{ "Event": { "published": true, "date": "2023-08-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-02", "timestamp": 1691020981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "500bd5b6-e5a0-4393-a481-4cda306e76bf", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64095fe8-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690997908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997908, "uuid": "3ac77d09-224b-4377-ad31-0d162f6b9afd", "comment": "Malware payload (RedLineStealer)", "value": "34fd90ce74e675a31efe89642959c731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997908, "uuid": "d37e86d3-4151-40f2-93fe-3befa15018a1", "comment": "Malware payload (RedLineStealer)", "value": "00ae0e7d430a80c94763a556dd0e254941e763ddfc9ca662801b01f2493f727c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997908, "uuid": "0b8c670a-6be7-4ca7-8427-9437ab799269", "comment": "Malware payload (RedLineStealer)", "value": "1a7e1c9868c10d3722aa39b236557f3c345c27fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997908, "uuid": "0ca2f15c-4a59-4d0f-bcd6-30e8bdbf3cd9", "comment": "Malware payload (RedLineStealer)", "value": "500057bbb94d0dc9f89675c9036c6887547468b13fb2fb7eed4b07ae16df4a8c252e4392beb48c5aa399cf076f8f4cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997908, "uuid": "6f3a2b81-e377-40fb-a34f-2d0c90aaac79", "value": "T11EB412426BED9423D8B02B701CF603C30F36BEB19E7496663346995E2D726D4A932737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997908, "uuid": "8a1157d5-293e-4cfc-8b75-ca2ac79dce41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997908, "uuid": "b90f5166-48c6-4886-902b-257136aebc78", "value": "12288:qMrLy90W6PSweqYvowU+6leDiYBSOSjtR45M5ZW:xy6PN1t3erYv0M5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997908, "uuid": "82fbc263-0d54-4f2c-8569-a9308fe4af7b", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997908, "uuid": "75a7e04d-abee-4bab-b64a-afdef234b2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997908, "uuid": "85f0a5c4-53e7-43e3-991d-87c769f9a028", "value": "34fd90ce74e675a31efe89642959c731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08854021-3122-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690973273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973273, "uuid": "ee0d63d4-43b3-48cd-ba9f-c56258979c78", "comment": "Malware payload (Mirai)", "value": "ddfa5008164298db0ae57b9e8121b76a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973273, "uuid": "05131cf6-1ebd-4488-9512-3f6f55a18ec1", "comment": "Malware payload (Mirai)", "value": "00c0c994f8d9890ad96444f86452aff4b1e762d02394d342ad72218022bd4df7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973273, "uuid": "60dbda55-87e0-4064-9392-bdfa7e3a90fb", "comment": "Malware payload (Mirai)", "value": "f81159b2fe636d6fb4d63498018a0a9fea26f23c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973273, "uuid": "75a915d4-842b-45b9-9be9-024e1b05d286", "comment": "Malware payload (Mirai)", "value": "cdf5bffe70eba6739566e5fb876a78ad5929b476ec128972c5089facee5faf2eeff0d87e0d7c63ce51f1fa2033254614", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973273, "uuid": "43e7b34a-7f7d-4f4b-9c89-de3a60834e96", "value": "T1E5C32A05B30C0947D2633EF43B3B27D1D3EF9A8121E4F644255FAA8A92B1E325586DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973273, "uuid": "778c1d12-9e38-4064-b833-ab6a86b5e68b", "value": "3072:aUYccxH71b9LgwFbMArr6/tMhEhhhhhhl:axccxb1b9LgwFb5v6lMhEhhhhhhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690973273, "uuid": "6bae4978-557b-4aae-bc2f-cf81514dbb3a", "value": 121720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690973273, "uuid": "249c59f9-35eb-4c8d-a13c-20dba0e0648a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973273, "uuid": "f83be4bc-7740-40b4-88f8-befa8f3bd14d", "value": "ddfa5008164298db0ae57b9e8121b76a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a356d77-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957116, "uuid": "bbd4fb92-dc53-47f2-bea1-33a33b44788d", "comment": "Malware payload (Formbook)", "value": "0ca8f60433aa28b78dc0d301b7884df3", "object_relation": "md5", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957116, "uuid": "79f47e57-adef-4de5-8e88-47aa0a09817a", "comment": "Malware payload (Formbook)", "value": "00c631724740205bbd826f91c99aeffc142ab15b08b80416707989c2cf61edef", "object_relation": "sha256", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957116, "uuid": "8fc4b3ca-9596-44f1-90a4-932111eddea3", "comment": "Malware payload (Formbook)", "value": "681f1e8403599c6864d844bde86df3d2bda0af27", "object_relation": "sha1", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957116, "uuid": "ee70643c-118a-4c73-a7cb-e9e1aad87b91", "comment": "Malware payload (Formbook)", "value": "94e4341bcc75ed92ce160bc6590ed6b138bf6f143ed82b611c4fd93a6fe757255dbed40377383119e5b2def2a3e1856a", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957116, "uuid": "98f953fe-58f4-40dc-a943-90ec628269ba", "value": "T1DB13266CC74F806ADF61663B9B5A0E0846FCBB3EF68452A4346C43B537ECC2E2521579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957116, "uuid": "d8979ea9-bb44-4530-bfab-01371ed78d66", "value": "768:hbMX9gRWj2RfRiyHPLig0jkIxBiDnXlk26cCNm:pHRiyvLiFi7Vk28Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957116, "uuid": "4754adeb-7165-40a7-a316-43abffc94f55", "value": 41495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957116, "uuid": "b4a6e721-97be-40be-820e-0973cb9e0e2e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957116, "uuid": "58116a58-9570-473f-b121-ab8b8878564b", "value": "obizx.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28beb938-3164-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691001674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001674, "uuid": "f573b741-85ae-4988-a4ad-ea86a4ac385f", "comment": "Malware payload (Formbook)", "value": "4ef341e4b9c3229fe2281ddece402c22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001674, "uuid": "0fcdd752-8224-4ab5-8e7e-87cfe76106d9", "comment": "Malware payload (Formbook)", "value": "010058f0f4fdc7a44781d9704645f7dac272505984f7eed264675121992c1b77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001674, "uuid": "888d542e-fca5-4ec6-8ecb-a1547b143433", "comment": "Malware payload (Formbook)", "value": "27d44d1724c70c81e04df01ae5e72c1e22488dda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001674, "uuid": "f3b6c284-9f38-47e8-a08e-a1b3705fb2d0", "comment": "Malware payload (Formbook)", "value": "73212fe087f2c91d5053650b9c9bab8f091267a80eea3fe2c0e423771fb7cac438549a54fdf7b3e2296de5fdafda0f42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001674, "uuid": "b30c4e68-bd15-4f5f-b901-c9a50e342ff0", "value": "T164541281AFF84973D6A342B049B6A1846EB46C3A61A147479700FA6DFE727D09D4F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001674, "uuid": "f937a481-46c8-4ebd-9e73-11923de2b288", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001674, "uuid": "f56ddbec-c233-450a-b26a-57f00eec75ad", "value": "6144:AYa6uorMGf7Qu02GM2K8vn6lsOqbG3rC8AJ9u1T:AYA2MM7dEvv6lszbG3rCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691001674, "uuid": "a8e82eb5-b897-4e8a-a3e4-9ea16557bc85", "value": 292759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691001674, "uuid": "493b5c81-ee40-4882-bc36-2e5b5ae7cfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001674, "uuid": "55f1b9f4-1f90-4270-a194-fee8470e1b07", "value": "4ef341e4b9c3229fe2281ddece402c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c0f782-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963903, "uuid": "49a99cbd-8321-497b-b7a1-80e825009ab3", "comment": "Malware payload (AgentTesla)", "value": "bd6687dd7ec1ee893b0394316ec2249b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963903, "uuid": "9458f5ee-7302-41af-bd55-4e538a120b3b", "comment": "Malware payload (AgentTesla)", "value": "01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963903, "uuid": "e3a4239a-75e4-44f5-908f-b5ad3a39b699", "comment": "Malware payload (AgentTesla)", "value": "a73fd83405530c5905cd675eacf00213250c2477", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963903, "uuid": "1fd2ff91-2a1e-47df-8fbc-233492ef42e2", "comment": "Malware payload (AgentTesla)", "value": "21d7ec548375a6062f83499ffdef3687cd9033c091f5c49afa95083ff045f8adec0d3f7d4be0fb3d4a35dfaa8bd2de5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963903, "uuid": "bdd9f4a7-7ed4-4d24-bd45-c432951d960f", "value": "T1ACE4DF00726CAB67F43E9BF49525818407F553BE746EE78A9CE1A0EA16A4F500F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963903, "uuid": "5f2a220e-b653-4377-87fb-f7ae131a06cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963903, "uuid": "a42182fe-93fd-46b5-8b46-f5c4e10df194", "value": "12288:d5MYO0M22fUQbYNrxUtduItO/bqvw7yZiA3mdBLFGrfeY:d6DCwU6YNFUSItYbqvwyKDFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963903, "uuid": "3371802c-41fa-4e05-83fe-af5b507cc5e1", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963903, "uuid": "bed195a4-a785-44b8-92f9-0e365635487c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963903, "uuid": "218f9cfe-ff71-4a20-b93e-be02e1a7b690", "value": "57m\u00b3 LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbf9128-312d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690978305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978305, "uuid": "90e0c027-5a55-457f-9e3a-429e87a0f38f", "comment": "Malware payload (AveMariaRAT)", "value": "c3d2671ab969fd347e6e0b81c777fc48", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978305, "uuid": "73ffc11e-5fb9-4292-a356-b6901ef39a44", "comment": "Malware payload (AveMariaRAT)", "value": "02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978305, "uuid": "58ae93b1-5cf0-45df-bbd2-3571ef62a563", "comment": "Malware payload (AveMariaRAT)", "value": "43d9902d2a7b0583be43ef8d4023c81e9a776e52", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978305, "uuid": "eff58b0b-fcd8-4c9b-bdef-a5a813008198", "comment": "Malware payload (AveMariaRAT)", "value": "c75572a84c2e0415b5e4512055655fe6b62b8adca098833af73c0f40fd6df1895c5206178316c65e8a13062272b9829f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978305, "uuid": "d55f6c44-5812-4f62-8cee-462b322fee3d", "value": "T14C1402913BF4C433DC820B313EBA0657AEF5E91538A2BB0F5365191CB972A52D25E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978305, "uuid": "f8fba35c-2047-482e-8a1a-e1767b1df34d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978305, "uuid": "8eb19a5b-553c-444b-ad4a-f0c4bb40b2ec", "value": "6144:/Ya66WOW6k4nLUfQzcGg6Zwaidc8J1CQC:/YgWOE4EQIhairI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690978305, "uuid": "68afaa7c-61e6-4ac1-8282-ee3fcb4e1091", "value": 208028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690978305, "uuid": "54451078-da5b-4931-af78-b7424f966fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978305, "uuid": "6b95d29b-5ef8-4aeb-afa2-ae987ac1d994", "value": "Reservation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9370149a-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690966205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966205, "uuid": "5f211356-5a02-4ef2-a3e3-e24a253148fe", "comment": "Malware payload (GuLoader)", "value": "fb7e0bd08280df0399c877d5a67745be", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966205, "uuid": "ab13b910-aa16-447d-bde0-61d0cee74bf7", "comment": "Malware payload (GuLoader)", "value": "03bf3d014b0e302e7d0d9bcdb78149cf039058ef6b96820f876ef87a0117deb1", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966205, "uuid": "04ea380a-e609-41f1-be95-17e9eb3df542", "comment": "Malware payload (GuLoader)", "value": "2fe62ad86359d0c722d0d16dc0ac418e413bd196", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966205, "uuid": "fd2b8863-d052-4684-8914-c61a00e2411c", "comment": "Malware payload (GuLoader)", "value": "aba1df3cc85a67d1a8a431f896c0f7450247edfbfcb3830c8b58fad87e43ca1b920b84588798c22f72b2791525a5eb2e", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966205, "uuid": "932db5e6-3d80-4618-b45b-f3f30e45133e", "value": "T11F74231712A6C0A6CDB306B13E76A9239BE49D3164B0835723317BBC79727D0DA2E395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966205, "uuid": "e02e7990-d031-45af-bd49-35a170bd9686", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966205, "uuid": "415adf3a-aa5d-4b34-a3f0-1dac27ae55b8", "value": "6144:oQA4vocawiycI58+Io4AOFoXEe3qPYF873CRHs+v6BWdXyWd8tvedQEP:ccawZcN+IoXREOqwO3CNs+v6+utoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966205, "uuid": "ba842d4b-9cad-4ab6-8bab-e77f0db0f462", "value": 344642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966205, "uuid": "802177c5-42f7-4015-aa18-dc1487340698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966205, "uuid": "f94ffa93-03d4-4e82-bbd6-bc300e1864f2", "value": "HSBC Customer Information.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b5ab0f-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998683, "uuid": "f30cf499-3690-413c-84e5-ba67676b4b9f", "comment": "Malware payload", "value": "5c030e434955d73f32c3d7f05e20172b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998683, "uuid": "8b10f301-059c-498a-bcfa-1cb6d886f11a", "comment": "Malware payload", "value": "03fcb16b8fddf2cba414c572b82d74699338fd28201918ecb87e58d4832891fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998683, "uuid": "782f59a7-be2d-4799-a8d1-c5f0455dd83e", "comment": "Malware payload", "value": "bf1396786844e30e1db0ff15834aab74a87c2fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998683, "uuid": "e8c33c37-5c65-4933-bb77-67f09448789d", "comment": "Malware payload", "value": "47cc51805143325347c2d19e0b6e3c3a2e32957c2024462b6441df6ebd802dd7bb330f6b5abceeeee8a2f78ff71c39ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998683, "uuid": "353c0760-7761-4201-8821-e46631286c38", "value": "T12F44E043B7EC9033CDB52B7058F602C30E35BDA15D78875B1691AA4F4CB2684A97637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998683, "uuid": "9b14263f-319d-43fd-90f0-9ff2d9418ff7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998683, "uuid": "d09a9083-42a3-46d2-8c27-0aeae73b2945", "value": "6144:KEy+bnr+jp0yN90QEfDGNGsaP7msgcArJ4aG3v:UMrLy90lDKGsaPKIUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998683, "uuid": "2a4d451c-0681-480f-b0b7-e0f037c89e7e", "value": 261901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998683, "uuid": "7a6d8801-de7d-4423-ab76-b07dcec19c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998683, "uuid": "a6877973-b7df-42b4-b9ff-6c6cca704362", "value": "5c030e434955d73f32c3d7f05e20172b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc01a47-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690969551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969551, "uuid": "caa1064d-9e05-4648-bcc6-37ab3a1e2e22", "comment": "Malware payload", "value": "4917a81f660316779a236946a26f600f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969551, "uuid": "de9669c5-906a-498e-8945-41b14f5a4b5b", "comment": "Malware payload", "value": "04e730254804f27933027ebd24c62740234a47d6a813a1c5389d141cc7fbe6d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969551, "uuid": "0131c97b-735f-4d3b-bd8e-557706f356c3", "comment": "Malware payload", "value": "368958463734488326d425b413c6aa1935044460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969551, "uuid": "2cb6483e-4c70-40de-b502-8ba40ee09fde", "comment": "Malware payload", "value": "b3b863d19caa52cabd9e1a1b0bc3d444700a65b3e4dc643424465fa4dd70bd7a9828e6b9c561db7002ab1598008178fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969551, "uuid": "7417f6ea-ad36-4bce-85dd-a6b4cef44c8a", "value": "T12EF4E1027FC547B3D5B3CA325939FA80F53EB0242F269E0972ACD25C5736051D2BEAA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969551, "uuid": "90494f07-ea04-406e-901c-5c3a74eed710", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969551, "uuid": "dd0dc71b-d6ba-48ea-861b-f80d5b0cbb11", "value": "12288:AcrNS33L10QdrX6d1nB/oQ4m/oYeNOsizk9HqmrWlLcWIDBPmEKhac1FMvn:jNA3R5drXM1Bb2Fizk9H96LcWI9iMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969551, "uuid": "63d7035f-6c9d-461a-a899-6049ecf09f68", "value": 736540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969551, "uuid": "b4886c27-1450-49b1-b9f2-2f8f447c1d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969551, "uuid": "514f43a8-158c-4e51-8c91-df1b95a0fecd", "value": "Belge_Bilgisi.