124372, "uuid": "92d410d8-6316-4adc-81cf-309c73ac2d38", "comment": "Malware payload", "value": "050da45db19fb09fae0f8644061660e5b40c16be2d80552fe3e7abb711d1b80db020a83851752451b413a09866360dc7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124372, "uuid": "5fc24fc7-f63a-43e8-9415-3e4e1c080281", "value": "T198E4239C46D058287C4DF1BB667722200989BAC863DB14D9C914F87BFFEACD627C921D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124372, "uuid": "1b46f7c3-3356-4d09-bedf-9661efaa98ba", "value": "12288:UNtzpUPhrEiKoD1PnvfuVlfXSivJQp6/9ltWDAMiTStnWkSuEBlAp1rnw:UjzDmPnvfuLfXSivqp61ltCAMiTAnWpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124372, "uuid": "7ccdf68d-b8c7-4d7e-a324-c27ab61b36ff", "value": 682573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124372, "uuid": "82d5ce8a-a39d-4873-b51d-ade0511da37d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124372, "uuid": "d3976493-d5d1-4a69-9114-b4a1d7389817", "value": "03-08-2-23.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f89a4f7-32f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691175712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175712, "uuid": "d25f9506-276d-46f1-8102-a96c12d6838d", "comment": "Malware payload", "value": "87c5e0323049fb19c46cba988f525038", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175712, "uuid": "efdf9a26-602e-412a-a1be-f9356bc5dc4d", "comment": "Malware payload", "value": "eac716271ac8b624a2415c028578626a1fdfec31c69dfb7ebf07de247b817a33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175712, "uuid": "a745e123-f4bb-44b3-9fb0-e8235cc6ea5a", "comment": "Malware payload", "value": "7710788e98f8ec58859e10693da862d50b59ffa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175712, "uuid": "aa30941f-7802-429a-946c-1950cdbf9b8a", "comment": "Malware payload", "value": "7840161f5cd0229080462dcbcef7c889f1d9d1e8a6b2b1c38085deb247763436306812d14ca2046175b1a22c9aa7e39a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175712, "uuid": "82b235b1-32b0-4bbb-ad86-2b90a5f628da", "value": "T14664128A26F1895ED193027146F6ED66F5FEE1144127E6CF6BE19F6E3F224C28D0B102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175712, "uuid": "585321ce-51ae-42bf-806e-25a8204aadbc", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175712, "uuid": "68f7582e-b1a0-4d01-81fb-b788a336ddca", "value": "6144:qMMYNXqBB+nbI0OVrZWjuuo1NsSaONfwJdBTTQewR1d5uRQMtGk9nFkXrrlOx+jM:+n+bI0cEjuT1/IJdB/Xwjd5uRN1FCtOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175712, "uuid": "73b5c612-2ee6-4553-9280-4586b61e2f4d", "value": 314558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175712, "uuid": "1501fbc0-fb50-4e10-9917-ae5b4bc2890d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175712, "uuid": "863aa7f4-708f-453e-b20a-1f60df928b20", "value": "87c5e0323049fb19c46cba988f525038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc73839b-3263-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691111443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691111443, "uuid": "67a81499-962e-41f1-959b-fc63f479e5ad", "comment": "Malware payload (DCRat)", "value": "1bef4da5a885fa480121e9d44381399c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691111443, "uuid": "e675d207-c598-4a5b-8c27-19d4d56d3534", "comment": "Malware payload (DCRat)", "value": "ee65606edf7efb11bfa97d04beccddbd02e9f1ad6659714aaa889332fbbcc310", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691111443, "uuid": "0fa722c2-7d68-4cba-855c-69993eea46d0", "comment": "Malware payload (DCRat)", "value": "4f5aca22bf2df47bd4ac0e25f20479a9d0e2e9ad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691111443, "uuid": "4c6c5964-8163-46e6-950b-88848f6fced0", "comment": "Malware payload (DCRat)", "value": "464b8271412264dc0bb9a08f945eb829401da23a2b5d5e8d00ccd6ecfdf1318cf0d506f302ac31b7e9d8aac2e2e61d8c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691111443, "uuid": "816f6fd5-ceec-413c-8209-9b5a2f80485f", "value": "T14A8560342EEE502AB173FF798AE47596DA5FB7A33707985D00A1038A0723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691111443, "uuid": "ceaa0c46-5448-4961-ac5a-efffbee1dc4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691111443, "uuid": "18d9a83d-e128-4635-aa4d-28d78dcc0c38", "value": "24576:x02+Qtv0xyW2Nzh4XeMws2J+gRpRo4pRbCzU/+5PPoRBpW6YmJ:WnQEyvNQkBRp4zDOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691111443, "uuid": "41bd8ced-c4e7-45ca-8841-12d9b90542c7", "value": 1789952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691111443, "uuid": "89eb6463-3650-4926-82da-c20333145718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691111443, "uuid": "c9e1786d-d9bf-4531-b730-ac1aaed84272", "value": "1bef4da5a885fa480121e9d44381399c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feb3a90-328f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691130052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130052, "uuid": "913adce5-cea4-4978-8e31-b4d056a84e51", "comment": "Malware payload (Loki)", "value": "541f2177b845c929fdd5b93e466e60fe", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130052, "uuid": "f59c7739-1e92-4325-8296-9a2fa119dae3", "comment": "Malware payload (Loki)", "value": "efdb1f3fc62ef8d8564aa87e9fa1a0954e49837ad00e1bf83c9839b58581ff82", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130052, "uuid": "7cc7c382-91c8-4adc-afb8-c26010b07317", "comment": "Malware payload (Loki)", "value": "4aa89a2ff71ee011f91248f38b606cb6885ddcd1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691130052, "uuid": "bd3d96ca-1bd6-42dd-98d4-f32aca982b34", "comment": "Malware payload (Loki)", "value": "cd8c6fcbcde760492a647203d069ea90b4fc0b12f5748ad169fa5a70b4eb38048659cd552618abcb5428180c9152ca4b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130052, "uuid": "e8d86bb7-8e5a-4355-bd8f-0a21bdf4b3cc", "value": "T1D7A422513B62EF687A8CE6E239FF5423D7B19500FADF982035EC35339028396656DB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130052, "uuid": "23846b05-f597-40c0-9430-9847a89404b4", "value": "12288:RV8ts167+B1xG4IEqIgrgfhsol75YOruj8QK8kf01:vl3xTIElygfhzlFYOuj8QK8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691130052, "uuid": "65b8ab25-5df1-476c-8496-8d1c26f5d9cc", "value": 493615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691130052, "uuid": "de604815-3c54-4640-ae2a-9deaad6d546e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691130052, "uuid": "3248033c-a86c-4bbc-9421-003032dee8d3", "value": "AWB#2334578903123.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4742e1-32e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691164885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164885, "uuid": "83962432-41df-48aa-bdaa-1013d0ad12f4", "comment": "Malware payload (RedLineStealer)", "value": "27dd902a1d1e21f09ac1b05e5ed9b2ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164885, "uuid": "137eff24-154c-420b-ad2c-902617325a06", "comment": "Malware payload (RedLineStealer)", "value": "eff3755788d12c64a06f81b47fc6e908483886b9f9637b4061e479e72dfc5d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164885, "uuid": "1966a01f-487a-43b3-a4df-f9ab8c8a517c", "comment": "Malware payload (RedLineStealer)", "value": "0800861078b2c9181e184e5f3be4a9cfba9c230f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164885, "uuid": "bc34c06a-ec76-4783-87bf-13755a0f60ad", "comment": "Malware payload (RedLineStealer)", "value": "2d8190e57e5c774adf700cccc9bbe8df6d4c929b8deeb3131f651e49899a5c49cccd887e8aefe78d6825e0aa60e8d0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164885, "uuid": "3852f528-4a38-405e-9fa6-bf026fff6fb9", "value": "T127C41216A2E8E431DDF9577108F702C31A32BCA28DB8825937459C6A1DB36D1E93736F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164885, "uuid": "9caef39f-5738-4613-b282-68a846b75048", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164885, "uuid": "f597677a-f6f1-449b-8037-05856adc6fa5", "value": "12288:/MrOy90wH9LBWUodQWB2RnfVZks8m0iWgBYCxLa7YihKJJ+WrX:1yXHhJodnB29f8m0kzwPI+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691164885, "uuid": "469af313-758d-4eab-9fba-b932134ab1e9", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691164885, "uuid": "6aa7f331-bd12-4efe-bb18-415d5d0b1a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164885, "uuid": "8e13afe8-df61-4c32-80f8-62a9da929631", "value": "27dd902a1d1e21f09ac1b05e5ed9b2ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ae3121-3276-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691119537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119537, "uuid": "f200af94-570a-4590-9eb4-9df360b27c9b", "comment": "Malware payload (Amadey)", "value": "df4af2cb965f94746efb8505bc7fd975", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119537, "uuid": "e08ae51e-ef6d-4ca8-a97b-7771453faa62", "comment": "Malware payload (Amadey)", "value": "f0a4a5845e8de7884e52f0f5379e11488e7d0b0b1bd0b2e782a1cfa696fc23f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119537, "uuid": "e813ae76-9472-46a9-97fe-ef71fb0e7a98", "comment": "Malware payload (Amadey)", "value": "1d52f9cbf837ac4803f0debf004342c6ad6fc146", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119537, "uuid": "6a6062de-418d-489b-8072-db65079a81f2", "comment": "Malware payload (Amadey)", "value": "ad5d85af5bcffa944b94e3d61b0f7234f9123e8ef1db4cfec9a7046a2d6a468960e3c0fae1fe3cd0aa0bc578437a86b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119537, "uuid": "6c61a8c4-389a-42bc-9b0c-4273501002b1", "value": "T1DAC40263FAD880A3DAF157B058FB03830B35BDA189B8525B3795685E1C72AC4B47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119537, "uuid": "0cbc0d5e-cdf7-4345-928e-91b0a8ad9b74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119537, "uuid": "ef0d59b4-07c3-4b76-9809-090ce0fffbb6", "value": "12288:TMrMy90WDMMOGYnHAGcPy4WJwhvNlVmyi34iSZvIk6j:/yJkgvPy4W+vNfmyU4LzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691119537, "uuid": "e8e1d37e-92b8-4400-bf2c-d69fbec03df4", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691119537, "uuid": "d9ed18b3-c6c9-4025-aaa2-909b3ed619ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119537, "uuid": "f33bb1f6-eb61-4477-81c9-9de906186e87", "value": "df4af2cb965f94746efb8505bc7fd975.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee04ba6-32f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691174449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174449, "uuid": "fa94612a-bf05-45d4-a426-d737c17b4be9", "comment": "Malware payload (RedLineStealer)", "value": "0a637291f3e96cbb7645f75ff7650443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174449, "uuid": "fd38129f-0b7e-4aaa-b014-a15871c498e7", "comment": "Malware payload (RedLineStealer)", "value": "f13062d5ac10e9dc9e81f197e291a8005c6655fd83f7adb31db51d452e225d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174449, "uuid": "9fcb02ff-d537-490a-90ac-0ea2865e6ced", "comment": "Malware payload (RedLineStealer)", "value": "6bed22543b21454491038dd3685168200902c665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691174449, "uuid": "7b908a62-99bc-44e1-8da5-e14f348e2b75", "comment": "Malware payload (RedLineStealer)", "value": "d4018a6346a424062207e66e4e1e4e12d270a94f3d1530a51d0e75a5e2b9653cc2750cc3da39020245971b0c7d5cadcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691174449, "uuid": "8b006341-8eab-4b48-af8d-102c08ad6b81", "value": "T10003F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691174449, "uuid": "1e540f78-bdaa-46bf-9994-4d980e8d3719", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691174449, "uuid": "261289c5-0ce7-4e49-85f2-44c56b1e78f0", "value": 40250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691174449, "uuid": "5eb3af3b-07d4-4dd0-a7ed-2d17f8f785ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691174449, "uuid": "e6395e16-9397-4340-b14e-39747ce05af6", "value": "0a637291f3e96cbb7645f75ff7650443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696f41a0-32ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691171434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171434, "uuid": "1080bbe5-9cf5-492f-9db2-b8ea85142494", "comment": "Malware payload (RedLineStealer)", "value": "9c7660389500a0aaa846e8f74f4c34d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171434, "uuid": "6c673cd7-11b8-4e77-9f28-f5d4d38e2b4b", "comment": "Malware payload (RedLineStealer)", "value": "f20fcf4afc9881cd622612969ca4face752c1793b446ea272b4bf711f634407e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171434, "uuid": "a0accd43-412f-4a94-9161-d9f45efd16fe", "comment": "Malware payload (RedLineStealer)", "value": "43d8da3754a93ac64a1caa36faf15c31159dcd1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691171434, "uuid": "03f838cc-43ff-4c5f-83a6-25c53fc529cf", "comment": "Malware payload (RedLineStealer)", "value": "021d758a1d97ebd7b179460ad8d2f068d26d4bd7aedd3517efddc63e162df44ab96f6fc64f6262aae65d21691e32cc0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171434, "uuid": "ba228e6b-9c33-43ec-84f1-2a79b8fc361a", "value": "T1AFC41226E7D8C172ECB5277068F613D30A36BC619E78932E3705E54A0D726D0E4B277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171434, "uuid": "59924ffc-c0d6-4622-8313-5939a94a8c19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171434, "uuid": "34e2402e-7ac7-4c86-baf0-510011c860b4", "value": "12288:fMr8y90lTAY081+lWHU1vDlsUSh8pGgBYCFy9jEGV9ZL1tY:3ykA73GUw3hMzQ937Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691171434, "uuid": "bc9adf97-9d39-4147-a5da-cfd0a7d32d0a", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691171434, "uuid": "a209a34a-1a72-40f7-bb23-111b54f0a389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691171434, "uuid": "b0dde852-fab4-40b6-adff-d1b2c34bbc3b", "value": "f20fcf4afc9881cd622612969ca4face752c1793b446e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b70eb7a-32e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691165773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165773, "uuid": "24b9f16b-611c-4418-ba44-696ec241be9e", "comment": "Malware payload (Amadey)", "value": "1cdaf7b0875cf85b3cf14722003b361f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165773, "uuid": "556c13fb-3f57-4ea0-b535-427b9ad3c5a8", "comment": "Malware payload (Amadey)", "value": "f2b75d8d3e9702ea430d3c705a40bb9a0289a0257e1c329ca9da9d58bf056986", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165773, "uuid": "30ba8325-7c21-405b-b8db-14e609bb4864", "comment": "Malware payload (Amadey)", "value": "93be2e9fb1408772f91b2927249dbe24de5dba3b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691165773, "uuid": "3ddc3d44-55e1-4b06-adfd-b9b204a1010c", "comment": "Malware payload (Amadey)", "value": "b55573e6c01b49cefa5216e507800b0b6e58016672629d19c88220adc588929ca63030d7fc0d0995c4438e863e29b3f5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165773, "uuid": "10988f06-2b27-4b3b-bb45-2acaa38f66e3", "value": "T10DC41253F3EC8032EAB2077058F406D31A367D629878835B2741A99D0D73B95B5BA73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165773, "uuid": "97fd8725-cc41-4166-b834-0a2d77d4c69f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165773, "uuid": "68f2f187-13c9-4eae-9783-886f4a6efe24", "value": "12288:mMrGy90pEafGnXQrdH3qpaPcBmwMYd9FcUyDZ:UygEar5qoPQmwMgItDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691165773, "uuid": "d464307f-dd72-4fd0-ac70-d874dc9e9474", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691165773, "uuid": "77a1d5b7-4ead-4ca3-8666-a766b3872b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691165773, "uuid": "b7166494-93a4-42cc-acde-cd202bb82101", "value": "1cdaf7b0875cf85b3cf14722003b361f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d035d-3309-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691182571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182571, "uuid": "e7add2b9-0334-4cb6-8a19-1be8e816df00", "comment": "Malware