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f276539-30d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690938710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938710, "uuid": "6684679a-b3c5-418c-aebb-d9102645d91e", "comment": "Malware payload (ArkeiStealer)", "value": "df0c22316b7b50ee84b60b201fb837ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938710, "uuid": "f44bb6f9-5646-4dac-a482-e429069c0364", "comment": "Malware payload (ArkeiStealer)", "value": "05e67c0721526e7dd9b6ef6cdc391d656399d9346b0e9e7e563c160fd0c4fa79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938710, "uuid": "e774bdfb-22c0-4d6d-a676-29878f0cb33a", "comment": "Malware payload (ArkeiStealer)", "value": "081aef95af7a81682d2c882b91b299cc63efcf2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938710, "uuid": "d85466e0-2dbc-4811-91e4-5081e4a7ec9d", "comment": "Malware payload (ArkeiStealer)", "value": "db62cddba0dd77dffb19514a405a8755d5c9a1dbf86f8de911a39ac38ec76560dc12610b42e7a3d7623157390c801a4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938710, "uuid": "350c92a0-f305-4d44-ba9b-654ccbe88fa7", "value": "T11AA47D31B660C03EE59211B68E3DFB66087EAC71231554CBFBC50AB97EB42E15B3521B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938710, "uuid": "c27ed00c-c565-48f7-bbaa-66791dd1f102", "value": "eb946a5d419bb360e395b3426711b797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938710, "uuid": "8140a63b-570e-4350-9241-ec363932d2ee", "value": "12288:7MqFYULoWzniwtgGbl6mw/YAMOtwhF5fBqylCnwe+:7MqFbniCgGZ6T/DMO25fzonwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690938710, "uuid": "9b68e820-4f08-45ff-a65b-31aa732d4210", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690938710, "uuid": "3debcccc-b292-4423-beec-460fcaba0023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938710, "uuid": "95ff8b64-9ecd-4623-be3d-a5d031ad038e", "value": "df0c22316b7b50ee84b60b201fb837ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7c1620-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690966569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966569, "uuid": "91f59850-7222-4d5d-beec-0179e1fc862a", "comment": "Malware payload (SnakeKeylogger)", "value": "0a24f265c64fd296e6d7cb4e0e291518", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966569, "uuid": "006512d8-9c5c-429d-8d8c-66cd934edaa9", "comment": "Malware payload (SnakeKeylogger)", "value": "065422f5a2797ef0b64e40890c4b00d60c2edda5bef5a73a6eb361ec8a81baa9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966569, "uuid": "cb8bc152-c6bd-4339-80d8-c08e17fa5f86", "comment": "Malware payload (SnakeKeylogger)", "value": "5f676ce8451a1f7274cf37d753c7e0f772e9890c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966569, "uuid": "5d5ebaf7-969e-469c-98ac-b52afe4795b8", "comment": "Malware payload (SnakeKeylogger)", "value": "790b39a4418ddc35f657d0d15c0a6683119db13ac9ad5f962e81e9ff28dc7c3316e563b3ce1039c8d2f1d8df02cc4b10", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966569, "uuid": "a231ad68-b256-447c-a91d-80d0604cd82f", "value": "T173D4123525B4EB5EDA2F0B7E5D72405503F85AA93570F72F8F9172C26E70B824B04AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966569, "uuid": "c51ebbea-bbd8-4d01-a210-3c83daeb3fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966569, "uuid": "c0a05be7-a80a-4d9d-a2cc-0f00095dabf7", "value": "12288:5+uZdrYmJ+37pZa9Jbr3CZap6LSt5GDNCHBe3fiSYwYAKw1V0n8aPaN:5+uDrYmQ37pZa9Jb7Ich5Gkhe31jew1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966569, "uuid": "4529ef39-48df-47d5-af9d-db4cbe5ed6ea", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966569, "uuid": "7b14bd87-1d4a-4cb3-b8f1-ffa95f8abf27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966569, "uuid": "0df2aa34-e7a1-4b97-adc8-e25eb8a7fe5b", "value": "DHL AWB 5016240033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fc7cdc-314a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690990665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990665, "uuid": "1b033f72-910a-49dc-9daa-6770277657dc", "comment": "Malware payload (Formbook)", "value": "0b104723cd036fbbf65a9b14f9b26095", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990665, "uuid": "06be7faa-1893-4d12-92eb-3f126944d988", "comment": "Malware payload (Formbook)", "value": "065ec44f35f6c7e66c0180c5e4030f3688411c892e41174314aea8c185fe1775", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990665, "uuid": "77425d6e-a8b2-4bbc-a371-0af374b8adef", "comment": "Malware payload (Formbook)", "value": "83032064013adc37dfe2bebc971e60088d59ab11", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990665, "uuid": "da9d9d9e-97d1-4e27-902c-a4b7bd9ad309", "comment": "Malware payload (Formbook)", "value": "29be57d74b0cb3cf68c1059ad815af9e8af0ce43452a1370a8a049eeac13162fc67ad364a90c7e33376e97d850d3a936", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990665, "uuid": "bdddcbb6-9131-4a01-9e96-15ecd7460e59", "value": "T15B850103D8048B86D50C83F87E533DD94A0D7F26B4DA7DDB06527F9B3A32A67892A50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990665, "uuid": "7630990d-db04-410c-bc32-7c85fd91d323", "value": "49152:ZQmmQ30bupp6VsQmmQ3085d6VkiNhv3tWUXDnHgk6EDS:ZpmQkbamspmQk+mkMhfDl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690990665, "uuid": "0dee0156-631a-4cf8-88a3-121341b7b7f9", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690990665, "uuid": "e484d012-f0c5-4aed-b74a-d80e427c51c2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990665, "uuid": "0630e91c-f32e-43a6-8bf9-9bc9a918f217", "value": "product speicifcation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7e66c1-3184-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691015719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015719, "uuid": "92d3df53-bb96-408d-8ec1-b745b26e4dd1", "comment": "Malware payload (RedLineStealer)", "value": "0e97ee8987c0e05c0aaba5ce86af3f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015719, "uuid": "09a12d9f-69a0-4cea-9214-0067bb54fc3f", "comment": "Malware payload (RedLineStealer)", "value": "087debb5b43c07f011b4facd7577023c5f02f16b40395ca916a9ecc769c737ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015719, "uuid": "54f6078a-4efa-4278-9f48-43c1349fc448", "comment": "Malware payload (RedLineStealer)", "value": "d6d9203cfc3f9ce03a7731c15bf03bd207dc9272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015719, "uuid": "e03f476f-449f-4740-b60b-b6f6e6ab8167", "comment": "Malware payload (RedLineStealer)", "value": "df68e371cafaa9d3275d158c3f16a893941d71bbe5ff0183d859a45f4d303856847744b39ba9c69c9280630d15790512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015719, "uuid": "026a0980-45b1-4a9a-af79-ca180f97e484", "value": "T17946331F84D1A4CAFD2B7D78F4AA227B1EA1E7A1343E60CA714507F40765FACAC86C15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015719, "uuid": "404f5006-45f1-4ccc-ae9a-9ed95195430a", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015719, "uuid": "976d2b85-8ba6-40e6-a77b-096941708f2a", "value": "98304:mORvd2mg0YAHzD9SKgZdwWOt4C3xqZPmn5sJ6ez7qpbkIQWvuioLKH7whZzAaFmF:mMF2m1YiP9SKgZdwWgt3xqM2JvqpeGTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691015719, "uuid": "fc6f6ebf-f2cb-4c77-82a0-7220044ffc3c", "value": 5882592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691015719, "uuid": "a7e33c1f-8ebe-4097-a050-b46e3b2f8360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015719, "uuid": "977ab0ab-fcb5-4e71-82cc-ee49ca90b957", "value": "0e97ee8987c0e05c0aaba5ce86af3f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfedbd8-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963914, "uuid": "fc628901-09ad-43bb-ad32-949a720307df", "comment": "Malware payload (AgentTesla)", "value": "4eae6776404bb5c2d7c674f8416d64d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963914, "uuid": "d6396f98-8018-4516-964b-fb38e49d81c6", "comment": "Malware payload (AgentTesla)", "value": "089462a333a00823a7b2b3f06a622107ff50187c1e7c16fa53a0e67202373bdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963914, "uuid": "d294074b-2059-4cd4-b52c-bc640682363c", "comment": "Malware payload (AgentTesla)", "value": "7b6cfd8ee65beb455e48b1163e8b2f96754fbb92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963914, "uuid": "efc59a38-87da-4900-ae5d-80b2364b46ee", "comment": "Malware payload (AgentTesla)", "value": "411ae6d5c3b68811854f3a1178b05e2fd99670cb281a7181597bdb1cee1393da8055fa88172972389ad12d522e870ca0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963914, "uuid": "0b432cdc-2b7e-4267-a7bc-e1eef06b7d16", "value": "T14A327D6DADA440BDC32F51B941606815EFAF76A6FA240B0E7970BE5188F37AF4311314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963914, "uuid": "7de05793-a968-4e69-aa28-6a2e34184e6f", "value": "192:rya0NzkeOW/4N5eNA2A+EnVs+mg1SoBBJYNO36PvQKx48Y9WcWe8ruP:ryXzkeOW/u5+A2bkBdBBJYNOqPx4Z9W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963914, "uuid": "d7f437b6-90b3-4eb9-9dd3-93afa8a7c6de", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963914, "uuid": "74fb3de4-0b20-4da4-bb75-c1b88760af8f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963914, "uuid": "df08fb24-5703-4d0c-81b8-7d8c5cf3091e", "value": "NEW ORDER_Letter.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01af227-3140-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690986412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986412, "uuid": "6eedc473-aa7b-4e4a-b13b-9cd70afae00e", "comment": "Malware payload", "value": "1eed67831d466bd3c8f223b5ad3bc7a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986412, "uuid": "d3f654a7-abef-42eb-a45a-e3b4cd865086", "comment": "Malware payload", "value": "091e397a31b380d81720d20508bdec645306d146ce12f524d70bfc4091ad00b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986412, "uuid": "37761fb4-4b39-482d-97f2-72990f2cefb9", "comment": "Malware payload", "value": "25c673e1fc38dc7b077a6d4e4075f0fc9e82fcd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986412, "uuid": "d3fbee16-823f-484d-bf6e-5ba13c03644f", "comment": "Malware payload", "value": "9345089351790ae85416ea2499146a61cbaf48633a4643f8202a0455bb71b9ffe6bd0678b43ad922ba567e3ae7d3efa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986412, "uuid": "4ec7fb1d-e7e9-43f1-b4ee-e3d59b9bf1eb", "value": "T182963326F0B3E4DCC19BC071E99A16F3F9317D6C0382505652AD6AB85F74B60EEADB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986412, "uuid": "1ff76bc2-3edc-4fca-b205-b5d53a37c15c", "value": "9ea5854395f99dfb3b55a7e476af7f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986412, "uuid": "069b9773-064d-421e-b9aa-a7df953f42eb", "value": "196608:DLq5aVxlzdQD8Jpfd+IzNFe3iHpDFzJyOALmem0:xlzdQD0xdFzSyHpDyOAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690986412, "uuid": "0b5dc884-8222-428d-8def-a4f53fd042d0", "value": 9011602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690986412, "uuid": "eb1646f6-537d-41b3-84da-06d8ffd8469f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986412, "uuid": "88f0a9b6-b195-4f74-90f6-a4b252830ae5", "value": "09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e340db-30ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958236, "uuid": "c9879558-283f-487e-99ce-94b78dc5972c", "comment": "Malware payload (AgentTesla)", "value": "e59dcb20d46c9ee0fdcb0a414a65a6cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958236, "uuid": "1f70d15b-4814-4a9c-85c1-fcc45da3df9f", "comment": "Malware payload (AgentTesla)", "value": "09489460976badf8dc7374b3020862745f2682068fdd2a6d60520fa1f615b6db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958236, "uuid": "14e77e68-6937-4a9e-a85a-b6bd32928364", "comment": "Malware payload (AgentTesla)", "value": "9ca6acf7c78bc1804f0d2e67ea4f3c452735a197", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958236, "uuid": "e3db56ed-f552-4625-9df6-ab9f9e32c4ff", "comment": "Malware payload (AgentTesla)", "value": "a2eb0cc783b1f59f4970ca0d43379454d6f40223da0597cc0ed0e6b53ea75b8648412104dd85935396b45d5b701385bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958236, "uuid": "39089da2-f03e-4878-9aa7-fba1f2d7039c", "value": "T1BA25F7274177A4B3DF087ABC5A12D97A219C6F40B1B6E298A32F34C3D9D61121D3A7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958236, "uuid": "ade8af33-bf49-4c78-87c9-d593efa970d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958236, "uuid": "aa1217ce-b4e3-49c6-a1f2-fb87b22dfbb8", "value": "24576:NaJIra2nFFe/n7dAZpppNpppppoOQpppNpppppoOZfJYOW:W2nFk/nRRO7OdJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958236, "uuid": "fb5e82e1-10e5-4f5e-8734-4d8f149a12a9", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958236, "uuid": "f5119511-22d1-49f8-ad74-5fa25aa94367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958236, "uuid": "331f2c85-2dc3-46c7-a95e-c31295b4d498", "value": "103603-81075327-LBP23103603039.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03a1785-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013122, "uuid": "1b6b316c-45bd-4a06-82d6-c636f344c924", "comment": "Malware payload (Mirai)", "value": "b168aea5c738fd56330e1aecb248b76e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013122, "uuid": "fe2ad1e0-1f3d-44fa-91da-464eae6f91f9", "comment": "Malware payload (Mirai)", "value": "0a595ec9f3ea4596176f2af13c34746ef0e54e34ee826400f0777ab2eebd7988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013122, "uuid": "55e0c35b-0d5d-4615-8564-ce74af1b5fde", "comment": "Malware payload (Mirai)", "value": "1016ee0746499b6ba77ba2f3975989783688028c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013122, "uuid": "b338f247-ec3b-4589-9f55-2126a4ab8135", "comment": "Malware payload (Mirai)", "value": "267fd4fb268e52fe04486c711fb3c2101f092a30f7b6cd7fd907ed1780c14cd94fc3e56617e228a786361467a1c5842f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013122, "uuid": "04631e69-22a9-4431-9f08-1aceca2b3f98", "value": "T122D2E0ACDAA293D5CA6E147D90CC2B295F65B041279ACFC633535C8E9236CAE75070BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013122, "uuid": "7bad49d0-c9da-4a98-8aa7-1b1b38d1eb54", "value": "384:08pVWtmRsLYEpB6V8S628FRxT+Ytkw6WBLqpbQnmFfpGFv0KOoLqGeptZsPh83g9:5MYHb6221DzDLkbQnm/GjoyPhDT5W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013122, "uuid": "49d948bd-0e14-47a7-9db9-db090ae33a9b", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013122, "uuid": "84ca6c85-7d94-497e-9378-b864e2df375a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013122, "uuid": "808a2ae6-f9ce-4315-8cc1-de9ae015ce6d", "value": "b168aea5c738fd56330e1aecb248b76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2f6b3e-30d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690938703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938703, "uuid": "9ad3dc6f-fc99-42a1-8d6d-16c5d9df157d", "comment": "Malware payload (RedLineStealer)", "value": "0f09cef79b5954fe8741e04f850608ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938703, "uuid": "db970550-51b4-494b-a78e-78969d853064", "comment": "Malware payload (RedLineStealer)", "value": "0abf4d06d367f859ffa382f1e05fc9dfeac9463290992132a0955b71f03f8d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938703, "uuid": "a17a9bf0-a005-4d75-8490-93f58e8925ac", "comment": "Malware payload (RedLineStealer)", "value": "3e3ede45feda3aa5c61068d98afc99085aedc70d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690938703, "uuid": "dc0836cc-4d31-41c5-b7ad-47e4e07ed9bd", "comment": "Malware payload (RedLineStealer)", "value": "43bb50166e8de445b1d701c542aa1feea27ab2ecf75f6fb4419e9acc20172c39678024b60955cfa5f1f262c5fdcfe003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938703, "uuid": "7d316c04-ad0c-46e5-ae5e-5e0c5a3551ae", "value": "T1BB656A213D818E32CDEED0B645FCB9E5412DA0A30F2546F796D847EED6206F16F32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938703, "uuid": "7a725aae-2cea-46dc-9fa3-a91a500e73c3", "value": "6775d129202f77e37e1827c229c8d773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938703, "uuid": "c445ca38-7ec3-49b4-b8b9-c3925153ec6c", "value": "24576:2JKhiQ1mEAofpfawMUGWQpVRQPlxJrrP:wQcEAofpf4/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690938703, "uuid": "156360b0-2169-4b88-ac43-13535911c9e2", "value": 1544704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690938703, "uuid": "af5e2864-7d35-41cc-a573-a55e525b7927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690938703, "uuid": "caa31014-85c4-4816-bbce-29027bfc769b", "value": "0f09cef79b5954fe8741e04f850608ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9d0999-3110-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690965841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965841, "uuid": "e5333962-b702-418a-a287-ef7590b80c11", "comment": "Malware payload (RemcosRAT)", "value": "4e3c3d181e7970eef2b314c1391cd1ba", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965841, "uuid": "dcfb4da0-54e5-4ca2-b641-4c2d848d9f7f", "comment": "Malware payload (RemcosRAT)", "value": "0b3d65305edc50d3882973e47e9fbf4abc1f04eaecb13021f434eba8adf80b67", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965841, "uuid": "4a0e6a87-3ae7-4be2-aa68-7fea11320de3", "comment": "Malware payload (RemcosRAT)", "value": "6719e473f847b5b08cc2cc3d91a565d145e763b4", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965841, "uuid": "e161e6e1-bc46-405f-83a5-119995060de5", "comment": "Malware payload (RemcosRAT)", "value": "8ab18d42cb10c264ee81455571f73d8b1891009bc683f16756a4d2d65e04f7eb1ed94db1fab117e426f3de01965441dc", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965841, "uuid": "97da7e50-d0ae-4ff5-a0c8-5e82bd5aeadd", "value": "T1C52241EA2983A7B6CD330055CC07A4D8D7EC5299202720B17CE4CAA7140EB6D767BD7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965841, "uuid": "b804bf20-b8fe-4239-addd-301f8e03d23c", "value": "192:8abK0wfZcMx6Eh1FzixMXqIvcbEtSaRSO:8FTKMxt1FzixMaIvcbCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965841, "uuid": "c43ba00b-0d69-4aa3-93e3-fafdd90b773d", "value": 10586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965841, "uuid": "993485ac-4bb1-4837-977a-a7ec6764450f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965841, "uuid": "c2a9e4e3-8f42-472b-a7a6-c78c3b88b575", "value": "SU KAM POWER TECHNICAL INQUIRY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d2915f-3190-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691020700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020700, "uuid": "bfbad547-d11b-4a91-913e-690dac2b42e3", "comment": "Malware payload", "value": "129e8e90a59990df73e740f7fe76b131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020700, "uuid": "ef1c2fda-760d-4b7e-8027-f958a9e428f3", "comment": "Malware payload", "value": "0bb242d711de81ddd221efd5b4d7a839e6c2d7599a88ce84743c914015ebd638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020700, "uuid": "00754129-49d5-4cc5-af4a-e492eb2b40da", "comment": "Malware payload", "value": "615239b1b07e37684b29e5735462d3b506b7aa6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020700, "uuid": "04cec231-2264-45c7-bbe0-704a7a1dede6", "comment": "Malware payload", "value": "bde22c5790a17948370720f0568da27a8fe32178ed6ea2d662beb052806627c6100e76bb7e161341e0a1ef1a164f8df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020700, "uuid": "74aee442-8bec-4052-96a8-19da6ebbc381", "value": "T11B8622ED2744336EC02AC0349523ED07E373511F67E6B99A77C76A907B6B7309A02B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020700, "uuid": "e0e67931-9bb4-483f-b649-f8d8676611f3", "value": "713f2679b25b10e65da54bb5dd0f93c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020700, "uuid": "de78d605-7451-4fc1-bd7a-f46b5b6c2e86", "value": "196608:bC3WNbFJa6K3a4IW6ghwLxIIujWWdK1Cq3slwoh0TJGl:bCm/Jjpy4x3ujyI8QcJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691020700, "uuid": "ba900b2f-9581-45e8-8e23-87cf846fa22b", "value": 8041396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691020700, "uuid": "5b21cbd8-e819-4f9d-9004-2ae592046d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020700, "uuid": "ef5baec8-6206-4f76-8b0e-6014215e5b0a", "value": "File_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5982d47b-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998320, "uuid": "653d1b9f-cd08-45f5-88fd-772a8297af89", "comment": "Malware payload", "value": "ab127976b450eb70a6395efd034d7583", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998320, "uuid": "670b692c-1451-405f-8480-e8d4c836f286", "comment": "Malware payload", "value": "0cceac83b308ad730c810078d2bfda96ec55e44674dd7ea031f8d4da0c1b6865", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998320, "uuid": "56c8c73a-afd6-4b5b-8342-59d98c969300", "comment": "Malware payload", "value": "d0298a768bdd45700a361b025b5e3ca13b8397d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998320, "uuid": "7b271a61-aa11-40be-a6b8-72ea86045bd7", "comment": "Malware payload", "value": "b34d4b198107da0f29aaa224af30845adb47a34e68c8fbaa6c0a6c11e8dfe3ad75b2c6057721a6acc3da1da47acfcae3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998320, "uuid": "c0d2c9d0-cf04-4e08-a69c-b064a0a8ee1d", "value": "T171D5F9F476E077D70FB5690DB3CE40B23D64B857F0EDAD8622890D1E928039999BBD60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998320, "uuid": "330ab0f7-945a-4839-abdd-71857ba02b93", "value": "24576:14dLzvFfzYJFX1q8vKufPDHKP0f6cS/bRYn+Jc1vzlftxWLzAUUPL6XprOJNmB21:NLp7WZUbUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998320, "uuid": "afa67490-e47f-4e99-ab36-2ebcf30c230c", "value": 2940201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998320, "uuid": "349a10ae-be35-4e77-8d29-0ff5ea82dc55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998320, "uuid": "a76242d9-d1c6-4834-ba37-6c4aba480c1e", "value": "1112769422362.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ae7980-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998929, "uuid": "bef613a4-4d39-472a-b30b-68161ba88150", "comment": "Malware payload", "value": "b262d0e420307a931b5fbbed795ad866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998929, "uuid": "b2d5771b-1bb0-4fa1-b6de-3a78c0810181", "comment": "Malware payload", "value": "0d4209c4e101725f1137270fbaa7fd5d8b9a586b81d5adb7ca6571fcf637bf8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998929, "uuid": "0f7875e6-32b9-4ab2-bc12-ff01acf4e241", "comment": "Malware payload", "value": "a2e87077b95b1977c7648813af2a3390fb1f1c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998929, "uuid": "e1642e21-7625-4b5a-8144-39856f48512a", "comment": "Malware payload", "value": "7ca31c5831c80d9f55165c242dc8bb6e497d79afdd4b1d5a6202f5f9f0d2c9f546ebfb77e5cf992e2d1292de8608bc84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998929, "uuid": "0e0fba37-6b71-4f1c-a11f-a0eb21ee11a7", "value": "T17636121AB9648C64D593D4331015D6A39205D28EBA18CFCF23B01D0AFEF59EB8B167ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998929, "uuid": "6c8cf5c5-5fcc-499e-94a8-9e4a89960e60", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998929, "uuid": "2eca8623-6da3-4849-84f1-fb8a07f29b45", "value": "98304:Qq21KaNjf5rBIZU86Ch3/NCFBdkPo3Tsy1y6Ifgk31fTmU3Gt2U6cjlWtW:e1DNr558bhV8dkwDsb6M31fyU3Gt2UlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998929, "uuid": "970ab8f0-9e06-49c0-8a45-f3d61a81a8b5", "value": 5321600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998929, "uuid": "cccd52e2-dddb-41d7-a9e9-5953e81d8e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998929, "uuid": "53f23bb5-9d21-4c72-9ff3-bd28455ec76c", "value": "b262d0e420307a931b5fbbed795ad866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a246ff4-3190-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691020762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020762, "uuid": "eff0dfe3-fffb-4c60-a157-133a0b90438b", "comment": "Malware payload", "value": "f2109403294095e6f6e42fe423ef47a2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020762, "uuid": "8c3aab29-a989-4050-b857-e093c114d703", "comment": "Malware payload", "value": "0dee14bafcf7a9e5ae5ba9e0ff7a15c08cea8144e80d43777a244b737256b4af", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020762, "uuid": "3205af45-c9bf-49d1-a1ee-c20c09e4752a", "comment": "Malware payload", "value": "c05170312601872265eeb52baf31414250049b9e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691020762, "uuid": "7ce3922d-4b97-436a-9451-c609a5ad86fb", "comment": "Malware payload", "value": "faef01fdf604e6dc3c5991e342ad6d45d74671c5c51a2d2b794eeeaeebabd58e39f549562988d50af7d6330e407e1c99", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020762, "uuid": "ee4eaf44-2cd2-499e-a8f7-7702336fcc1c", "value": "T18957AF0BF4458979C5E9A474D24FC2B6B32671998352A11B6E08CA243F9BBD8DF3D3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020762, "uuid": "988e20e6-fe05-4c6d-8c2b-ed64b370ccfb", "value": "393216:L2zC5GXxv3upJH8CPwR6Rp+MCg5e8B1+OJv3upJTPCPwahLCsZbZv3upJZDCPw3L:izFm5dXbty7GFjbGuGbavK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691020762, "uuid": "aa828dcb-031f-4031-bd4f-e90ac8e3e66d", "value": 28807089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691020762, "uuid": "63d44b6d-c838-4143-b4df-9fff004d6a25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691020762, "uuid": "30661beb-c941-4c41-95f9-2b374e1c1223", "value": "Seguranca_Nubank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08e584b-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998144, "uuid": "f4d8a37a-35d5-4efa-a17e-63bc549d8aea", "comment": "Malware payload", "value": "978086ecf4b9ef726ba993930ea819bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998144, "uuid": "59bc22f3-344f-44db-9382-e5c22e30c648", "comment": "Malware payload", "value": "0e92a973b5dc17478b368045e66e38029ffe5fabf97c121af6b8f9a10fc4ab63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998144, "uuid": "30c3f73c-223f-4f68-abb3-313ce9e3172b", "comment": "Malware payload", "value": "bb672f0a1b9c752b69e8ffe47ffbd2b35b2aad63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998144, "uuid": "7f504676-0256-4101-8b9f-486f2df4f201", "comment": "Malware payload", "value": "41286f670ea580397c4c0222f8ee601220c8b1eacfdea932513a07b66febfb1aeb15d7e522fca5069f1e2972ebf333d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998144, "uuid": "9285b296-8c61-4c53-8b76-0b07c1cdf563", "value": "T1C1A39D2165E0D073C42771305570CAA22F7E793227B869CB5B6829396FB07D06B793AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998144, "uuid": "b8e71bbc-58dd-4894-b08d-b6fa1f3b12b9", "value": "1536:3RFn670ej+X4UGUeBsb7umHBvNIItIVm8XX/Pnnw:3RF67311FUSmIMIhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998144, "uuid": "3599e79b-29bc-4b0d-b580-c693dabb1641", "value": 101318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998144, "uuid": "b8a81b46-5de3-4d59-9714-df944c2b8869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998144, "uuid": "9d4960a9-f2c5-4abe-9b9d-f5a8933a35cf", "value": "978086ecf4b9ef726ba993930ea819bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17974669-315a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690997350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997350, "uuid": "fbd4eb82-0c64-4776-89a4-469de0d72028", "comment": "Malware payload", "value": "91d60742a0fd856a6975448b05195942", "object_relation": "md5", "Tag": [ { "name": "comfoo", "colour": "#16D466", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997350, "uuid": "bc229d33-e595-4924-9415-4feb027d541c", "comment": "Malware payload", "value": "0f18616be5622718bcb500f240d0820cd5702cbed8889380e1e1ca20926b0cbe", "object_relation": "sha256", "Tag": [ { "name": "comfoo", "colour": "#16D466", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997350, "uuid": "30b991ce-c2e5-492d-b02d-7c6db1d06bee", "comment": "Malware payload", "value": "a53f4d1af5df02b962ef5c103c53c9e558384d66", "object_relation": "sha1", "Tag": [ { "name": "comfoo", "colour": "#16D466", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997350, "uuid": "3326ba8e-4d7f-4b78-b84f-3c826d0c8c4c", "comment": "Malware payload", "value": "4b75c87361f9637eeba266e465dcf04ed0a614569d3f6d84e91373caaba929bf08638ac12478938a7dc40284f3d722d3", "object_relation": "sha3-384", "Tag": [ { "name": "comfoo", "colour": "#16D466", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997350, "uuid": "a95302c9-0293-4c92-924b-17d630bc1e27", "value": "T167D34C03BA8585F6D668013C05EB6B72D13F16F82D2AAAC7BB10FE7505779E3A235107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997350, "uuid": "fc0f2dab-c91d-4b81-a3a8-a88dbf2fb194", "value": "886253b3437bfb96cfdab167c97d5ad9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997350, "uuid": "4526f698-3cea-4adf-98e6-dff69029cc89", "value": "3072:5LAR3b0R4kC65x2EbHmQI8eDx6idr1J0bhVl:5LARAR4k/2EbHmQnArrE9Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997350, "uuid": "d05525db-e6c4-425b-aca3-b329c947c08e", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997350, "uuid": "92e41675-afa4-4312-b4d6-570ffb7612f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997350, "uuid": "96ee8e02-33a3-46e4-8001-beba8069c8cd", "value": "0f18616be5622718bcb500f240d0820cd5702cbed8889380e1e1ca20926b0cbe.malz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41860bb0-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690964349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964349, "uuid": "c14df073-8e52-42cf-ae47-40740e67c7e8", "comment": "Malware payload", "value": "aaf14926cab485bfabd319985a886890", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964349, "uuid": "038f4bbd-eb22-45b7-bef0-28787d6d1669", "comment": "Malware payload", "value": "0f9bf5166c9b3ab8ec53635510bdc87c269415ae51eace428c88bff96871123a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964349, "uuid": "bb1f4d84-84cd-4baa-a629-4b8a56fe5218", "comment": "Malware payload", "value": "b1b1d815403ee5050356deeb590ba657b5806507", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964349, "uuid": "160aeaf4-b5c9-40d2-b815-a9c030ff0608", "comment": "Malware payload", "value": "d1270b9002981975fa85e6a889aa52ac2cb796ed7ae55662c36a9ff48ca21bc2645f40f187b74b23dc8db3d75a2e3e96", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964349, "uuid": "14008788-a511-4d21-8107-237e96e2fa44", "value": "T10DB37C1BB3A501FBE5768238C8934A06D7B2B86607309BAF43A407551F277E19D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964349, "uuid": "e4c14739-cc15-4d5f-8b66-3dd561fc06d0", "value": "7c6dafbdd1f1639a0b34078b8b0bd02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964349, "uuid": "62a2c356-c247-4ed0-9941-a22ac660cb3b", "value": "3072:Gfxix/P+e/re4IsYXu4m3Q6WwM8DgoSGS:GQx/P+n4IsGu4270oSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964349, "uuid": "394ebd3b-c81d-4761-9eda-b4eb402a206a", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964349, "uuid": "c081d20b-b9ed-4523-a85b-4130430b4613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964349, "uuid": "9647eb69-810d-4fb3-a38f-ba11fda3e869", "value": "aaf14926cab485bfabd319985a886890.