payload (Amadey)", "value": "ae67ab7d2de2fea0999e12b2bede35c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182571, "uuid": "f12dfd72-1b66-4944-80af-ff6f64ff9ea1", "comment": "Malware payload (Amadey)", "value": "f379f5ba79fff2e69eb5dba9dfd8d5cf0b61433b51a4f99560684f3b883ce4a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182571, "uuid": "99d48ea5-9cab-45dc-b37a-cd75d20b2354", "comment": "Malware payload (Amadey)", "value": "d393aa5f2e17a534fb6989153725a7fff96222ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691182571, "uuid": "d164e231-b268-49c8-a946-18d736d06744", "comment": "Malware payload (Amadey)", "value": "6b20b72938bdce937067680e79e5b9513e65f698c53611bdf59ed5ecdf3e37c2b8973d48347bdb82bd9e98a3cfe3e663", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182571, "uuid": "7f3be42a-f386-4e00-a81b-6b497c709344", "value": "T143C41217AAD99073C8F11BB018F613A30B35BCB19DB4931B2754995F08B2ED1A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182571, "uuid": "c7702eca-4e22-4105-8ff4-6a7f9ef41424", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182571, "uuid": "73665375-b7c0-469a-849e-435e67094f19", "value": "12288:NMrMy90/kEcmtV3H5OClQVTtYy/QOi3HnBRW:RyXEbZnlQ5tYyoOuRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691182571, "uuid": "096a4663-936c-4f86-9d9e-5776088c80a4", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691182571, "uuid": "50069c61-9f90-45c5-851a-a4cb8e74d26c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691182571, "uuid": "ffbbd6fa-5b0b-4796-b9ed-2733ea66bca6", "value": "ae67ab7d2de2fea0999e12b2bede35c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7970b48-32d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160371, "uuid": "eec87cf8-c852-4d09-8c4e-27ab4a0a9d50", "comment": "Malware payload (Amadey)", "value": "a650a52eb98a8c0a1ebe1f3bb81aa82a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160371, "uuid": "6135e0eb-a11f-4160-834e-c704c3eef8da", "comment": "Malware payload (Amadey)", "value": "f38768ee7b36fc3933c780cca8dc326db590c4adc532c1cbb5d0ab46aebf6be9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160371, "uuid": "83709ac1-4cc9-4aa7-8011-2c109c3a2b3a", "comment": "Malware payload (Amadey)", "value": "9f4342476a88672257e4b16d465bee645e799bf5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160371, "uuid": "d193f045-4b2a-4765-a04e-96e44756fe9e", "comment": "Malware payload (Amadey)", "value": "8025716253404712db5e0a566b4882a44f2ab3ccba945ce14847b77792e2848cac5451187e8d8056b07e376dcc9e0cea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160371, "uuid": "879a21ad-cc0a-48b5-b0ad-f2acbbf69da1", "value": "T11A03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160371, "uuid": "8393a1e2-3650-49ce-afb8-1c8106616902", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160371, "uuid": "19a42922-96ef-4670-b07b-80ec90ba32c4", "value": 40083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160371, "uuid": "30d1d5b0-cac9-445f-9fcf-bc8161adda6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160371, "uuid": "29bb8e90-0587-4ebd-a52f-6ae34235d8fb", "value": "a650a52eb98a8c0a1ebe1f3bb81aa82a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be0b094-3280-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691123737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691123737, "uuid": "dafa151c-3acb-479c-87a8-d5d24749b492", "comment": "Malware payload (RedLineStealer)", "value": "03d089f1b3561d9d701502372320bdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691123737, "uuid": "898fee10-b28e-4b10-a2bb-4cc5c4e8429a", "comment": "Malware payload (RedLineStealer)", "value": "f55ae7a7b0beda4e2ec8be84cce01c8e2d67fb99e633a455395b12fabdbcdc4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691123737, "uuid": "5853f2a9-62a6-413f-8722-7115437d7097", "comment": "Malware payload (RedLineStealer)", "value": "2d123eea9c9371f215a750e15383b8bbc9884f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691123737, "uuid": "2107095b-256e-4fd5-9ac9-5380c7b39912", "comment": "Malware payload (RedLineStealer)", "value": "bd20fe57d3fce39ef837567c2898c58836abe8ac152ea6642e528075a6116d8451ef132b86a67e28d47daa2d9fe5776b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691123737, "uuid": "82751260-67d4-4c03-ba67-721a43b3662f", "value": "T140C41253F6D880B7CAF65BB018F612930A35BDB19E79834F2A81D91E5C33380A47576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691123737, "uuid": "849d5765-a20d-4683-885d-14bdae4ef9fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691123737, "uuid": "496523d5-d1b6-4c88-b889-e60727f88cad", "value": "12288:fMroy906RLmCHtR0FvhgzxvLyiWniL3gDENC7U:fy1IC8gFvLyhnAgDEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691123737, "uuid": "f529061b-ffd6-4e03-9d31-8220561ab382", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691123737, "uuid": "68254ae8-e995-440f-b80e-fcc3ce1df51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691123737, "uuid": "605b2d8f-824e-4804-b621-d9810a4806e5", "value": "03d089f1b3561d9d701502372320bdda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a19abb-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124364, "uuid": "dcfca9d9-beed-43e4-9e6e-7a2400a2f6e4", "comment": "Malware payload", "value": "fc67413bb0296c9173075a4a6b4abf3e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124364, "uuid": "cb2af3ae-8604-4b07-af35-a4ee7c4588c6", "comment": "Malware payload", "value": "f5cba593e33f1730a6439cd898f83eadc2aec631d6ad39fc9b6d71c6482f7c34", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124364, "uuid": "ea8a1fb2-533d-49db-8d88-a5ce6835f256", "comment": "Malware payload", "value": "5e758525248fb3b234a364d91836164e74da6e1c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124364, "uuid": "42ffa6ad-637d-4119-855f-38f70671125e", "comment": "Malware payload", "value": "772150e27d1578841eb21cdead1d4c3f5d18ebb6420eb7a0dc6a792fad38f50b3f381c0290ad666c733b65cfc485e4b9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124364, "uuid": "4e7520fe-bf14-416a-8623-4344839d729f", "value": "T1E0F42369A9B48FC9A193C1740D43D5DF4DBE36C945F13A08F00FBBE5DCA85BA219342A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124364, "uuid": "b903dde7-6293-431e-b3e2-0f1e338e282a", "value": "12288:ylLWWFDsED1RIDxs9ss5w25aT54BCjeuDnKEIoMwmVGZ8mDCgK3gGtx:y59sEDkS1K2M54BCawnKEIDGZ5JK3xtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124364, "uuid": "b79621fe-6cd5-4f53-b4e1-8240c74aa7c8", "value": 741846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124364, "uuid": "b90c5280-847c-4dee-9ea9-b6213b4656de", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124364, "uuid": "cc28ecad-87b6-45eb-bd45-29d1ffc3da49", "value": "pago de la factura 11-369013..xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecb0104-3306-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691181375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181375, "uuid": "0441752e-9cb1-4e1d-9372-b948d8e4c0fd", "comment": "Malware payload (Amadey)", "value": "a039816a1837d40b0bda1f0af318ce7d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181375, "uuid": "648fcb48-4e7c-4c43-a21e-63f44eeeb29f", "comment": "Malware payload (Amadey)", "value": "f64a139edbfdae414bad954970a6e4651a69bb3f579f7a2a0cdeef614ed3f370", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181375, "uuid": "56ae0dfc-3e54-4cd9-aa8c-82d240a6d034", "comment": "Malware payload (Amadey)", "value": "d2282beaf000e495fec13aa5ba3248c04c871d46", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691181375, "uuid": "247064d0-098e-4d73-8d12-93ceeccce331", "comment": "Malware payload (Amadey)", "value": "101093779242fb70f250612bea78796964b5d5c980cbd4b2df8dd9e5b210982826711cec15693f9ce0f1873ed563bad8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181375, "uuid": "6ed4583e-e6e0-47a6-bf7b-25a7d342c0a9", "value": "T1C103F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181375, "uuid": "56ecc286-4641-447c-90c0-a86be61132f4", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691181375, "uuid": "133bb865-4e3d-4a22-b2d7-b82b4b35b503", "value": 40397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691181375, "uuid": "3d9b842d-6e0f-4b3c-a33e-6c3ba8ac19c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691181375, "uuid": "e5c25f00-9cf9-4b97-b948-586332502a12", "value": "a039816a1837d40b0bda1f0af318ce7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ece099-32ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691155723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155723, "uuid": "e8a2a7a0-3584-462b-bd90-4acddf15c920", "comment": "Malware payload (Amadey)", "value": "4e18de4859663d03f7b5ee6b73dfa746", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155723, "uuid": "f9bc2d6e-95c0-49ea-9e47-ffc4d9edb56f", "comment": "Malware payload (Amadey)", "value": "f68d27da41855f12c5b8fe1225b34f3cec8af1bddef5931e39a7ba7be97dcf2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155723, "uuid": "93d9fe77-3d03-486b-abad-e653ecb4218a", "comment": "Malware payload (Amadey)", "value": "575fd4dba64ecbc5df5efb19494840546cb1b4e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155723, "uuid": "2d23b58f-792e-4ee3-bf4f-6537d6396406", "comment": "Malware payload (Amadey)", "value": "c131ff6cf16b44e78d0021b201dbefb7037e5900344298a2d16c673147e0ad1131673466f620770a8e93842fc010e345", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155723, "uuid": "a4193c8a-5eb2-4565-8d65-49f78397f456", "value": "T1FE34E042B7D89033D8B127B01CFA07C31B36BCA19974836B3795695A0CB36D4A97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155723, "uuid": "19761d91-df49-4e88-a34b-f144fa1007cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155723, "uuid": "51d0ec6a-c23c-4360-9edc-cf6ad9ed199c", "value": "6144:Kxy+bnr+Ep0yN90QEbRbpvz9PPuUktBG:rMroy909n9PmUk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155723, "uuid": "db2c4c75-2eb2-47b5-89bf-0226749cd33f", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155723, "uuid": "294878a3-7bb8-46e2-85ac-2a2b8d1a684c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155723, "uuid": "59790f96-6df6-45ac-bde9-cedfc14b184a", "value": "f68d27da41855f12c5b8fe1225b34f3cec8af1bddef5931e39a7ba7be97dcf2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c058e787-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691149246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149246, "uuid": "9204ac58-8181-4486-939a-d620d082513a", "comment": "Malware payload (RedLineStealer)", "value": "e523ede92526b3dd58124e38f5394fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149246, "uuid": "825530e6-c278-4b5e-bddb-8c21aec92cfe", "comment": "Malware payload (RedLineStealer)", "value": "f6b54d0b60e4f677f9b9cf69ad3c90d23fab5e21c5ba28d08356295fcab1eee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149246, "uuid": "9f3e185f-9892-42fc-9c23-3db1102fc49a", "comment": "Malware payload (RedLineStealer)", "value": "f8c4fb82408953b96c10f5870428045982014e43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691149246, "uuid": "5955dc47-2063-438d-bbea-e674c9a8bb14", "comment": "Malware payload (RedLineStealer)", "value": "72fab661961bd96d3b10fd7071bc8542ca59fd5643e60d9211b346be60dcfda5bf80049e344c2e4bbc292a2eae1ca0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149246, "uuid": "52c8aa5c-3431-4e43-ba64-43422f19bd93", "value": "T1C0C41213EEDC4077D9B22BB058F706E31F30BCA25874832B2795A95F1873684B57276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149246, "uuid": "9e44fa99-f8b1-4305-b318-fd669da665d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149246, "uuid": "59f47bdd-cfb3-4a05-bce8-6071eec9f15f", "value": "12288:gMrTy90JN90vmc4+7FMBlxxnQQ+fCG2y6igivC6cMy:DyCNSvmh+sAvfCFytg4Cz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691149246, "uuid": "4cf44aa0-2182-45ce-bcf1-45b9fb7df9fe", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691149246, "uuid": "8c7470f8-1ef6-475e-9339-039cec033d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691149246, "uuid": "7ce3c51e-0009-4641-a265-1dc59375edac", "value": "e523ede92526b3dd58124e38f5394fb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6a691d-32d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691160354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160354, "uuid": "8996f923-cb38-4259-b4a3-a13b783dbc9e", "comment": "Malware payload (Amadey)", "value": "1a614550ca83505f7513629647cbdd57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160354, "uuid": "a77e5c59-eac1-4bd8-bec2-24db3632e381", "comment": "Malware payload (Amadey)", "value": "f6c2e5cb95a45c4f0b994fc8c7adf406db2bc0f3c56a8046fe5d98ae2cc2706b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160354, "uuid": "d909080c-0914-4578-aaab-55385540b41b", "comment": "Malware payload (Amadey)", "value": "995ee2faba7f9b59e58156bf47a0114e2b3fff77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691160354, "uuid": "43abce01-9177-4cf3-95b5-a754d59bb66f", "comment": "Malware payload (Amadey)", "value": "8ce4a9b18e1227e49ed4a1eb41f629204b012af69b08780d3fe175e3715ec3abf332ba3972b74b8031df02b1554eaf05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160354, "uuid": "152f3a2a-1852-4777-bd66-38eacd376829", "value": "T1BFC41212ABD941B3C9F51BB05CF707C307357DA1A93886AB2B55885B0CB3790B172B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160354, "uuid": "3a908e53-f10b-421d-984b-ed4ba8691972", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160354, "uuid": "5e045f15-1183-429a-b9fd-c03f124b856f", "value": "12288:9MrAy90zKSKIyRNDGa5A+5xbeT2aZeyq51iKf7BxT:Vy0KIYhHF5mrlC1f7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691160354, "uuid": "95d0bcea-aeaf-4e5e-9c4b-fd2720f93ea7", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691160354, "uuid": "2f3047cf-bd20-42ef-891f-92e9eb3e8c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691160354, "uuid": "944aae6d-0067-4a55-a7b6-bbb3e006345c", "value": "1a614550ca83505f7513629647cbdd57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b206b-32b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691146249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146249, "uuid": "4ac10c30-93b3-4580-bbad-ab57d91401a2", "comment": "Malware payload (RedLineStealer)", "value": "a2a4550a77b17d40f100dc2f003d9e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146249, "uuid": "16bc1b59-cf25-4e0a-99d4-e8dc871bb856", "comment": "Malware payload (RedLineStealer)", "value": "f741e86acc38671ca9a689ea910f2d4add6a798a810b13c412144434ca6823f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146249, "uuid": "0ec14c9d-7cc9-446a-b327-8c24a9fcb256", "comment": "Malware payload (RedLineStealer)", "value": "9db9c7725f5f2ceefb9f66357ba2a4077db8671a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691146249, "uuid": "d7c379b8-d75d-4141-a1d0-45f9ad2f1e1e", "comment": "Malware payload (RedLineStealer)", "value": "197be4c604d1afe5920386794fe537186a0b86e63007809e58f7e3b161870f7b356879bb6e9ace6b14ef3c30e04d6b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146249, "uuid": "116a6afc-e2ff-4816-85f5-aca4d838a468", "value": "T128C41242B6E880A3D9B54BF028F717931A30BCB1ADB8875F1785554E1CB3B856136B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146249, "uuid": "305eb022-c7e7-4b6c-a3b0-bda86a4902a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146249, "uuid": "99d5d4bc-d7b7-4406-9279-63dc636d800e", "value": "12288:JMrmy90QRv56kEHH4LykstPqKExayN5NiTAXGGON5:PyZVVPFayDayDNcaON5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691146249, "uuid": "3af66e4a-6d61-4ac6-b9ae-5c3937c772c2", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691146249, "uuid": "930c6db4-b752-4b15-a1b3-7226333bc647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691146249, "uuid": "3d194a91-10ee-49be-b281-6219fbd7fa6e", "value": "f741e86acc38671ca9a689ea910f2d4add6a798a810b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083fa27b-32f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173848, "uuid": "e35a021f-8480-4056-9bc7-bb2130bcb9f5", "comment": "Malware payload (RedLineStealer)", "value": "7cceca19e308794acccf53747e12b21b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173848, "uuid": "812a12cd-a52c-46f0-8399-cceafb6483ad", "comment": "Malware payload (RedLineStealer)", "value": "f81c515e6deec83a0c100a8e4ba2eeb143e8b0181229734f51934d17c5d56eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173848, "uuid": "063b1d45-4fb4-4a7d-bb0f-d38fa17c0116", "comment": "Malware payload (RedLineStealer)", "value": "355c89013a63104cf2e7b87144c4aa4c3b7a823b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173848, "uuid": "e5b2262e-a24e-4f88-bf33-67a173098aaa", "comment": "Malware payload (RedLineStealer)", "value": "bbea257e936b7e8d0d4e1cb82d49888ff0564fa28449e1e11e1c994e05ce6f9fb124ebde0c1ad14250463ab3ae3e5f42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173848, "uuid": "a1ff24f1-0ffd-4a84-94aa-200e3510a4ff", "value": "T108C41226E7E99073ECB027B089F943D706357C62AC74A72B274AD94E4D736A0A474733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173848, "uuid": "6045b398-d3cb-426b-8d12-74e33db338b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173848, "uuid": "3c7ac69a-0799-4ac3-b63d-7a2d567bf55c", "value": "12288:+Mr8y90q5vHsyLQbhVoAKxP6tF6gBYC8lCdEsZp2NUyxDi:myVlrQbhq3SzHdlpuUui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173848, "uuid": "0e3aac25-da7c-4448-a491-f8bfca3da5b6", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173848, "uuid": "8630f881-7c26-4215-900e-7d4df9bb0de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173848, "uuid": "5dc45de5-f998-4820-90a8-61f4f3791c2f", "value": "7cceca19e308794acccf53747e12b21b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa7597-32bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691148960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691148960, "uuid": "245a1987-acf8-4f65-99a9-dd9066c5e4fa", "comment": "Malware payload", "value": "8bc0679a225731f6e4e41212fc7b98e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691148960, "uuid": "ca6beb05-6839-480e-8c3d-96e999d8f699", "comment": "Malware payload", "value": "f82b63420881ea689d3d01e7aee66845442c828f63372fbda39a94a970363734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691148960, "uuid": "5dfb2462-2516-43d2-b520-7035193d92d1", "comment": "Malware payload", "value": "354e96da4137a010682abbbed07539e4c52d02e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691148960, "uuid": "c8bcbf36-c801-4cf1-826e-378b683e80ad", "comment": "Malware payload", "value": "d59b697d7b7426a2f55d34d9c6437b1185260dcaaf5c1c7672fba5f07fc459acaa79a8182d10b0bf856cdd1500391209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691148960, "uuid": "fe988e90-c89d-4eb2-b75a-8eaa3f4aa0e0", "value": "T1F2C22982B67C4760CB98CB7ED9AFC454073DEBA65047C38D704BA3829C1239ADB95EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691148960, "uuid": "a6fbf44d-7a63-4876-8515-e6bf19a7514b", "value": "384:ahF4brsSYQqWvRKCtz8GXIwoES9Xd3AO06uv6NndQyulgB0WQ3eIR:eIrsSYQFvRzoGXIr1Gv+6KPjIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691148960, "uuid": "66e0ebb6-661b-4ad2-8536-24531e7bcb81", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691148960, "uuid": "f3caec54-eb9e-48b8-a55f-8e2a3aae1a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691148960, "uuid": "0d327956-c9a5-4ba1-8f3a-9e5c2c9b6a7c", "value": "f82b63420881ea689d3d01e7aee66845442c828f63372fbda39a94a970363734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57302a9-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691124397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "08be9697-67f1-4349-b4db-b4a2c739aa8d", "comment": "Malware payload (GuLoader)", "value": "a7154fc76746640a74a084b384a73167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "9530192c-3fcd-4f12-b0d0-479ab44510ed", "comment": "Malware payload (GuLoader)", "value": "f8de8a1c7444291f99f4ee2f1e2fe81ca27d2b1b195705a7dba0219b66961db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "24258f4a-959d-420a-bd22-697895b73cbf", "comment": "Malware payload (GuLoader)", "value": "3537207cdb5727d0becbf746b993d6930e497416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124397, "uuid": "b50bbd5e-081e-476c-ba0d-b903fe0b31d6", "comment": "Malware payload (GuLoader)", "value": "be297bb851fa66d792e24b9ad073604c3171d94d5062c0424802c4b58c2e04393f1eb2460f032756fcbf9b969794e763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "96ad7fb9-d8a6-4f2f-88a1-62f41ae866fd", "value": "T18A6502112461819BE596EF30F36AEBF647185632A4B312763976187D8CF3F00BF291E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "fdfb07a5-815a-4c9d-8166-d43cc7192c64", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "976abc3f-79ca-492c-b348-db9d1ca9f9a9", "value": "24576:3y8I5+eb8yxWHy9+9tLFOk7UVvT/WNQY97gGLkZAZoHTzXFYx6hJQFfazuTovJRI:nUB/WmY97gY84onVu66f7zLDwWKMkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124397, "uuid": "fa21f9cf-d50f-4786-8547-cd0054acb34b", "value": 1541784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124397, "uuid": "704e26f4-583c-4ce3-b4de-de100270a331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124397, "uuid": "be10d493-ce7c-4ab2-bad1-f7f972e2a082", "value": "Solicitud de Cotizaci\u00f3n (Universidad Aut\u00f3noma de Centroam\u00e9rica costa Rica)\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73641fdf-3320-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691192496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192496, "uuid": "1e273c47-86ae-4ae1-833d-daee6cd0d488", "comment": "Malware payload (RedLineStealer)", "value": "263502bebfcb4729f66d6c74837c8ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192496, "uuid": "bd924858-de30-4a2d-ac35-841a9fc21c2b", "comment": "Malware payload (RedLineStealer)", "value": "f905c2321ca9868dad5d29a3c8979106ecdfd83452e55f8dd235d82237b22d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192496, "uuid": "9519403b-5d23-47ba-a0df-abc497fac9ad", "comment": "Malware payload (RedLineStealer)", "value": "4f42a7deda23150430001272152f453187b1431d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691192496, "uuid": "9ab0dcac-06d0-4965-8d90-9a41ad575072", "comment": "Malware payload (RedLineStealer)", "value": "c330357dec3bbab36c7e955bea11330536e157af26d1592c24217f8d267ee089f46f2abc3e82199020874476ef5328b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192496, "uuid": "5749f55d-267f-4e42-ad6f-3d25f35ceaa3", "value": "T1A9D4125297E8A532D9B51BB014FA03C34B35BC724E7983AF3395AC8E0C726649973727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192496, "uuid": "fd119237-673d-4d3b-8a77-c32eef4647b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192496, "uuid": "c517c183-e366-4bdc-ab7d-9f352f62bf0a", "value": "12288:QMrzy908lnA+C3t3SBixGYyypKcezinWBEFHlJfN4aMCQsXC:zynA1tC4xqlcHphHN41CdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691192496, "uuid": "b9bfdddf-f93e-4903-ad07-075a6cdcd272", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691192496, "uuid": "ebd0b0b4-108f-4eb9-aa65-45bbc8b800ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691192496, "uuid": "ae5a0b45-540d-4ac1-acbe-8c3cebe309aa", "value": "263502bebfcb4729f66d6c74837c8ce4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291a66f5-32e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691164883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164883, "uuid": "9eaf128f-9870-46c6-a9db-b0d395835189", "comment": "Malware payload (RedLineStealer)", "value": "8bed60e244869a8a8a87d763722bbff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164883, "uuid": "b5598a4e-990e-4cfb-9509-753397b51e82", "comment": "Malware payload (RedLineStealer)", "value": "fa3034e4ef2a9fece1b0934d64a254a887a3722163017e6092176d64437d204b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164883, "uuid": "4f9ee0a8-dd29-4a52-9c6d-f98af72e1640", "comment": "Malware payload (RedLineStealer)", "value": "a736bcf38f87699481f6be485cd8a44d5f67186d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691164883, "uuid": "aa172bd7-ad94-4d2e-bd33-e026e22e7f39", "comment": "Malware payload (RedLineStealer)", "value": "ec47f077f7f8d16f431f76fd6964da44547d59af0ab98f4aad983755753811da018b869d76cbed61ca2047d7eb7503b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164883, "uuid": "50e6092b-4021-4634-81e1-3a1d58204104", "value": "T10FC402539BDA8532C9B817B418F616830B36BDB19D79436B2385996B0CB32C4B93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164883, "uuid": "dc73eaf3-9d1a-4f6c-87fa-a221fe8ce5a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164883, "uuid": "fa2e8f3c-b377-498a-83d3-71038e80229b", "value": "12288:XMruy90BQdXGeSfBX7KIBvqnI04m6QkDwKzTM:9y1JZSfBXPBvqVm08M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691164883, "uuid": "13a9d394-7db5-4a2b-be23-154e780e45b9", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691164883, "uuid": "04ef8ea8-9e45-4b41-a64a-e7a07573f3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691164883, "uuid": "ffd5b22f-b930-4b7e-84a6-acf27d60e4f4", "value": "8bed60e244869a8a8a87d763722bbff4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796b3510-3312-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691186493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186493, "uuid": "7669ab6c-9c60-4ebd-99eb-f2297bc33a3e", "comment": "Malware payload (RedLineStealer)", "value": "1774d7d08009535048fa9ac4fded8750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186493, "uuid": "cc1aacc4-058a-4aff-8f64-507e73b22693", "comment": "Malware payload (RedLineStealer)", "value": "fabefecba25e23d3de180336783f809e3e733de3a1d6c56e86b500da48ad3b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186493, "uuid": "8c3a0c95-79c8-4b36-94ea-5a30dc6fa715", "comment": "Malware payload (RedLineStealer)", "value": "31537b32dd45a66de37a9a1cc81d5225ef734f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691186493, "uuid": "693c6006-f18f-4ecf-aa90-514f21326aa3", "comment": "Malware payload (RedLineStealer)", "value": "d87570544b2318a596bf6ba2e582c13c37839dd6ddec4e9a68b46203e6fa186866abaf30766107c3b9e20c96f361c67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186493, "uuid": "25705b12-2978-4fbb-aac8-8faca91c472f", "value": "T1F4C41253BAF951B3DE71677018F602971B367CA29DB8976B2741989E0C333C4A87132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186493, "uuid": "67bef849-def4-4683-ae65-3085f28d0a63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186493, "uuid": "66f45853-e717-4c7e-8f55-8e50097304a4", "value": "12288:5Mrsy909tCe6Yb6aJu+PuUjlPUi1gBYCnCSSzxKW0:RyvYb6Yu+PukPUiuzHSzt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691186493, "uuid": "161c1b7b-a685-4d34-b752-337acc843cc9", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691186493, "uuid": "37544a03-5eed-4c47-b193-ae34299e7cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691186493, "uuid": "f904a62b-5e87-4dbd-905d-966d9abac80a", "value": "1774d7d08009535048fa9ac4fded8750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887fb848-32f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691175351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175351, "uuid": "cbc572ee-5866-4065-89fb-5322c9488ca7", "comment": "Malware payload (RedLineStealer)", "value": "552e4ddb72f5dfffcbb5cb27c983c0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175351, "uuid": "852e2e97-2b55-4b40-995b-04c30e541d5c", "comment": "Malware payload (RedLineStealer)", "value": "fac79d1d65a18121e2c6c80e6fa59baf0ecb5466acf1db4e25ee7cfc7ad3e2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175351, "uuid": "605d85de-b8d9-4df7-82fc-57681321633a", "comment": "Malware payload (RedLineStealer)", "value": "eb3148e9a6889e0693e79e0f0d834073e9404ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691175351, "uuid": "d2f87522-b5b2-42d0-97ca-a8e7b2fa42e2", "comment": "Malware payload (RedLineStealer)", "value": "296badd001dd4d61c0af372152fc5e2480b7c3e4961b2cc6cded12c975419b736786ed618a1173339f8170baebdd15b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175351, "uuid": "91605fb6-c982-4246-a7ca-b16226aa86ae", "value": "T1D9E41203ABD86533D5B417B068F753D30F327CA18C78866B7782999E0DB2A809A75737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175351, "uuid": "fde1b7ae-37b0-4850-86c7-415af846d01f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175351, "uuid": "bf8bb2d2-181a-4a6f-b6e0-d8ab23557d7f", "value": "12288:UMrKy90Au0Qi/B1wfeYgYu9C80jAlhHTZQQjSb9Falrp:Gy+i5efIYgoI+EQPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691175351, "uuid": "4155ab7c-ce9a-4d37-91e6-c9fd6b59fcf4", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691175351, "uuid": "d1956a23-f18c-4c3f-ac4d-ba71ca18ca71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691175351, "uuid": "f514d666-0804-4014-a6f5-4421f4fe0f52", "value": "552e4ddb72f5dfffcbb5cb27c983c0b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b6df14-3281-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691124374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124374, "uuid": "c814b7d3-adb1-415c-8c33-f09023270ff7", "comment": "Malware payload", "value": "89b08e6cbc8cf66703b6aa8c69791806", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124374, "uuid": "637c93f3-fdc3-4c13-bc05-5be6131ba94b", "comment": "Malware payload", "value": "fb7306a4840ac9f3f64ccdd99012e4704c07aabec357cad2616e818e476cb32c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124374, "uuid": "4775a282-90e7-496f-8454-09a66d19a6fb", "comment": "Malware payload", "value": "bbf14557ca66c60fb3efec8d8d2a9a30280fe434", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691124374, "uuid": "d7198a34-bd9b-42d1-9ec2-5dc45bc8c464", "comment": "Malware payload", "value": "baf93f93101fbb0463c2cb1041ced1aab150aab0b50d4cdd8640419ec1d0975a91feabd12607c745d1eb044a7a289253", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124374, "uuid": "96e7fe9c-1fb5-474f-bae5-209712b39b9c", "value": "T1A4B423C9D19978A2D010E5B5DAC943A9435642DC79FEC323B2C43528BF85FC1AB3BD89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124374, "uuid": "46c8c3de-cbea-4fe6-83b1-f46ac8618c5e", "value": "12288:QVkUHERDmjdk/ZZ3ymMnXyeHhMQQnxitUQpC3:QVHLWPYnXysSNxeC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691124374, "uuid": "ac85dca8-6527-47c3-a61b-24bdd86a4b63", "value": 530437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691124374, "uuid": "706b2508-4b13-4212-b777-10f12f4d2558", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691124374, "uuid": "6ccb210c-40f4-499e-b129-329dc19c9d8f", "value": "SHIPPING DOCUMENTS OF MV STAR TRADER.