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d0d855-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690966588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966588, "uuid": "e25142f4-b69a-4060-b061-a2b8bb5bca0f", "comment": "Malware payload (Formbook)", "value": "e83301992c2d948f67fb27191e7fea65", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966588, "uuid": "d5cca459-bc02-4ae1-981b-fd82640fd95a", "comment": "Malware payload (Formbook)", "value": "0fa6047b89faa0096bac58ca8733687cd676b31cd75675654e4e0343ca8ae8c6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966588, "uuid": "6d55a90d-18f0-4850-b45c-1452c4fa434c", "comment": "Malware payload (Formbook)", "value": "793086d2c371c26d59fe57c066b2d64fbff9f690", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966588, "uuid": "f065e496-bb40-4e3a-8809-a19fdd0d091a", "comment": "Malware payload (Formbook)", "value": "ef74e63bafcadf1a76a78933776e2656ba117bfef7e520feb2b7e346cc91c2fdff0cf863386361f124254e9ae7efd640", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966588, "uuid": "3589dc44-b4c7-43f8-bfad-7ccff6d52e43", "value": "T19AF4D0447269AB76F43E9BF45414818003F563BE706EE74A8CE6A0EA1B64F900F44F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966588, "uuid": "a3b7476b-b652-443a-8ee8-37981d725039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966588, "uuid": "eec0b506-87c8-4e23-a392-7d3498358258", "value": "12288:u5MYghQcLvxkAAIrWzgiE/XTp5UoQ+f+x/pOrWdHR+lBYqGa:u6pzAE7XjpeoQtp1n+l8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966588, "uuid": "da6559e5-c957-442f-9212-f7da1c7f12be", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966588, "uuid": "bf2906c9-3d98-44fa-9c29-f573dd5c85c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966588, "uuid": "f67d56bf-314a-4ca6-a796-249da6bc0a71", "value": "DHL Express Reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f9163-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690998179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998179, "uuid": "8ef65a30-bd0e-485b-b50e-7b98c289b965", "comment": "Malware payload (RedLineStealer)", "value": "2f19d74a2cdfce67915bbc1fa8e3ae24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998179, "uuid": "c38d91be-40fb-40b3-912f-e640b5221ffd", "comment": "Malware payload (RedLineStealer)", "value": "0fd055597e039f4fc1be41a3ce187a270ee031d5c4fe0b66d582e6b6dd93e1d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998179, "uuid": "944a865c-eb7f-4a56-8bf8-a75b17062e10", "comment": "Malware payload (RedLineStealer)", "value": "f8cec01740ba42bc937fa2b98608048279190b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998179, "uuid": "06f92b69-b792-4ad6-b203-a934296443fc", "comment": "Malware payload (RedLineStealer)", "value": "84ae10e7dc4019818aaab6c2b6f51387377b8c9acc8c4aa6cadff86af77058651e06aefcaa583c22580f5645beef83b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998179, "uuid": "ec72b564-b050-4191-899d-a3f9ce774dc4", "value": "T160B41212B6EC8036ECB12BB05CF602870B39BD619D38976B37496E0B4CB36D49476727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998179, "uuid": "14fca44f-a976-4862-b4d7-83b458c38991", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998179, "uuid": "ea205b32-611f-4109-beb0-787c22d22ff8", "value": "12288:EMrly90ErFsb21TM5s68EWCZ6j61PS6S1/bFusbA7N1TVg:Ry7s15scrL8FhA7Nbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998179, "uuid": "2bab8c49-45a1-4bc7-a7c4-66efc2b6cabd", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998179, "uuid": "0460ed59-cc78-4789-a1ce-86d1c435a1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998179, "uuid": "d04ce289-209b-43a3-a2c9-d7001a74bc61", "value": "2f19d74a2cdfce67915bbc1fa8e3ae24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707d047e-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690967435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967435, "uuid": "cd502df5-1f6b-4f7d-930c-e84e970916d7", "comment": "Malware payload (Amadey)", "value": "f6bb0d9299a517a36d9adc3c17de5d2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967435, "uuid": "2763c0f6-c52f-4b50-ab2e-1f61d60f93f4", "comment": "Malware payload (Amadey)", "value": "1046db67c759f646cacef2bce7199f237597696bfff39973fcf7092fa9fd8e18", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967435, "uuid": "b6bfdad6-fc8a-470b-9d73-3e4b136f602a", "comment": "Malware payload (Amadey)", "value": "154d82aa821e525578279c8d2cd6fa8e8254fcbb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967435, "uuid": "be51cae2-047e-4810-9045-aed03bd6909b", "comment": "Malware payload (Amadey)", "value": "cfc1b56110566061c33db8d890b0e40f1fb4caa56224fd03cc49715fd38beb97251ce1a42a4abbcc1840e3a8b338e05f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967435, "uuid": "2e402c5b-0d95-4287-be17-1d99557cdcc0", "value": "T1243408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967435, "uuid": "850565f8-5d87-438e-958a-d999bcdc8766", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967435, "uuid": "ae5b7c3d-bf67-4d73-a61e-8e7e22a3cb03", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967435, "uuid": "85579617-8309-49af-995d-7496f8bd4004", "value": 236229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967435, "uuid": "b991a9fc-b6ce-42bc-bf07-4ed663337663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967435, "uuid": "5e11f0ab-7731-4446-94fa-8ffcd11ebbc5", "value": "f6bb0d9299a517a36d9adc3c17de5d2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c8d64b-3140-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690986502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986502, "uuid": "4cc40ac6-62d8-4495-b23e-a4388f6d05e8", "comment": "Malware payload", "value": "5a436fcc642de838a6ea70f60e324ee5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986502, "uuid": "e16c4ab6-64c4-40f2-b16a-a9edab96ac7e", "comment": "Malware payload", "value": "10df744cf1f9de6cd6e2383d1be7c752773ad738aebdefb61034f51d64279244", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986502, "uuid": "6c2dd1e1-92d2-40c8-8403-0ea1e5e29483", "comment": "Malware payload", "value": "2c5a5424794fc225fabc2c414490f4dceb9d58c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986502, "uuid": "e6fc1a31-1c01-499e-85ee-d8ccf35c23e1", "comment": "Malware payload", "value": "a4f8b28f27abead4ba54c05b0f91a5c597e81471819f6c756dc7a7fa2bc94bb0218f6b9c21d1b167841ae4567cea3221", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986502, "uuid": "87fe1d52-433e-41cc-9004-5064f525a749", "value": "T1FBF22B10D6C0ADE6E4FA26FD87679635363ADD30834940FF23C52D5E4B286C25E709AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986502, "uuid": "5e1960e9-3250-4454-849e-5d8b857c9e3a", "value": "969ed979bcbb9cc9e109e354589ac767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986502, "uuid": "8257ab3e-4bf7-4d74-9439-fb696f427711", "value": "768:WqICRLQXVuvCt5Sv555u3Uon34nlXQn6s2ta8H4x3P7n/PLzncouezaDQT:WqIeOuvCtc7owRMrL7zncouezu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690986502, "uuid": "55af04f7-635c-43c4-826f-4255255b2520", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690986502, "uuid": "dd313029-1c66-4eef-b86d-639d5c7ad3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986502, "uuid": "6c910d6e-804e-4c83-aa5f-e47dc3c672b4", "value": "SecuriteInfo.com.Win32.PWSX-gen.12591.13315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc3ed87-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957877, "uuid": "92b4ccd1-505b-4ef2-a57d-235429fd1131", "comment": "Malware payload (Formbook)", "value": "6d9e22b3c69aa619dcf8c11e67d6b2fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957877, "uuid": "50badfe3-7b25-4004-a515-512a6201ef11", "comment": "Malware payload (Formbook)", "value": "10e494e5f0bd89040c84d027f6fc3c1465567fd31d037dd37922a5ef3b4dfb56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957877, "uuid": "3fb186a1-0da9-4d2c-850f-3da63e7b82b1", "comment": "Malware payload (Formbook)", "value": "4122ab078b8db217c6940511fd02e43e1d99a7f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957877, "uuid": "49995f9c-ba0a-4bb8-ae93-7a81cf931b31", "comment": "Malware payload (Formbook)", "value": "ad9b3d08ce10586961a428efe1580e9b5532243a112d54b0b59d5d024c88dac02fcb7a466b8ee8c1124055fdff3febf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957877, "uuid": "8ab0328b-8a8e-488f-9862-7f4465b14fa1", "value": "T111E412218B78DB6DC91A17BD1A31001553769F363635FB2F8F99B2DA2B367C21600DE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957877, "uuid": "1f7a9cab-ee3c-4f9d-9b93-2a6fa8deac57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957877, "uuid": "c759b270-26b8-4834-abe8-225a9c5104fa", "value": "12288:6+uZVvXFYmJ+37U7zqfX3qxc3s3etPzcMf1Y7EslJ3UYPI5klDJ5Wkav:6+urvFYmQ37UHqPtxpQMfi7rRNAklDJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957877, "uuid": "b36c8456-f2c8-4987-af08-ee4af122528f", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957877, "uuid": "3339cc35-35d6-425c-991d-953ea4fffa91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957877, "uuid": "830ed5ad-1504-46a6-b3f6-389e612a86f8", "value": "INV_19CE2022POO38_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbded021-3149-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690990378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990378, "uuid": "b461d1b3-5187-483a-be80-99fd5d605d9e", "comment": "Malware payload (SnakeKeylogger)", "value": "e6716571eecc33687c8a777c5088b6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990378, "uuid": "3616bbfa-92de-4982-bf7b-a71b8522bdf0", "comment": "Malware payload (SnakeKeylogger)", "value": "113110be82acb7cb2ab34a08a27eccba3c4ec6ddaf06e8ca1c50fd343197a7a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990378, "uuid": "4346fd70-5af0-4cf3-a52e-72a54d6db5bd", "comment": "Malware payload (SnakeKeylogger)", "value": "5cc10d9591021b8d4e2176f2566e422106af10bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990378, "uuid": "aa135930-9664-4d72-939c-48763e9c13e6", "comment": "Malware payload (SnakeKeylogger)", "value": "e479a10ad28416d9306193d5ce0eec793b1de1b136f90d867847cdff343eec9efaf4ee5f83262fa3e7b8d7fa40c715f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990378, "uuid": "eaf0ebed-acac-4b70-b95e-ede2abba9351", "value": "T16BC4383C1CBC5E23C170D6B68F95C461F55885EF32A28F7667C7AA51460EA0229CBE3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990378, "uuid": "5c50bb84-e583-4637-aaa0-86418d8931f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990378, "uuid": "f7d6c7b5-ef82-499a-911c-4028554e1c61", "value": "12288:OmdXOwdXdoIRdCLUoOZ2EYEeEpbBlJ+BNfE:lFdDdeth8bBH+BZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690990378, "uuid": "1d309241-db67-4601-ba22-909f2b6db192", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690990378, "uuid": "73d80ea6-6123-4970-b926-75aa78ae1970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990378, "uuid": "89a8d209-7185-4c06-9e7e-a109d4616d39", "value": "e6716571eecc33687c8a777c5088b6c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1cc64e-314c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690991672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991672, "uuid": "aa4c8d53-c901-42c2-9443-91885c2a40f2", "comment": "Malware payload (RemcosRAT)", "value": "313eb8602dfe4f5b989ed9e7ef71ea26", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991672, "uuid": "b0b9b972-a6d2-4d68-b783-69df4a2ddaf7", "comment": "Malware payload (RemcosRAT)", "value": "152c6aa91bc274a0662811c5671f952e44f4f0c72378f667d91a9b4c93a5e4c8", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991672, "uuid": "afb4f4cb-0631-4dda-b6ea-3c38bd90ff4a", "comment": "Malware payload (RemcosRAT)", "value": "3f0808f2f17e716b86306b71dc8f02819c7e1da1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991672, "uuid": "a5a1a1f3-6b5b-457f-9849-2c806ed665df", "comment": "Malware payload (RemcosRAT)", "value": "94927c2d02ec852a4aa9be6ace0f7c1c118ca0a1aaf7dec6e90815c8482d999cbc1808adcf67d495033e65ab1a6da150", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991672, "uuid": "654edbdd-5547-44a3-83bb-552c48e6ced4", "value": "T1AFF3E41223EB110875723B2C96FA29B84F5B7F95527C917C05BC251A8BE3A80CAD57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991672, "uuid": "2a08fbe0-efa6-4bbc-b7ac-78616143d10c", "value": "3072:u9F2mPpWppp2mpppppR2+pSpZOuZplpXm1Fx:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690991672, "uuid": "204b84b0-a474-40ea-a5d3-47b5ebd37ca3", "value": 171744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690991672, "uuid": "1a580528-8d95-4541-8253-da8201324456", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991672, "uuid": "91bb256a-7165-4b80-94e6-960f668a445d", "value": "remcos.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6854b0-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690969553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969553, "uuid": "812172cb-ce9c-41e4-8e65-b9cea509ea81", "comment": "Malware payload", "value": "bbb1da69727ca4ee9a63454a203a5d45", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969553, "uuid": "760f358f-8f16-42c0-8b1f-c383fd0ab5f1", "comment": "Malware payload", "value": "164a8d6c7b972425a5a07c0a406d31e028a7a101ae2ef2c2d22c62765b9d112b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969553, "uuid": "ce77863e-805b-40ed-9923-fd407d49427a", "comment": "Malware payload", "value": "81c010ed162b84d5d2dc338d85e23fb0d7967310", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969553, "uuid": "000b2804-2054-4ff9-863d-cd0517be0fc9", "comment": "Malware payload", "value": "666f04127a8150c78534b9f5e54ef22f8edcd1296cfa687fc7c209cd8b80570c1b15787627675f2a8d415bf02345b70d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969553, "uuid": "690ff86b-b4ef-4009-a2b8-3812a2fe0938", "value": "T173F4338E92F3ABB4D7A268EE0375D046E9E53CCB80FB8D436A218E4764D70615C1B703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969553, "uuid": "34cbc59b-7960-4ee6-8a98-77f674cc15f9", "value": "12288:AkWZJ4gHlPrj7QBu7tvmEFAwZ6sMZhHZQzZkJm52GQRU4LUJ:4RjlkE+wAthHZQzm0wGGPLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969553, "uuid": "659c945b-4c34-4d20-acd0-65a6a4586bc2", "value": 739330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969553, "uuid": "195ff34e-0e37-4dfa-999b-db98147a0acb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969553, "uuid": "54acc923-2a84-442a-b176-62f6bd555ce9", "value": "Purchase Order_1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0867e2d-312c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690977904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977904, "uuid": "65640322-508f-41e3-b960-7f77a6be3e00", "comment": "Malware payload (Formbook)", "value": "c52d61f4527cea4f33072d9261c66e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977904, "uuid": "fb78a29c-cc60-4d1d-9f64-3185d8ffbcd4", "comment": "Malware payload (Formbook)", "value": "173041a84f38f3bd419a6993ff06c7c3e53bb763058036d4b25a047e190a50db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977904, "uuid": "8389b2cf-bb2e-42df-b112-e89d51320d29", "comment": "Malware payload (Formbook)", "value": "e04686e3c845fa8dbeea70d2da18585abf4525b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977904, "uuid": "e34c0d4d-f234-4994-aa92-65dd65b18c93", "comment": "Malware payload (Formbook)", "value": "5f365ae37acc6ea6f14c3701b3e16275d98c2e114a896209be1b215dfdf6d85637d5f91b1057bc5b8e7994b8364c2c56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977904, "uuid": "23e3570e-7f5f-4d06-bb3d-e5606d017567", "value": "T171A48D54389864CAF3116C3344E8EFED51F42C755AA2CD8A96CD277C272C7B8BD2426B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977904, "uuid": "76ece12a-0663-4ba1-be08-bafb3f54a11b", "value": "6144:czSo/d5hYVOJ0WTUcrVA+cSJdtyDvU1N/ZZ9wdI4e41R6/I02XCkQSxK8Y+xiSoI:wSpWIEigyY1N/ZZ741RB0FS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690977904, "uuid": "3a0810ca-8796-4a91-a434-8869bfd39899", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690977904, "uuid": "32cfb449-0d9d-4217-adb3-0fcf2295dc61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977904, "uuid": "23393799-9481-4828-8cf3-17e3e40a4032", "value": "17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9898e92d-3115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690967931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967931, "uuid": "fa074ffe-e99a-43de-b348-9deb7a7a27b3", "comment": "Malware payload (Formbook)", "value": "f43da80652fdc28d625bc4a8023743a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967931, "uuid": "c8643d3d-c1b9-4a70-a56b-e9833c11b563", "comment": "Malware payload (Formbook)", "value": "190090b95e7c9b2410ceb2149bb1c4369550963e56693e331bda3d020a0018e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967931, "uuid": "f8f9f781-26fe-4991-a487-2e8697a87c35", "comment": "Malware payload (Formbook)", "value": "f2df5c4b839b6c9ec36016d4f440af9ad564b2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967931, "uuid": "10c932ce-3467-4a28-b1a2-08123067e350", "comment": "Malware payload (Formbook)", "value": "3c54992a28bcf2b52871cc369562bf3760ebf4faa5e72f9491ea7100eb101d6717a886e8d036e2d745ed4fd0d88a0ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967931, "uuid": "455f485d-42c4-454c-8f8c-40ede944fa2b", "value": "T103341212265CC18FE8E717712F3E969217F9AA2764E1A74B03601B4E7D72141FD0F7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967931, "uuid": "48cd3a8f-e88d-4b71-bb7c-e619b7d3aa36", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967931, "uuid": "f5685d6d-3c42-4c5b-b61b-d3bde9f4b14b", "value": "6144:/Ya6ZqZv3Cm8VhUC6Q9Ta5ruZbD4ZpjaQtg:/YjYn8V+C6eapuZbD4bjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967931, "uuid": "a00435ca-2274-47c4-8a4a-440d1cd3169b", "value": 252285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967931, "uuid": "f04ff188-8482-4333-bd57-a8f1b4bc6084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967931, "uuid": "8e2517cb-21c9-49fc-88e9-53083b1be751", "value": "Ultratech Alfa PO NO.333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae885b2-3162-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691000980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000980, "uuid": "62d8a4af-6fda-481a-b9d4-f6b2acb43d87", "comment": "Malware payload", "value": "0056e6e4f6f215c189d6145834240f68", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000980, "uuid": "3c6d7af5-ed77-43be-9489-e2d90585e1b0", "comment": "Malware payload", "value": "191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000980, "uuid": "162aabeb-8896-46e2-bf09-4725d9fee507", "comment": "Malware payload", "value": "9e2cca76b1e55b0fd2efe3646c28f3f40d224983", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000980, "uuid": "bb27f044-4316-4464-ab62-cd43b147baf5", "comment": "Malware payload", "value": "c2a89ebe5d3347be7f90aafa81a34dea08793e5a85ba2bf57e4f815d071b143209613a8bf32b4974ab9340be0fa3ebe2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000980, "uuid": "5b035e5f-d18b-478a-aa66-3776e2fe5bc6", "value": "T149F21B20D6C1EEA6E4FA16FC8A77A524363A9D20C34940FF23C12D5E576C6C25E706E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000980, "uuid": "d7a6f846-c7d9-4a4f-983a-9d40b648b51b", "value": "969ed979bcbb9cc9e109e354589ac767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000980, "uuid": "cefaf8b0-70ee-48d3-b06d-42f62640df7e", "value": "768:c1CCRLQXVuvC2ei5c5z3Dmf+4nt0h6eE2AazMmxS27niPL0bbjt:c1CeOuvC2/W15JtkQSCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691000980, "uuid": "1048b146-eb49-4a34-8a48-ccebbc530a27", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691000980, "uuid": "a7f9c252-f83a-4954-a424-5dd3cbb99f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000980, "uuid": "f3345af4-ab7e-45ef-949c-2e63b0df4e62", "value": "SecuriteInfo.com.Win32.PWSX-gen.31879.18695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665c0060-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966559, "uuid": "b9005b81-ced4-4e99-bc93-ad2871e7b7b5", "comment": "Malware payload (AgentTesla)", "value": "ac4f63b6d812ccccfc518e11261dbd2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966559, "uuid": "e09f7c82-952f-4fe7-b021-5a8b384c8883", "comment": "Malware payload (AgentTesla)", "value": "1b91aa318e9c011abed18662e8c577ddcb12499de26e2fd19bfb4a4ea81f7450", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966559, "uuid": "9cf14242-ebf3-40fd-a226-cc657489b2ec", "comment": "Malware payload (AgentTesla)", "value": "68275abd75aa0850bc2d272ed6e8d47ed38dec4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966559, "uuid": "b8182332-8031-4b2b-a6a3-a6070a4473ba", "comment": "Malware payload (AgentTesla)", "value": "1239d9ee554227807e96f5ba8ef82d9fc82ed2667fb8a51078c094ae1f53274309bdf95ffb4f7cf1126c1c91da5d595d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966559, "uuid": "6d1fd078-855c-4a66-8751-50df73b3eddc", "value": "T1C2E401039DAD8B92E92A47787D1B0E9C7BAA660CF946B7FE11750CDB3F413110D0A46E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966559, "uuid": "4d60d72c-60a2-4a0b-804a-7fbdd1fdeb42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966559, "uuid": "05177fcd-0203-4c47-b896-f85cb505de91", "value": "12288:kIsI2W0kMz2jwkMFBPnDurXNwRUH0cuxsNRsPOZe0bBuBGKtWdMPwj92S:hsDWwzwwFFtnSrdpUcdRsmrVQGbdMPw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966559, "uuid": "6b3414f0-1ef9-4197-923f-639a92d1a427", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966559, "uuid": "d383d6ed-bc4b-4cc9-b1ad-61edbae0f45a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966559, "uuid": "9f491ec1-11fa-4caa-b3e1-17db2af4b5d6", "value": "DHL-Re01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799ee513-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998803, "uuid": "416086f9-0991-4060-95ea-6710d9b58174", "comment": "Malware payload", "value": "f9778cc72696c3b0dfe78ae23fce2d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998803, "uuid": "fa839865-5f87-4995-860f-9324fe505f4b", "comment": "Malware payload", "value": "1c2ffcdacc67ed928064e5eea666a7e09e635854b6daa07c41ceeb7033ed923e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998803, "uuid": "6ee5d611-7429-4e6a-8490-c03287cd8381", "comment": "Malware payload", "value": "e40af627ee037e79d18af7e47805f2bb67507920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998803, "uuid": "81c9179e-0d50-4905-a9d0-272be33b049e", "comment": "Malware payload", "value": "8b75b8e5b2893be17b30f91ae4a5c4ab21425a3fe2be6f78da8195b01ab97a8af2b738e5e653560e04fc940bde6b0bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998803, "uuid": "ba5990d5-fdce-45a1-bdda-e89589aa4751", "value": "T16616334010C34B66EBEC863B49A81DE2A548B8387141654BD37CAEC5F3EC5BAF5E17E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998803, "uuid": "6c576726-29e9-4f1c-8ab8-c33e4e03e8bc", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998803, "uuid": "27317de4-33eb-412c-a17a-ec7c3a7fed6b", "value": "98304:yQBQOwFbWUob6rW7PMRSJDXSf/QSdu0/C:ylFbWU7lRC+4S/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998803, "uuid": "f87a07e0-12e4-4a0e-8794-228218ed1f2a", "value": 4067583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998803, "uuid": "edd1a3fd-2808-4b7c-8bab-d53647c9d87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998803, "uuid": "756965c8-b804-4b31-a15b-9448c2b9ce7a", "value": "f9778cc72696c3b0dfe78ae23fce2d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff511bc-30e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690946872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690946872, "uuid": "a6a34ac4-7ca4-4f24-a917-31087d920e8e", "comment": "Malware payload (AgentTesla)", "value": "6c8403c97b7d16046218c8b26eb36d45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690946872, "uuid": "0e61d23e-e17c-41d3-b058-e8f7e6dc6484", "comment": "Malware payload (AgentTesla)", "value": "1cd95a6e7380834f98182cef84e49b843d27c20bc2c111849a756408a8a2a34b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690946872, "uuid": "5427f1e3-910f-48c4-beac-24acafe6ac55", "comment": "Malware payload (AgentTesla)", "value": "c360688864dc407a298f10b42eb1a436ee5a2293", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690946872, "uuid": "08785401-fda3-4e69-bcc1-c9f7d1b04c8f", "comment": "Malware payload (AgentTesla)", "value": "31b2fc5381367b8faa30499f3289a7cabab5889149e1947130018af0a8b9bc286a1a612705ad9d724d6e2febb08dd7c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690946872, "uuid": "277f72ff-d2c3-47f8-b372-cf930e1067cb", "value": "T100F4D044726CAB67F43E87F45524418407B653BE707EE74A8DE2A0EA2BA5F500E40F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690946872, "uuid": "34b16547-8c72-44b8-9b68-93fe35d7af88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690946872, "uuid": "18611661-bdd0-42ab-827c-b87c5d606e5f", "value": "12288:o5MYDNqtNr/G+AcZ9ZcyQMmkXO34EA6Zsi+P0kj8qg/hKHGLDzjRs:o6Y4nrrqke33+Pprk0Gjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690946872, "uuid": "aef5a5fb-c409-4bc3-bb93-27724890a437", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690946872, "uuid": "25dd1b53-bde8-4ec8-9fc0-d7815d0740d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690946872, "uuid": "ae1b6ec0-6efe-41f1-b4f9-27c5573c885c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.20453.16698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a9e704-312d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690978310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978310, "uuid": "6ef2823b-f478-4651-a901-6144cf208abd", "comment": "Malware payload (NanoCore)", "value": "4e6b2990511ec813243e675ec932151a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978310, "uuid": "30cb79ab-0876-460a-9299-5366d0850f68", "comment": "Malware payload (NanoCore)", "value": "1d3537a78980a2e078642e4e0370f71533154d0212ab9984219b78b6191e3c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978310, "uuid": "003c83b2-c296-4378-9e96-5dbf606cc86b", "comment": "Malware payload (NanoCore)", "value": "b272deb21ab8c04d101259ddcb477498a572ef09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978310, "uuid": "5ae1a584-0c16-4bdb-b38c-0f08485a0c1f", "comment": "Malware payload (NanoCore)", "value": "2a9f0bb26367d7b063634dd4e923116d996fcc33126d46dacad38175f19dc376ba3f33311af6b88466626d1d5b9686e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978310, "uuid": "d2a366f8-f23b-42da-b663-22a39cb230a9", "value": "T1547413443FEC4029EDE605712FB60E929FADA9325028C74F73515ADDBA32681D90FB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978310, "uuid": "18afeb6d-bc05-47c6-a684-b5c5df4eba10", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978310, "uuid": "226e1c75-8f12-427b-bf09-f791f46b0903", "value": "6144:/Ya6BuYHHIE07TKxGwly/yhs4N2PKMFBIa7NkaMQVjNI9:/YXuOHx07TKxHmDect6a7uNQfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690978310, "uuid": "2cc8fef7-daa6-42d0-8b11-ee988d62d462", "value": 339563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690978310, "uuid": "f155b008-f47c-4fa8-a7a6-d81a4bc3ccfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978310, "uuid": "81df2e5b-cbf7-4be0-be38-36d7f9392893", "value": "Reservation -30% Off.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846f96d1-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966180, "uuid": "7f1ba61c-ccaa-408d-8e32-a9278d4a72a8", "comment": "Malware payload", "value": "2c39e4fa40271f319aa19583fea60551", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966180, "uuid": "97b64b46-4e91-4c43-8c2d-75e37103d8b1", "comment": "Malware payload", "value": "1d76f895c5375c2af7953cb81e9f2a6872b3528c6fe8f8916adfe543cede377a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966180, "uuid": "e5008f05-d06a-4d2d-8846-2f4faf3694fa", "comment": "Malware payload", "value": "fbda38f0f88814f263ad0335543eef5b6ab0c905", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966180, "uuid": "763a8568-33ca-4ed7-ac21-ec9e8affa5ce", "comment": "Malware payload", "value": "cd5cb9e05878d3c7dd68692bed2595dce265a651523b423800fe0184eebaba0fc90973d305b82fdc6b40a57fd32a0f39", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966180, "uuid": "034b9f1a-b38e-478b-ace3-4f4b338720f4", "value": "T16FD423961C6B410EAEBB5297449443F25C753E4B36567B2BAB2208FFEAE1E14350F07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966180, "uuid": "2167a8e6-8c39-45e4-a018-d5c53f020e96", "value": "12288:/SnWzc4WlNn+w9Mp4adlALepd889rF65qaVKvMVrSynRzRy9e:quWlN+wm4aALej9x6Uhv82iRae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966180, "uuid": "16385386-4084-460d-b6f9-a74b07d47c40", "value": 619842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966180, "uuid": "21ca08bf-7605-4ec7-944f-6044c9270202", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966180, "uuid": "7d6f24a6-e60e-4894-abfd-006e777dae40", "value": "20230703_INV-2023070297.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f614210b-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966800, "uuid": "584d61ca-2626-4f1e-bbb9-1c2a8140ceeb", "comment": "Malware payload (AgentTesla)", "value": "e7372be7593c3b4e8aac7e5b97d7fd4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966800, "uuid": "f15fb65f-d29a-4379-a69f-dc0b1a8a876c", "comment": "Malware payload (AgentTesla)", "value": "1f2d3d8890dd9e64645db50eeb14ff707f855defcfdd55eb5fe49f409373ca56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966800, "uuid": "53ee5dfb-1e7b-4172-819a-b351e7af8d9a", "comment": "Malware payload (AgentTesla)", "value": "96dc498e98a34c7a1906f4bff6b35f29cc84ba03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966800, "uuid": "1bec17bd-8d62-496b-ab3a-f43b98489970", "comment": "Malware payload (AgentTesla)", "value": "1bb02be9c7403458c01c044fb386ed1056b52d0c8afa7d61e5141518f8c5e3b8fedc6b3c75fec07a3ef0961e6417e2c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966800, "uuid": "0edbd545-5f1c-429d-a8f0-83da9bc73fd5", "value": "T16645DF067A755171CD00DB34C9EBAD20C6D3EE9967E2D10AB588B36D4B327BE8B071C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966800, "uuid": "f46f9762-5372-43b8-a9e7-2a660c0d2361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966800, "uuid": "d85d74f0-8244-49c4-8063-144130cea9c2", "value": "12288:L7+pP/nMrqzZQnUfm8u2BJWIAlgmiWbqlDjmRwd0aZsjwODc8ioz2LcsXEtL+:v4P/MEQIvTzWb/BbqVqm0aZQMXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966800, "uuid": "adb9ec73-4dca-4442-9b6d-728dfc533436", "value": 1220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966800, "uuid": "614cbed5-29b8-4f36-9280-6e0216e32656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966800, "uuid": "e30d0430-990d-4cec-a04e-cb17d68e1585", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3d7535-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690967481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967481, "uuid": "d6bc26b5-c260-4ddb-b599-c32f3f1c0dcf", "comment": "Malware payload (RemcosRAT)", "value": "eea7fa164cbd8d8afd5c7fde44aa5b0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967481, "uuid": "5f297d7a-f099-4953-96c7-82fe4e648aab", "comment": "Malware payload (RemcosRAT)", "value": "1f5f16708303943ac08ec370899c73caffc0a0cebbe4e4c32f7374f94c944408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967481, "uuid": "43f4be94-008c-46b7-8418-743548b24990", "comment": "Malware payload (RemcosRAT)", "value": "22f49ef78478d2fb8f8e1cf5788d57f227935b1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967481, "uuid": "8fb039be-6337-4182-ba96-9e4912616778", "comment": "Malware payload (RemcosRAT)", "value": "c91559054779566b1e18ec181cd73c1e5c5d2567b05406b56d0dc604ad189ce6e2a2e5ae02b784e1de6d732ad980d8c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967481, "uuid": "167b7c90-863e-491a-af2f-e6445592036b", "value": "T1D9A3A40BB69A9DB2C204573ACD9F50DC03A1D683F363D61AB64EE31E0903FE99945D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967481, "uuid": "7da25e14-4743-4e88-8df9-de45d6f2d678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967481, "uuid": "9299d669-10e8-4ae7-b19d-dbd14226c960", "value": "1536:joqM11CaYvvp3zYh5tz1qWFypfWK07cv4CR7QFoLAwWox75nnp5EkS2:s1CLktz1qWFYWDCRkFokwWY1np5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967481, "uuid": "a47cfb39-a639-4269-bb1a-fda29e65de38", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967481, "uuid": "8979a3ea-615f-4416-a99e-a04e6251b9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967481, "uuid": "43d11e16-5815-4f85-94f4-59e5a31208d8", "value": "eea7fa164cbd8d8afd5c7fde44aa5b0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6349a8f4-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690969560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969560, "uuid": "e904e656-1903-4e2b-a6fc-23483c9f5b70", "comment": "Malware payload (AgentTesla)", "value": "2066bebe7c32cf52b2e7e5b2ae6dcf5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969560, "uuid": "0b366b0b-8ea0-439e-beed-ce06939c19d1", "comment": "Malware payload (AgentTesla)", "value": "20ca9236b9070c02ddedeed75c4b5b478a06f31c9a3d714105503a17595e386f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969560, "uuid": "91fae3d7-bb78-41b4-ad13-5699ee87c68a", "comment": "Malware payload (AgentTesla)", "value": "acc4a396e69d6bb6de3791d8cda944d899f524e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969560, "uuid": "69c9a0d8-1322-4f81-ac5b-8055e135a273", "comment": "Malware payload (AgentTesla)", "value": "e79fc9e7fe2943afb5ae0c3aa098cedc05bd1219479859edd5829cb29b4ab8a647ddd9b40b90e2312d02c089d9250d50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969560, "uuid": "b6e92467-a28a-4ca8-a442-af83b5ddd112", "value": "T17CE4129527E4857FF0BB73B5B93001820A72BEBA34E0C6DF498634DEE16778059613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969560, "uuid": "8f211ce9-85e2-4b83-bf27-bc944d421b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969560, "uuid": "6c96eb10-45ea-451c-8f4c-a410ccb6a1f5", "value": "12288:Og7Jh13m+oB7VDW5pJN89HCpxHEM8XGysZrPBVr3UoKl:Og7tW+oBJD6prbEN6JNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969560, "uuid": "46b01318-0b18-4d43-a5fc-499dd4c73265", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969560, "uuid": "9291abe3-8c4c-4f46-bd23-bc73d5a5b092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969560, "uuid": "3ef9a015-5965-43db-a5ad-8bd3b8ecdfa8", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68dcab6-3102-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690959848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959848, "uuid": "929ee8c4-6fde-488f-a470-593f9400dbda", "comment": "Malware payload (AgentTesla)", "value": "5e5a912b4e35353f42714cc20cfe0a38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959848, "uuid": "0346d9dc-927f-4982-9e40-6b1067a9b170", "comment": "Malware payload (AgentTesla)", "value": "213d7c873754f120f2d7329e0cb33908992fe94fb3a2bbba9f6c900f83391fdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959848, "uuid": "fe8ca294-1210-4f67-a3c3-30070b00c2ba", "comment": "Malware payload (AgentTesla)", "value": "ed437cb295cb9e076b3b9071cb2c40edd6eecbc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959848, "uuid": "1fc0fe46-fca7-4dad-9f18-27b42757791a", "comment": "Malware payload (AgentTesla)", "value": "350ca2c9f1f2633f78f85b9a859e10ca32385a5f3600e0a5ddf4121f4059a3be836ccd6b45697e08ef5b2e67a423d46d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959848, "uuid": "559f3f29-1b7b-4cea-a249-43a763e50c44", "value": "T1EFB423587286C97CAC7AEF5704443460A0F6F05E93BE5DBAE9CCC9B4C4AD4638CEC961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959848, "uuid": "d5207e48-d089-49f2-84db-68582b0daa9c", "value": "12288:RelWvHAvu5K58aFjBkTNA3M/pff8ZIEvRZ:wlKgqK+avkTNLfUvRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690959848, "uuid": "da0344b7-eb48-424c-a8f8-e0a2e028e97b", "value": 528290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690959848, "uuid": "a41900da-bff2-47cf-b69b-d3e653e20062", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959848, "uuid": "94e5e4c3-309f-4cfc-9c54-cad46898dbd0", "value": "PO H0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326a97c0-30dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690943279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690943279, "uuid": "96b991fe-de8d-41fb-bb52-1731c98ef2c9", "comment": "Malware payload", "value": "1ca761b532aa363ae45b55f698e4eec7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690943279, "uuid": "884614b1-9cad-48d6-b00e-473d0458281b", "comment": "Malware payload", "value": "216054f0cb4a17285cc37390320665e38c48f96d6461496604c5bb855b554c19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690943279, "uuid": "719161ba-b9dc-4334-98f4-ddc6f6802894", "comment": "Malware payload", "value": "cf7c5106ab7834f5e1cb3e336d343f2f243d579e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690943279, "uuid": "d90ede4a-46bd-4ad3-9cfd-bef8f37770c8", "comment": "Malware payload", "value": "fa39ab0cab4a336f07c3989dbbbb8f0575aaafe4ae8b947b6a9fa7b0f3c83f9c8083da3ac31ed4718af07f4f460c4f3a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690943279, "uuid": "fa6b6458-06a9-4d95-b39b-29d95c41ee25", "value": "T1AFF21B10D6C0AEE6E4EA26FC8767916436369D20D34940FF23C53D6E5B2C6C25D709E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690943279, "uuid": "665aeeb5-f632-488e-9dcf-08738bb30789", "value": "59fd9007e1ae0a333e9e71b3ddb860db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690943279, "uuid": "a8311226-98e0-4c0c-85c6-e31ccc2b58d7", "value": "768:J9Q3CRLwXVuvCyRS5V5i3QErz8nd/crec2Za4joxI7jnnPL5FLI+U1MQxKDIrHu:J9Q3euuvCyofk8VYEvj5FLI+U1MQxKDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690943279, "uuid": "7de448b3-1e4c-4241-9d8c-31a2cf66be80", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690943279, "uuid": "e51d904d-34d1-46b7-92fc-bf6624f34131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690943279, "uuid": "e1b8bb10-d027-4682-a404-8a6450b8cb3e", "value": "SecuriteInfo.com.Win32.PWSX-gen.19836.13671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97437b11-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690966641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966641, "uuid": "d57f87ac-57b5-4c49-bc53-a901c4c31408", "comment": "Malware payload (AZORult)", "value": "0167ac4400f39a4363d85cb15381dce7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966641, "uuid": "6947d0db-0e72-46e8-8961-bf93308cc8d2", "comment": "Malware payload (AZORult)", "value": "21dc118af9730d6f93bba477a5dcb12589aabbce66bf668048ed3486c1d1a076", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966641, "uuid": "b3a81841-1d34-4a6f-b1df-d10b7e876e4d", "comment": "Malware payload (AZORult)", "value": "5fd57f717dcd1ba23f626c7e8e796b15977f2387", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966641, "uuid": "ccfecd4f-eafd-4810-bc7f-0c94caffc0d8", "comment": "Malware payload (AZORult)", "value": "43d6c20a7d088a0d0ecb06e6ee2ecc9e38065dd7e31a047949cd6d24da9c00c1669041979ee5441421e16780c3653192", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966641, "uuid": "1a5ba335-ea35-42f3-acf4-1dec3a30280d", "value": "T16144F1842AF8C467C1921B701E76A637E3B5FE3D5829E2179F527F689E38241C70D24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966641, "uuid": "dacd5b64-21e1-43f4-a9e3-6fc79b65e7fc", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966641, "uuid": "2f70f8c3-495c-4f34-ae19-3104e9cf5d51", "value": "3072:H030XCIscLlj+c4qw+bP5YEjyuUaPlj//ROUD5EFodCiNznBD8VPfVdTyZmLcaF9:Hj+q7POEyunPhQ+5EmdraPT1Lck0I9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966641, "uuid": "703e9261-0370-4ee1-a7bd-84f74b7bf0e6", "value": 274208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966641, "uuid": "0ddd3984-3cf0-4c9c-b24f-b9a7318d8c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966641, "uuid": "2f014473-ad84-49ab-9a44-b8ae6ee63ecd", "value": "HALKBANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0302f97-30f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690953878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953878, "uuid": "93dbc5cb-8dda-4b27-9bc1-96792b791957", "comment": "Malware payload (AveMariaRAT)", "value": "4ac3722b4a6ab5192a728768c91b3857", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953878, "uuid": "0d07408f-bff4-464a-99ee-cfafd4909c93", "comment": "Malware payload (AveMariaRAT)", "value": "220a1c56a744037642df1ffa23fb21c675d070fe0418849a989405aca2a28541", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953878, "uuid": "4a2b1d63-ae25-45e2-a52c-976ca2933444", "comment": "Malware payload (AveMariaRAT)", "value": "905bb2f604a40d9e47f59c25b31a9f0f54dfac83", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953878, "uuid": "7b4bd030-1d05-4533-b83b-3a5a0b256275", "comment": "Malware payload (AveMariaRAT)", "value": "cecf96d72d61855c7fc1ba84973a16a07cb12407bb208447c8222f20ef71c4cc4db6bd6c2c97535585fd07a1fcfe36ab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953878, "uuid": "632a6aeb-278c-478e-9698-2e19dfd3c428", "value": "T1C8242307776602F176EEA1B01198E57E5C1315CA827CC57F781B3128BD28AA9E7D1F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953878, "uuid": "abe44142-2c25-490d-9f19-ec6013c649e9", "value": "6144:ZwIIRsvgsADmbzW26mxG4wRVMr+OygMpCa/xs8:ZcshADEW260liCTygMscH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690953878, "uuid": "80b7ff09-0d9a-44ac-9a02-906d288f266a", "value": 224671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690953878, "uuid": "f6f87d8a-d759-4bb4-8bd0-69b0d8be82dd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953878, "uuid": "73eb2b00-3507-4203-aecf-6bfd4ac06f16", "value": "inquiry.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7152b137-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998789, "uuid": "f0ba8ae5-5d27-4308-b32e-7828ac2ff314", "comment": "Malware payload", "value": "00dc13dd514d982ea1afa5cd6112db9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998789, "uuid": "adc11940-3e62-4ed3-8509-65afae84e64c", "comment": "Malware payload", "value": "22880a18038986c7de0dfdc5c9a80df755b4b674633f84e96b0822271cf744e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998789, "uuid": "d8731eac-4b3b-470b-ba6e-ea64ab6ac9b3", "comment": "Malware payload", "value": "996aebe67c85ee6b6d9a9ac350e7ba7d6b44bdcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998789, "uuid": "2dd98ea8-a848-4845-a2dd-ed87f2b7e3cf", "comment": "Malware payload", "value": "ca708cd3c6050a94e2a3ecfcbce8ad513f80aa8c628a07f0199c426a24de0dba1fd285f306d29f6fb4abe3054bc3b787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998789, "uuid": "573d8cb8-4e32-4f21-b136-432f73edce3b", "value": "T1D0A4A05A0AE93C10DC9FC52DE76E7DAC4392034A5A0274A906FF4C586B3D6CF21E5DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998789, "uuid": "8e58e340-87c6-4493-bf3a-d8bf4e3faf23", "value": "341ef3eec107cf8949a849080b1bfce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998789, "uuid": "ca845f03-48fa-4970-b841-3941d2e5f230", "value": "3072:1JvvfEvhiC5L7inzcke+8V9jFhS/TZvex6KoDTTDHN8UDBCWnez3p2wDwtDa9JdB:LEiChVo07E+eDa9uDQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998789, "uuid": "ece45406-c62c-47fc-9206-f1596682d5c6", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998789, "uuid": "48941801-ff4a-467e-9ce8-bd6bafbfc52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998789, "uuid": "0716d58b-e4f7-4528-96dd-a5f107b6b223", "value": "00dc13dd514d982ea1afa5cd6112db9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9ffcf6-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690970274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970274, "uuid": "24daab15-5c6d-480f-9435-782f02661edd", "comment": "Malware payload", "value": "e5db264540e630ca55d377e83841b340", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970274, "uuid": "8a8f03d3-e6a4-412a-9673-2892ad7dc441", "comment": "Malware payload", "value": "244403b6a6e2118b71c4723e1552330ea99c9ba255ee55f60817aea4dd307d61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970274, "uuid": "0032c3fa-6f78-4753-88b5-206da65365b9", "comment": "Malware payload", "value": "db5c9867d5f9e1c57e8164a9ce17d080bc772425", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970274, "uuid": "e6a0b3b7-d847-4a86-9cca-513c12f71c44", "comment": "Malware payload", "value": "b88c84e0c08951ebe0004428faeeb4350f148be182fa1ac53b261fd467eae8b4fa433bc522f3f3d8bff218e590ab865b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970274, "uuid": "914346b2-0856-4d04-b27b-3cbf7ab05f5a", "value": "T19BF3A91E6F338F6EF668873147B74925975923DA22E1D684E2ACC1105F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970274, "uuid": "b7848517-a89a-431b-8623-9fb38d98ac9c", "value": "1536:9MHV0d+9edSAZTZtZdNKGd7sUeN8IlPBjmTfNYoDFQT7GvQqQK:9M6DhZtvNK+7sR8IfMYo5QTKvQqQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970274, "uuid": "2f316827-6fcd-48c5-a07a-43ca7b66cac0", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970274, "uuid": "1a8356df-f00f-44d6-9728-0934a62d0c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970274, "uuid": "e49f776a-9a71-45bc-8999-dd4134298b45", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65db8eec-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690969564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969564, "uuid": "c3680224-67b9-479d-8ae2-34870892dc17", "comment": "Malware payload (AgentTesla)", "value": "ba59e646dd6c13696f7f628775aca485", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969564, "uuid": "7265304a-7ebd-414c-a921-20f97e317e30", "comment": "Malware payload (AgentTesla)", "value": "254ac19fea0bf1c463f7b2122019f58a3c77a4cb6dd4815c1590b3528397d44c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969564, "uuid": "140096f1-5eb9-4156-9b80-7ab91a91e1bc", "comment": "Malware payload (AgentTesla)", "value": "461aa437863f5a02b711b080ce354a001c2cbb04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969564, "uuid": "ebdc608b-a2ea-4de3-b84d-3c7d51d047a2", "comment": "Malware payload (AgentTesla)", "value": "e170c98c91d16bc039e821c72cdf1b45120f7725fbd8bc7b3087a9a9fa88c21b9d7ca910cb42dba763acb2574c954f61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969564, "uuid": "5f199b08-8d51-4a61-9199-38f7ed3d1e1c", "value": "T1CEC423D9243373D696F1FDA4000DAEC4821F1164E4F7C135AE34975E9AA79FB283A319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969564, "uuid": "1841f43c-e61e-44bc-ace3-c75bafe11f76", "value": "12288:yNPmLfDWyjx7WVlvgYdi/pDGvKSdVMDNQJpLTfsMK4CjaM:y1qWyjx7WVJgYdOqbMDNQ3LDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969564, "uuid": "7f07fbde-b1a1-4a9f-9988-cb9788aba19a", "value": 559791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969564, "uuid": "c51b23ad-4364-481f-8c35-9c9d3aa008ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969564, "uuid": "13268322-f32b-4bd3-afc3-389354212d90", "value": "Quote JQTM2623(WTL).pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c436e5f-312b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690977306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977306, "uuid": "dd4775f8-038b-41f8-84b8-8c14ae0ebe48", "comment": "Malware payload", "value": "263c8da403eff5f360a6acda5d95c9af", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977306, "uuid": "381e2e92-644e-4d3e-8e64-a5c2784ade93", "comment": "Malware payload", "value": "2617651bf6fed3abc52be5f0f7e7ea5df915309ec29ac48b06d2c8aa452b66de", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977306, "uuid": "defcd626-4519-4388-a963-b1747412765c", "comment": "Malware payload", "value": "9d7112b41b2366af66be9440fda98ff1f011d530", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977306, "uuid": "4354b098-1232-438d-a82d-9521de696e61", "comment": "Malware payload", "value": "1d40531cd9052530eb49548f99ecbe12779525beed480753ac9f5e192ece762e1d33f7a0c0a23c3e4296920ecdf02dfa", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977306, "uuid": "c6456b0e-8c8e-49dd-8bb8-fd18e06731b1", "value": "T15CB0126231896962823B511E06010A03643D8B1528654EF858062B940F065C95F35057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977306, "uuid": "34f25189-05aa-452e-94f9-71e15565aa4a", "value": "3:12yTSX0UXDTFESSpiKMPvf/9DcVzVOXc6:8ye9fFECKMPvf/9AV5p6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690977306, "uuid": "5d2680cd-014b-4b67-97dc-48bf5c9df52b", "value": 100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690977306, "uuid": "bec4d0f5-7662-494e-a300-1bf1606f741a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977306, "uuid": "a2083d24-92dc-4d89-a5e0-2a2a1cf8947e", "value": "TJLAFI20.