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c2f589-3275-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691119245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119245, "uuid": "1cb974d5-49ae-4895-9fa1-f9ebeab21ad2", "comment": "Malware payload (Loki)", "value": "4ae93e205ad3f9223519d4bf2684344e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119245, "uuid": "ebc1ba1e-e86e-4dd5-bac2-69fada262df2", "comment": "Malware payload (Loki)", "value": "fc3f21ed9a524c059f340dfa59faf810856d9b41aa84bcc8dab3d2a586cda3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119245, "uuid": "fa0f9d51-25fe-4203-b7c4-153f2ca0fbf2", "comment": "Malware payload (Loki)", "value": "da2bd1372f1553866f1ba88c8d970f39364d1424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691119245, "uuid": "2eabb050-b200-4161-a676-c387920ed2ff", "comment": "Malware payload (Loki)", "value": "12317f4a6a56aa29e0590aacfc8ba1625a97e5b359a68ff8e12b3bc2be01f4cb9d1bc0f17b2cf19f70851767c9d61973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119245, "uuid": "d8c99061-5d4c-4869-9d78-4487250b0ac3", "value": "T15DA31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119245, "uuid": "902f2e1a-64e1-4ec7-a181-bc0e2de4aad3", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119245, "uuid": "8b3d91cb-5283-44c4-afb2-0e865933440f", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqNIzmd:nSHIG6mQwGmfOQd8YhY0/EYUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691119245, "uuid": "d5153971-05f0-46f5-95c6-7a10ca900512", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691119245, "uuid": "173be2a8-09d8-4629-8726-6f581a70744c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691119245, "uuid": "75ee2018-a577-4ace-8744-b4d898c12503", "value": "4ae93e205ad3f9223519d4bf2684344e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2efe7e-32f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691173239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173239, "uuid": "fab356b8-cb70-417b-a49a-2c9e4a05ba3a", "comment": "Malware payload (RedLineStealer)", "value": "886db1eb081f55ee58c5250978034e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173239, "uuid": "775dbaaf-39b0-4f88-ad2c-b29dcf8cb8dd", "comment": "Malware payload (RedLineStealer)", "value": "fd62797c9c0e48df613fd527d76c360ce3fdfbf9ddddc46d0a6ea0ba967a04bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173239, "uuid": "5a960c5f-b51d-4444-8439-c15a1510c180", "comment": "Malware payload (RedLineStealer)", "value": "7871942b1a8dead512d9e7fb1037c592ee245967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691173239, "uuid": "9846d5bf-0b95-4995-a22e-05739fe24697", "comment": "Malware payload (RedLineStealer)", "value": "a327b196f6d9c10368c59f792d52ec6fa898505246e1da5ca12d60937a0bc0a42cb60807b385a53a715d6e489af253c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173239, "uuid": "ac9708f0-39d8-4ebd-a15d-82b380f85d19", "value": "T1A0C41216A7DA45B2CDF00BB05DF122C31E35BCA24C75832B238A985E1DF3690B97576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173239, "uuid": "22f5060a-32ab-42ab-b353-48ae400c1dd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173239, "uuid": "ae1f7abe-99da-4526-a0cf-e1f662dc9f68", "value": "12288:FMryy90sKTf5v4D7207CSDOs8RCYwEVwENXygBYCvJ7DC2SWxw9+:7yrDq0ys8RCY8ENXBzdoj9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691173239, "uuid": "f280a61b-c759-426d-b07d-7803f07a5a6b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691173239, "uuid": "a33481eb-5c83-4207-a3f7-7470b7c92e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691173239, "uuid": "1aef6a24-20aa-4a7e-a979-a9e7b3d7b718", "value": "886db1eb081f55ee58c5250978034e4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38776742-32ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691155460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155460, "uuid": "e379705d-ee38-4c6e-9cf5-127f63fa59ea", "comment": "Malware payload", "value": "6bd3273352289296f8146124ece714a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155460, "uuid": "63246cfb-99e7-4a66-9461-ff711e9645e2", "comment": "Malware payload", "value": "fdaa58c31f2dc4803a04573ac30be4bcea154c9e71b575d308adb46e174d5ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155460, "uuid": "a0b8d836-232c-4136-885f-8bb6a5d44dde", "comment": "Malware payload", "value": "42701e1742500546e4437218d5eb36311fa2c12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691155460, "uuid": "50c13cd5-8cb5-4da5-a9d0-82cfb5152813", "comment": "Malware payload", "value": "18ec51c3fd033554d9bd4a38d48712aab9d332d9fe43cbd08ad663e0c8c831f512c711b201039f208b132789fe1250e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155460, "uuid": "6b4fc603-cad2-4bd4-a82a-6baf294f9cd6", "value": "T1ACD3BE26BBD5CD92E1161B364883C7B91BA5FC54E9B1825372C02F5FACB7281DE22707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155460, "uuid": "2e133de2-d9fc-49ff-ba17-bcc710c25c02", "value": "1c16d819803cfc46dc666a97a5cd486e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155460, "uuid": "970a816a-6609-4d40-b15c-acf5738468ef", "value": "3072:OpLNSpPo0IQOSniEzAXaMKmlwO04rc5MTd40LwJVs:ekPo6OidzjwwL75Mxus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691155460, "uuid": "9be811af-7131-4628-b923-0a16f14f2ced", "value": 132176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691155460, "uuid": "806be505-dd45-4ac5-bd96-b0e93b8e0457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691155460, "uuid": "56fa19dc-5193-4ea4-93eb-ba2dcbf5de3d", "value": "fdaa58c31f2dc4803a04573ac30be4bcea154c9e71b575d308adb46e174d5ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b20c12e-3270-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691116837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691116837, "uuid": "52d3ba00-e84a-4b36-a6ad-2a576412e8f8", "comment": "Malware payload (RedLineStealer)", "value": "3c042c47327b31e7be6245e52bf58c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691116837, "uuid": "6e5e2a82-f5db-43ea-a042-12759a406f0f", "comment": "Malware payload (RedLineStealer)", "value": "fde04e2fa33af64e75281b1205f21012632cee26a3fe5d3dfdd709aa6347c834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691116837, "uuid": "c7494133-b6ac-4890-ba15-25a184f0bd35", "comment": "Malware payload (RedLineStealer)", "value": "fad77f2d99fcc1212c25aad8570c5b7798ae490f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691116837, "uuid": "7de0999f-7d11-4739-8ef2-c584cc9438de", "comment": "Malware payload (RedLineStealer)", "value": "e96fb248d75a4a91efa61f718abe6a562ba356de3a67b1f767d543b90a42a97acac247b166252094a80a6bce256fc6be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691116837, "uuid": "b48d0d5c-003c-48ab-a717-19d6faf8c1a3", "value": "T163C41217EAD980B2D9F15B7024F313D30B3A7DA14939471B2B85995E0CB2B89E47273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691116837, "uuid": "b1e652f3-cbe3-49b5-ba17-7f77941ff8d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691116837, "uuid": "d2f19a76-9494-4b16-b16b-967c4b7a1f3e", "value": "12288:DMrOy90mFfTdsRohgL6pjfGmr1ib9T7CE:ZyfJTmRJL6pqg1wEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691116837, "uuid": "180bcbad-2706-4881-8711-3a894da9223f", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691116837, "uuid": "cabee427-200f-4f7b-b101-352d32a9abf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691116837, "uuid": "7daf3562-cb6f-4cf1-a1a9-0e11ee4d9801", "value": "3c042c47327b31e7be6245e52bf58c95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce739988-327a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691121352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121352, "uuid": "620c4e5c-1819-4941-b943-f9654f84d631", "comment": "Malware