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb283d2b-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998162, "uuid": "b0ed5d6c-94ef-4905-8945-32c8a9757e24", "comment": "Malware payload", "value": "3cd67cee34fb2448f37cdd5e1d1b1333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998162, "uuid": "695b268c-ded3-4bee-8509-8c924098180a", "comment": "Malware payload", "value": "267be58b72a4de93ed75a30d9893169f1f9be90faa993f04d4f8c7b6a5a67a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998162, "uuid": "a5ed5b2f-b966-43d9-857d-4866be4392bb", "comment": "Malware payload", "value": "609e66cc45598f8f44cd371bcfc98822fb3a003b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998162, "uuid": "82531044-e237-4d04-8c4d-64be9708dad5", "comment": "Malware payload", "value": "d6d08ee5508cb9fa1dfb1cb8633964d0f4063cfdb925a8265e5230edd7edc46e96d6a20471e27de4d49b763b63b7bbf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998162, "uuid": "4d3a7ace-670f-4691-8d10-bd166f3200e2", "value": "T1A4B40257E7E88073E9F667B015FA02831B327DA19D68877F2A51AD1E0C72680B47137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998162, "uuid": "eda9c8d2-a5a1-4648-8805-3fa7eb549635", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998162, "uuid": "db987a82-dd95-4b51-88e2-8b1950e6745e", "value": "12288:wMrJy90bOQO247iycG6BuiXRgBYCsATlwuowoYDR505St:pycV747pcGBiX6zBJwuyYJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998162, "uuid": "ce6d518c-69a7-4a60-941f-696be0c2ca81", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998162, "uuid": "c542eab6-5739-43ea-917a-4764989210a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998162, "uuid": "5f832cc5-26d9-4724-8172-81e164514f0e", "value": "3cd67cee34fb2448f37cdd5e1d1b1333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d07a2a-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966803, "uuid": "f99d8f24-1b02-4b2d-945b-447e90808785", "comment": "Malware payload", "value": "1ccf404df635e0f6e75ce299fde9a5d2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966803, "uuid": "35a2e957-6310-40a2-a641-9590ea2722d5", "comment": "Malware payload", "value": "2688c742345ce61e419b9c8b68dfe452d40bc764284fe400f40cd0275a6e48d4", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966803, "uuid": "cbf052a5-18ea-467c-ae0e-2f00cf0de6c3", "comment": "Malware payload", "value": "bb056d4208e4581a60c48a491dbb83e1807be754", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966803, "uuid": "91342759-d7a2-455c-bd61-9eb36ade1ac3", "comment": "Malware payload", "value": "4d0aa45f3c55c160e78eebb0de68c86d7041dfa944c58ddf090d2cd975cd634e50a28598ea9c6e1db2c5abeb852232fd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966803, "uuid": "3544c0bf-8dbe-4d65-b23d-80254e032ad6", "value": "T1B523018A016AD521DBBF20FEF001A709819D24738E10FEEA484D1FF64C8AFEE41655DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966803, "uuid": "75a73543-ca6d-4fc6-a27a-5bba98b6dab1", "value": "768:7KZyA6oyOZ14bCG835Tlg4RpID4icODVci5oabFj2ycbzYjF0mKLT7HCfcSx:75AP86e4RwDVz5bN2Hganifci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966803, "uuid": "3b599b83-b388-4130-a2da-c6cfa6e1e836", "value": 45739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966803, "uuid": "ba4f094b-9f65-4fbd-ae8c-0f37fa65012f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966803, "uuid": "e72da4cc-a3cd-445d-a3c7-b92aede5f523", "value": "KPI_catalogue_2023_samples_list_revise_ol.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7a69e2-30fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690956850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956850, "uuid": "1f44ad48-0518-417c-9dbf-3dea44da22d0", "comment": "Malware payload (GuLoader)", "value": "9c6b9ba35b609287699e2ab832d185a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956850, "uuid": "435fce82-8ce7-451f-b1c2-21df98e4fde4", "comment": "Malware payload (GuLoader)", "value": "27b13ca93042eff79f39647528803c8e7a7c29eccee7c3d10094ad7e52f17297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956850, "uuid": "1fb08353-fe05-4fcc-bfc6-8334c257eb77", "comment": "Malware payload (GuLoader)", "value": "e7f963786b8a4de52ec75f62d47a511547afbca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956850, "uuid": "375d05b8-76ff-4033-a97c-dd5e76260e1b", "comment": "Malware payload (GuLoader)", "value": "916c02d0b5d8f687ecacc359153bc7d0032188cd5cb39bd6b8e838cc96b9d41b9747d8a8a6d261ba6ee86196509d3705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956850, "uuid": "b65cc519-78b2-4a27-ad39-36c62fc89167", "value": "T132948D48F763ECE9FA6A0379257159263F419C5E60D9285D228DFB263C32212509BCFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956850, "uuid": "73e3a32e-f884-4491-84b5-09dd4033b0f9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956850, "uuid": "8630bb19-a550-4fe0-9063-7fb03dc17908", "value": "6144:NQ606x3uwDG+coSJR9Mgp3pbITJwu2C8oaNuVE2IJbkjQ47b6JIyy8i:nhy+hmhCRVE2Idkj7b6By8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690956850, "uuid": "db3da5e1-9d2e-4d65-917d-7ae2dd4d3e40", "value": 416204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690956850, "uuid": "1747e77f-f0f1-4907-8770-dbc18387f3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956850, "uuid": "3ab0b2ee-017f-4474-9808-f8b46bd35748", "value": "NEW_ORDER#794789_SAMPLE_SPECIFICATION_TIANJIN_INTERNATIONALSAUG2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44cfa0b-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013102, "uuid": "523133c6-12ca-409e-b115-a78c5b50deb2", "comment": "Malware payload (Mirai)", "value": "8c0c1f6da7c50756a0e4dff48939f3ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013102, "uuid": "9e0bd56a-49fb-4b8a-882c-2d64de00a191", "comment": "Malware payload (Mirai)", "value": "2836c0135994f5588908a14be6131b05fffec3232e8cbc751dd7c57bd2570f91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013102, "uuid": "7e709892-6496-4faa-b752-304965e25da9", "comment": "Malware payload (Mirai)", "value": "f00dc4caf2539c32a2ce617c025d67dbebe14b42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013102, "uuid": "71f7ffda-1f35-496f-b1bc-83d27820f562", "comment": "Malware payload (Mirai)", "value": "ca922a9e670ed9cfecbabc7f48342ce3c763b53fb5b56302232f27adef10371d9961c4d8a522784f6e62f7bb8732c22d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013102, "uuid": "742a55e6-2c8e-4745-9548-8791a4e5295e", "value": "T1AE732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013102, "uuid": "3edd461d-06c4-4ca8-a503-b42b32b2f209", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXmSKV6v3G78nN9Wr:927jqCA8v3GI/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013102, "uuid": "3a842259-0bd3-4c75-8946-398345e80adc", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013102, "uuid": "5bd31607-22c3-4c61-a7fe-23ad259b20f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013102, "uuid": "bf1d3f95-d350-4398-9d9f-c4ab5fabdfdf", "value": "8c0c1f6da7c50756a0e4dff48939f3ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ac1cda-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690970262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970262, "uuid": "434ba96c-3004-4d2b-96aa-ecfb22b79189", "comment": "Malware payload (Mirai)", "value": "5625dd015eaa8a433a5db44ec3b0209c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970262, "uuid": "97974849-cae4-4e75-84a1-610d3cf07f85", "comment": "Malware payload (Mirai)", "value": "28d2874a76b5e8f7af718c652d170dea0325ded9e9d39ec3e161f1a2d06af6ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970262, "uuid": "533ee2bc-aef8-4eb9-a927-71489386c131", "comment": "Malware payload (Mirai)", "value": "fc954dffb1e694dfb24a3ab5bf20eb8e7cb1780a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970262, "uuid": "61174e96-092f-4f03-9aee-f7a6e1df080b", "comment": "Malware payload (Mirai)", "value": "d8ae0bb642e424edc30521a4744e7b6a63ad80fae7cc0bb22f3a8f285debbfea5722b8477ff5d729c718088a3bc0a574", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970262, "uuid": "91a78e90-8f22-4be7-b5fa-17df6c2383c7", "value": "T1B7C32A45FC508B13C6C252BBFB4E428D7B2A1758D3EE72039D256F61378B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970262, "uuid": "ec64b975-3632-4983-aa0d-49fb78bdcedc", "value": "1536:JhtOKCrqaXRFOAKBc4Va2/sTgdMVyTvaCp2EnIdllDuawywrFv7k8uZtlqGKKONg:Jh2HhFOc4pkMdMVyTXsqIRJk3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970262, "uuid": "77e8a8a9-150d-4839-9eb1-6c77b3d2213a", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970262, "uuid": "f119a221-f97e-486e-a15e-44c31947f1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970262, "uuid": "5a0f9237-23b1-446b-a665-e0503399be03", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90337b7b-3131-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690979943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979943, "uuid": "df6c204b-3b93-42d1-9755-167d53ae8a08", "comment": "Malware payload (GuLoader)", "value": "991a71a7e025538223dbea2832308b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979943, "uuid": "30e947fb-472c-47e0-9f34-78d0b303ef66", "comment": "Malware payload (GuLoader)", "value": "2952bf5efc5b011349d22cbe6e7a813f0ae014d145f23115184a36a1448262d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979943, "uuid": "2b8baf80-1642-4322-a5ca-76e74865f333", "comment": "Malware payload (GuLoader)", "value": "76098153940447a2f89e4fbe8ecf5d31a2dacdc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979943, "uuid": "1ef39d3c-1e4c-4e38-843b-a94278249de8", "comment": "Malware payload (GuLoader)", "value": "df2002e136d3f5f41c708a6f0fd59b9be8bbd028c0756ca7b83eec23cd68f8434e127551b325bf5518a282ba4eb1e06f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979943, "uuid": "6ddd2124-4777-46c1-81ff-4c46c89283c2", "value": "T1DCA41266B7A0EC67D06413B0F86499FEF7694D01DD34870B41EA7EC33A764638B0928E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979943, "uuid": "076e318a-20af-4f97-8b7d-37623c115b11", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979943, "uuid": "bc2285c0-323f-432a-8cbb-3cf426ff88a7", "value": "12288:RUzuSGGRKqmfL4g40Ya4LiMEMU6tQLk7Y:RUCSGoK5oa4LiMib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690979943, "uuid": "d6a689de-f31f-4c0f-b9ee-ce79e5293325", "value": 493400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690979943, "uuid": "9de01e2b-1111-44d5-8954-1894a58a604d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979943, "uuid": "5a1cbc89-3fe2-4cd7-bf6b-38cda2573066", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47ed4f7-30d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690939685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939685, "uuid": "ef091e74-bc2d-41c7-809a-07e12d9e9048", "comment": "Malware payload (AgentTesla)", "value": "eb8e15733ba6e928ce75615e08134fe0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939685, "uuid": "eff121b6-4b1b-4679-b073-312be1501d1d", "comment": "Malware payload (AgentTesla)", "value": "2b11e9db29264a2312ceebcec9d16540d67d888b63e911f4d6554d5142e754d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939685, "uuid": "37b8dcf0-f799-4926-9d5c-01817bb9236c", "comment": "Malware payload (AgentTesla)", "value": "746e2a1885c507134b41bd3d650588de87464840", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939685, "uuid": "19c3e227-1dfa-4df7-9204-798e7ddd0be4", "comment": "Malware payload (AgentTesla)", "value": "86dc7db5abb981ae854bbc56048725ac65c989266fb62078f6c0c2d2d9cd5a3d708dd2fc2c728e670b621c30f1d862f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939685, "uuid": "e42c75f6-0fb5-4f83-903d-afb17ba67fc7", "value": "T1DFB3B347B7BA84E1E1549BBAC5DB60100361DFD7B263D6CABC4E33111B323EA5426B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939685, "uuid": "902d6662-42c0-4bde-a58c-3a8bef9664b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939685, "uuid": "5fc7a6f8-7b2f-46d0-90e6-09a8994748b8", "value": "3072:HrCAs6wid4onQPyJ593PDwZbWTJ98EdtmF8gfoo9yI:HuAs69+onQuNbQbWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690939685, "uuid": "0adc6c79-fd67-48e2-9ffe-98732ce50975", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690939685, "uuid": "136c7a9a-61c9-43e5-b845-85d1c05604f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939685, "uuid": "1c779f4d-62bb-408f-b36e-e6481605fed6", "value": "SecuriteInfo.com.Variant.MSILHeracles.99664.10813.18235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6a2e83-3104-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690960776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960776, "uuid": "364ce54e-e8fa-44c0-9255-f77335f542c4", "comment": "Malware payload", "value": "6e412c3f518a5e9913290738c8460d2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960776, "uuid": "2f1bdb5b-b493-4bdf-a9b1-f85693d1782e", "comment": "Malware payload", "value": "2c55b055d4a89fc7ba2576c9e6b172d793dc42351140ff1c834776e26c34f9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960776, "uuid": "e156b314-1d1e-47aa-b51d-334fa71b8bd3", "comment": "Malware payload", "value": "e561c3c788acaccc2c29b734d5b4ba29c2f4ecd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960776, "uuid": "ab0aef85-b0df-4554-8dbe-d13dc6c0fe97", "comment": "Malware payload", "value": "95c4380f658636ce3b50255af2e7bb233680632407308c79276fe101ec65d27e05004d2c91c8fca3b1aba4244b4757f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960776, "uuid": "3cd06101-695d-4165-90ab-d84aa78281a4", "value": "T11D878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960776, "uuid": "04c96d22-84b9-4b89-9df9-f7211a493091", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960776, "uuid": "0057bab4-883e-45e9-87f2-63543e50dfef", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfa:fMguj8Q4Vfv1qFTrYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960776, "uuid": "186b6e92-9e60-46cc-be5e-93c57755e92d", "value": 37652021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960776, "uuid": "d0787f71-30be-447a-b476-e11094c7f7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960776, "uuid": "e40f2d98-7e4d-410e-b63d-796244f7d795", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7b70e5-3150-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690993253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993253, "uuid": "b5f531c4-833a-4fdf-b603-897fa0f85fad", "comment": "Malware payload (AgentTesla)", "value": "c63a113663b6684d530c1872f29f6894", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993253, "uuid": "460119dc-8ff0-4409-9ee4-46fb5f3f4e1d", "comment": "Malware payload (AgentTesla)", "value": "2ca44c089612580726ee9da53877ab2b65c31d57abd49c0d8bf61037eb25a2a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993253, "uuid": "3600b549-f748-43c8-9b3b-c2f04260127c", "comment": "Malware payload (AgentTesla)", "value": "b63386b2d43a1ac67b863b55a64870c88ba1ae42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993253, "uuid": "cd240404-8fa9-432c-8efa-7c54bc879e99", "comment": "Malware payload (AgentTesla)", "value": "0f69df3aa17f7ad1cdd14d2e91a05aaddca25b6c32837019ad69558691cd565bdc32ad914efe7a8c3b85d1fd0f1bc006", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993253, "uuid": "6269ad42-cfa0-40b3-95c7-8be78b7d4f73", "value": "T1E5F4AE29F16BBB07C1F9A3F9A691A10003F65C5E3C2CE2687D95B4D9A571F002A53F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993253, "uuid": "867c45dd-6d1c-4245-87f1-8c0d36b3297a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993253, "uuid": "4e782f0a-adb0-434f-989e-8da00bcb58fa", "value": "12288:864NZ2Dm7KZqfKezk3TpYgnOLxs1txXt7TXpZKIY/bBZ:94vTKYfKYyFPn2axJ2I+tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690993253, "uuid": "0fce4d27-b2b6-4e82-ab71-462ddf30e23f", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690993253, "uuid": "d0558537-1b60-4638-b138-f7156bf11a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993253, "uuid": "53375ff1-8459-46f7-958b-47305304ee2b", "value": "rBankTransferAdvice-REF310720230193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d611d64-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957122, "uuid": "ff7de821-3404-482f-8fe1-8baf905799f0", "comment": "Malware payload (Formbook)", "value": "57e9d1f10761c88a94a5c67152c0116f", "object_relation": "md5", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957122, "uuid": "1a499142-a03e-4762-adec-70f32a30e458", "comment": "Malware payload (Formbook)", "value": "2cf1aa6e42a4116110b4b054b7e44b889a5cec40916393883c6bec4388e5599f", "object_relation": "sha256", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957122, "uuid": "e3ae0152-b354-411f-8813-d58eef216191", "comment": "Malware payload (Formbook)", "value": "0f5348591d5609f69fa322c2a25c997fbd401185", "object_relation": "sha1", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957122, "uuid": "a8208e08-d8b7-4405-9b5d-a597d57f3182", "comment": "Malware payload (Formbook)", "value": "8bab9417ec615c60fe7e638f85edfab0d103d9e113741cfe64280fc20691845fc3f3de5785e1b5d619cf6386db763e32", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957122, "uuid": "ded25b95-022b-4346-a7bd-40b99fe933eb", "value": "T148326D69EF98C1ADC31A60BD61602655DFADBEE7D358930B5DB0AA5080E23AF4301317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957122, "uuid": "328c7fc8-fa68-4342-9c82-413f79a850a1", "value": "192:qya0Ne0vGWo4N5eNA2A+EnVs+mg1SoBaJYKO36PvXKuhHY9zcWeseqn:qyXe0vGWou5+A2bkBdBaJYKOqP9h49zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957122, "uuid": "0943176b-746b-4b61-9af7-f58e9038c5e1", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957122, "uuid": "71998015-5eb2-4a0f-b306-7e95cf5a0b0f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957122, "uuid": "993cd5cd-6362-4284-bdfe-0c080537535c", "value": "DOC-85294690.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d9cd5d-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957127, "uuid": "08cb85cb-4acf-4a22-abb9-c2953bb7b0e9", "comment": "Malware payload (Formbook)", "value": "745174884165278ca284212180544a17", "object_relation": "md5", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957127, "uuid": "e7b70593-ed81-4380-83b2-98576d9490a0", "comment": "Malware payload (Formbook)", "value": "2e43e75303476b0eff6585680ad006cc7a7506a4564aa49504512ee3b6621884", "object_relation": "sha256", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957127, "uuid": "ab6d3513-f331-484d-8635-479080640b56", "comment": "Malware payload (Formbook)", "value": "920d5344b51f4f97cd92230e85c339c2237aaf1f", "object_relation": "sha1", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957127, "uuid": "5875cbce-fd28-4416-a11d-36324c7efe53", "comment": "Malware payload (Formbook)", "value": "15f166b667951ea210bcd77212ec57484ac772d37d5d0b048d570f523fdf3bc8e75d4bc507b2de95a39a0e40871064e1", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-254-18", "colour": "#359CA1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957127, "uuid": "f2b9b953-725d-4106-a53e-d60dd762db1e", "value": "T155D402A823E4A57FF0BB37B1BD30044105B2BBBA79A0C6EE59C520DED577B410A61277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957127, "uuid": "f46430c6-9310-401b-b21f-8a6595d425e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957127, "uuid": "93299f64-1ea3-4aff-8dcf-6484d0f77025", "value": "12288:mg7JYihlZ/dMkbGo4suHNmS3cgexJAY7ytxcFmRCkn8RWpaxOXskry:mg7CClxek9huHNi1JAY72xr4kqW8xOXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957127, "uuid": "092d47c7-c50a-41d0-8b85-37e353828c90", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957127, "uuid": "b2d4b27b-d2e4-4f9d-ba3c-b8cb76a95b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957127, "uuid": "f50cb622-790a-4aed-990d-275c088c86c9", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8060d4-3135-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690981684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981684, "uuid": "6ccd2f24-6621-453a-96b2-a0ba62318332", "comment": "Malware payload (AgentTesla)", "value": "99c8b8c9c4b1e113156d2e708766d658", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981684, "uuid": "b186d54f-952f-4af6-94fe-192e6bc89f8d", "comment": "Malware payload (AgentTesla)", "value": "2e4548a3744c45b01a65b8523d08f044ecf9e1cba90f3e792d3894d5c72dbabe", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981684, "uuid": "5cfe8297-9182-48db-bd95-4cd981c72db4", "comment": "Malware payload (AgentTesla)", "value": "8f2779e55101da7526d0d5c03e09259a4590daa0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981684, "uuid": "8174282e-877b-4b6b-8763-9d257bd4dcbc", "comment": "Malware payload (AgentTesla)", "value": "868761f7c5d9ac9fb1db76a4da4dac384ec6b20cf9a0465dbe57d7956fa5bdc05872ae3ff7b4c6ca76af8fe272786acb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981684, "uuid": "b48790da-df3d-496f-b07f-f042e460e3ee", "value": "T198C423007FAD46E7D5C8797649280B24AD35CA7A85724B04A6C3C8BD8F2725FC3B65B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981684, "uuid": "02428050-dd25-4f66-826d-cd153dd733e9", "value": "12288:ar9CCc9GCxB06hb8HzfbgfLfB9H0WkowjXz6rXKUI9XFSr4zBwWnlDm7PHg:yyG8Gw4zTgzfB90ownioSstpg/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690981684, "uuid": "279b4ef1-6688-447b-bfd2-e57b591f0874", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690981684, "uuid": "50a417d8-2f51-4cf2-bc0a-5a9c836febb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981684, "uuid": "e5a648cf-0b29-4d50-9e9f-89c2feaa50f4", "value": "99c8b8c9c4b1e113156d2e708766d658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c92b4c-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690963422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963422, "uuid": "b87112d7-34a3-4e3d-bd49-6e635325f71a", "comment": "Malware payload", "value": "1bdfa5d4db8f961fb85677c4d8bb64f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963422, "uuid": "2c87f7e0-5e9e-4e19-9415-066b6933254c", "comment": "Malware payload", "value": "2e54ec22a0d7931509bb5905acf51ac1f223d5bca7a46b9f9038291d7c80c6c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963422, "uuid": "db8b10bf-ce23-4421-923e-4cebac58e639", "comment": "Malware payload", "value": "3113a433ed20e84bbf7e0febd3cf78c0b443ae5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963422, "uuid": "9865be3b-9900-4a94-808f-f62c53ea8db5", "comment": "Malware payload", "value": "a9d8b85d29183bbb4f01055fdd629a0831e3caf521704a8bde93d3bf01c377464250e4978b933458de235ee8c8b8c25a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963422, "uuid": "8d2cd481-8b76-40cf-8d43-3497f7e5e2d1", "value": "T1157422C8CCC887A4D3F86DF14A97F5F77164CFAA39162026F85CB56FA4F287AA146014", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963422, "uuid": "922d52bb-77ad-444c-9030-8206ad5128c9", "value": "604d14eda74ecb05dc3fd3f2233fd004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963422, "uuid": "b4fa7526-5a1f-4672-a21f-bca19e797e62", "value": "6144:ndkzF43SM5dCsenQjq2Zs4ogcAWUwxPk47oLFldV1jJrBBxRdE3ajPXoSI84KF:n6zF4vCT4q2Z7NBWrl7EzdH9BL5PXoSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963422, "uuid": "4b9573c5-8337-404d-ae1d-0d6ff3cc9b2f", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963422, "uuid": "a7ba6c47-efdb-4eb8-8e36-76253ef6761d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963422, "uuid": "3ece1c38-ddfe-4df5-bdc6-904e53263b05", "value": "1bdfa5d4db8f961fb85677c4d8bb64f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4339e5-314e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690992283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992283, "uuid": "a715a032-408f-4c4c-81a6-5ecd3e25153a", "comment": "Malware payload (Formbook)", "value": "9fa1936a54b38a2f6b45e46a397a3c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992283, "uuid": "d5a895a0-457a-464b-bc81-ad89cb190a72", "comment": "Malware payload (Formbook)", "value": "2e6817886ae8c6bfaf55499d950bb963b5c176dd5adb5a9dfb8cde49d5bf394d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992283, "uuid": "540ff99a-0efe-4e45-bbb2-e7c13fdd7c93", "comment": "Malware payload (Formbook)", "value": "49dc2e15979f0af2f6d2cb195ef69f0290dcb935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992283, "uuid": "a5f16a94-86d8-4f93-b6d4-363e3ca98f9a", "comment": "Malware payload (Formbook)", "value": "839d7cb11fc9fd879a5760ba1f14a59f61f880e286387ce76a3bf1898b87dd4d603f0d3ae6ec466b415a39808b8fb6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992283, "uuid": "3cfea6b1-1523-4b47-844a-d375ef08ef6a", "value": "T1E1C42325912856F5D65D87FA3892814503730A1E6432EBD6DFE318EE7FD2B301A12BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992283, "uuid": "58d78e52-3586-425c-9e75-167a9b412e7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992283, "uuid": "6e58e746-7f4a-40fc-b966-53bc3e3d758b", "value": "12288:iK2iN8JJ1v+UYtBy2qUdrsYeKOODp72louEwNqylhdK+:iK1uJDIBHdrWQ9Dmqylh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690992283, "uuid": "f3be156f-5e9f-4b71-83ac-d1543ac074f8", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690992283, "uuid": "bcb2439b-b230-4d61-aa7e-e00d7fbf2f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992283, "uuid": "2c5def60-6c39-4fd4-9ae4-97bb4a01a99b", "value": "z8PEDIDODECOMPRAURGENTEpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5d4f48-3179-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691010941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691010941, "uuid": "4a6c40ce-e58d-4132-93ad-93243e146d13", "comment": "Malware payload", "value": "9b4261ee168a262ff5e19be07127715e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691010941, "uuid": "3adf96ce-7224-403c-8983-1c7a283abc5c", "comment": "Malware payload", "value": "2e71fca87c23efa79ccd1fcf975e6bf1e8ef54e11bcd7da652a8b5be229bb7f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691010941, "uuid": "465f789e-551c-4e15-9e8a-438086d33448", "comment": "Malware payload", "value": "93bdee7c0bfeec64ec60f24dfde1a6307bb7c35c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691010941, "uuid": "73d6d5bb-8d5b-4378-95c4-773a81aaa34a", "comment": "Malware payload", "value": "c25fae6124c02d83d03de4f9d1094a879638cc650de75379e70109faebd35cde36167ee2ea59b9e060f3b0beb37aa1f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691010941, "uuid": "59c3f5e1-73b0-41de-8929-19a80ebb1edb", "value": "T182F633019F699D7A4AA8833C60BF1F2D1BE19FC19018E1DB4BD464CF169EB85491BC2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691010941, "uuid": "d2a34dce-87c0-456a-bd8c-497a4da6c6f5", "value": "49152:4x1swXYG1njnuXhYywmYjs5agWhpB7QaXlIQBv2cU5uEx+Te+nATMlj5JRu/W+DQ:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691010941, "uuid": "de2731c3-bcc0-4718-a737-9bd4b443c587", "value": 16107901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691010941, "uuid": "3b91b06b-460b-4457-b0cc-fb51056499a3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691010941, "uuid": "b47dda92-7842-4a87-aba7-9f14c253dee8", "value": "Microsoft Teams_SC.ba#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c232731-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966139, "uuid": "9af2e989-9562-43cc-85ec-42308158035a", "comment": "Malware payload", "value": "47a6c467f51f09a24dd2cbeead7218da", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966139, "uuid": "8d7e2b99-14a3-404e-bcef-eeb93f80cc10", "comment": "Malware payload", "value": "2eff70f5d03e1c43ea2c0d15d23a1a020bb5d0975e4b6656afc6b992033d4367", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966139, "uuid": "a06d74f5-1925-40e6-bc8e-21b5e2781a71", "comment": "Malware payload", "value": "b3c02f02e767ef629c55e1a1f81b9995f9ad149c", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966139, "uuid": "6d925da7-56db-4fb1-811d-609775bbbd73", "comment": "Malware payload", "value": "c892530df6377c663403032fd0ef582981e4c97f3cfc41c1ea2325b8ad8dde092cfa272ea17c4cc0ee32abe3ee1b09c9", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966139, "uuid": "537ea3d7-b001-4c97-90bf-3b2f1fb3c497", "value": "T13BB4F100324CEDA9E68A07F97AB6B58E900CBD7375C562C36B88B30B8876FBF5517511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966139, "uuid": "7d46202b-d4d5-45d5-b100-683923c6338f", "value": "12288:IDQ7tWQmmme6v3QLQuE7WQmmme6v3QLQuEgYU358zDHn:5WQmmav30xSWQmmav30xj35sDHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966139, "uuid": "61a55747-5b16-4bff-ac37-2d8bde0e6c6c", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966139, "uuid": "64f99d2c-be27-41a9-b657-b40f8144dcfd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966139, "uuid": "3dfbecab-6e85-4bdc-a4fc-6946d0109467", "value": "PLE - INQUIRY.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d83379-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690998668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998668, "uuid": "4118c43e-02a2-4525-b084-911a36ce1bc5", "comment": "Malware payload (Fabookie)", "value": "b9b4d9a3664e7dc937f220d2d293dd48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998668, "uuid": "f47a98a1-2d61-4f19-8166-deee6ef8b77e", "comment": "Malware payload (Fabookie)", "value": "2f43530c4997efcd600d9f32c3841ad818f7426b4446bd037b93022e8b556dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998668, "uuid": "754324ff-d5e2-421d-aa6a-e23b4d9a49db", "comment": "Malware payload (Fabookie)", "value": "1c3194db8b1176a96348d308354891d6b2f6bc98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998668, "uuid": "e9602bc3-6d27-404c-aa6c-758f84305afc", "comment": "Malware payload (Fabookie)", "value": "625a81b51bbb2f72396912f697a87a4dc4588cded967374daf5509d410fd4fc21b5b1570b10aa4cdf92f00bf10080122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998668, "uuid": "2e82156b-f856-46d1-bd2f-c4bae6cf5fed", "value": "T18815AD4377548885E04D45348DABCBB9E6B17C207B2C43A773B2BB4F6E32AD16512F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998668, "uuid": "0b1513e6-b0cb-42b6-8e68-b38fe9764b24", "value": "de5ffdef0b7fe6105bfe44941d62fcd