payload", "value": "0968370732b25d494adaa6bc18b4d9ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121352, "uuid": "f15c7d59-0578-4fce-806a-149cabc3e26e", "comment": "Malware payload", "value": "fdf7fe4c32a5f1481cc8240aade6d7dd88c3b54853284de400bd7a4c84a70dc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121352, "uuid": "a988cbbd-3608-4b93-aee9-1240a283e5ca", "comment": "Malware payload", "value": "f86d46a5b9c082510336a10927f3d751d18e61ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691121352, "uuid": "7ad6d522-4619-406d-a349-701939bc18d4", "comment": "Malware payload", "value": "6474ba32690adff82c10c205bc45998bd738ce03a852c7109900d6e0c6ebe10b4d669b0bca4e3f17a5fea73aa3f692ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121352, "uuid": "6563e09d-79a2-4a95-bf0d-daa27c241a20", "value": "T1C445230C5A7A5317F6FBC7F19A813EE07E24EC02D69956C066D0D22D8C67310F680AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121352, "uuid": "80043da9-0abf-4682-b8f3-ed7ff9c55a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121352, "uuid": "71a35f4c-0813-491d-b993-6df3a48860f4", "value": "24576:pep8xy45bbLaFbFDuoztl/aVLSypCdbfwIBGBTKK4cJJ:xxymbbL6nuLpmjwZFl4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691121352, "uuid": "b533b75c-fda1-4898-8e18-0217f00c20c3", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691121352, "uuid": "9b1bc5f5-5cf1-4b41-b43d-5c6ee775b5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691121352, "uuid": "135f9d7d-5d30-4d11-9e18-63b99a7dadc3", "value": "0968370732b25d494adaa6bc18b4d9ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d82f1a-32d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cerberus)", "timestamp": 1691158899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158899, "uuid": "3c47e4f7-f314-4328-a334-505c4ff8b595", "comment": "Malware payload (Cerberus)", "value": "0baf6e89df2f0f5d6c320c5df8eca842", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APK Evde Kal\u0131yorum", "colour": "#740A7D", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158899, "uuid": "32f2fbdf-d664-46b7-89f8-0d4201099cc8", "comment": "Malware payload (Cerberus)", "value": "fe329c93c8a90149e50f48acaa77702e071290aa58203fc886fead002ff46094", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APK Evde Kal\u0131yorum", "colour": "#740A7D", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158899, "uuid": "46219fea-fc26-48c2-877e-8fc800ff358d", "comment": "Malware payload (Cerberus)", "value": "f4c1ffb898bd3cf9ef8200c44c4903921916096b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APK Evde Kal\u0131yorum", "colour": "#740A7D", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691158899, "uuid": "8ef387f9-d2ac-4b59-9161-84fc177e26fa", "comment": "Malware payload (Cerberus)", "value": "9ea6346b4672a45a04dd52c3d5e2d49d268441989f6969dbabb999d6cb827eed822e1c4075e0b197085b3265de5d3bb6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "APK Evde Kal\u0131yorum", "colour": "#740A7D", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158899, "uuid": "7d484f06-edb9-4940-8436-e1cea9291791", "value": "T14EC533259E8BFE09EA3916F540EBD6E620BE1351384BF3EB15769041C4779E9824CCF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158899, "uuid": "f20c5c75-f3c5-4a59-a754-afe2c61ac1d2", "value": "49152:oYfIeRMV2PUsWamyygA0TksmHaCXje8HFmErX+Eq9:o0WW40TkfHad8NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691158899, "uuid": "8c2ce7b9-45bb-4a9a-9211-d04613fdda0a", "value": 2674077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691158899, "uuid": "5126bee1-1747-41dc-9b34-fd2eac670fe4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691158899, "uuid": "c30acd92-7128-430a-a2d8-0d5ed6e9c7bc", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd78d35-32ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691178367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178367, "uuid": "ac2c62f0-d59f-4883-93cd-50081fa652d6", "comment": "Malware payload (Amadey)", "value": "42852e4c035a15b7a7f0cbb6bdbd9e69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178367, "uuid": "0c15cc7d-969d-4d36-8cce-1638cb96af0f", "comment": "Malware payload (Amadey)", "value": "fe6bdad8008480794dec8f285d1e90a6a365a6235693620e9b67ccc49fa5c22e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178367, "uuid": "43e90214-830f-4ee8-9f0b-818e4186ce73", "comment": "Malware payload (Amadey)", "value": "41a4f5d6db31333627af3c1f6365f3bb302fdf91", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691178367, "uuid": "d632b3d3-d045-44a3-a23a-eafb39d8a820", "comment": "Malware payload (Amadey)", "value": "fc7fd481342354a673eff3216aedcd32de7f1e16973a9f2af62145eec3a056ed13afb489329ee161c04ec6a28aa25dd1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178367, "uuid": "fbf7da87-8009-41f9-901e-3b292d2e1e74", "value": "T16DC40207A6E95023DC7567B059FA02830636BCB19C38836F3346AD5B1CB25A49A3677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178367, "uuid": "202425fd-76de-43e6-95a2-6ada785c73ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178367, "uuid": "84a2bbbf-b58c-4192-900c-67e93ccbe6c3", "value": "12288:OMr3y90/WaTeJmcDhdgYiiQxPcqhu+gBYCLm8BC1YmUqmqthYb8QZX:Fy41aDhmYiiAPrcdzS8gdsqItZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691178367, "uuid": "d97defd5-4f91-49cc-a41b-3b129cf7f1a4", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691178367, "uuid": "6e736ad0-0d11-40c2-95f7-ebb56f587eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691178367, "uuid": "8e3ebc89-a518-4db0-b5cf-b373f9d06724", "value": "fe6bdad8008480794dec8f285d1e90a6a365a62356936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1921aa7c-326c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691115035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115035, "uuid": "6904ad19-aad4-4df0-92de-d1db146e70fc", "comment": "Malware payload (Amadey)", "value": "ecf92bc716a86f833d6f5270d011aa72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115035, "uuid": "fa3c7f15-9b70-4031-bc0f-40d89bb8829c", "comment": "Malware payload (Amadey)", "value": "ffdcf0bf727a9c45badd5028283404d2d34ec7f7372e274d4a97ee3b69081d7f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115035, "uuid": "f811e5b2-f2ee-471f-a079-f1a40ec379ae", "comment": "Malware payload (Amadey)", "value": "e40cad4c85750e9978a712e2cc380baf4793de4b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691115035, "uuid": "d80e73a0-990f-49ba-add3-d8779a5655d8", "comment": "Malware payload (Amadey)", "value": "779d155f969c8c3738a86fcb0c004d14104cf71b3be2389561845c9cb3f1be9db096f2077355c6ff0b22d411170a8637", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115035, "uuid": "91c8cf7e-6bdc-4a71-9690-9d337e9238ea", "value": "T107C41243A7DE90B3D9E41BB068FB03971E39BDA14934875B3685A94A4C726C0F836737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115035, "uuid": "ba554821-c562-4b25-905d-fb08a5860e4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115035, "uuid": "a8c0c3a7-0fc0-4f06-90e3-373439bdb114", "value": "12288:vMrDy903bqYs2eakfm9i4uPLwTBFiyEuMsZg:Ey2PeakfmsxwdFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691115035, "uuid": "64b58d93-14de-497a-8480-8a68fb39af59", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691115035, "uuid": "af908242-5500-4442-8c75-29fd07b4b342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691115035, "uuid": "573cee83-6ac0-4039-8148-2d29ce592307", "value": "ecf92bc716a86f833d6f5270d011aa72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }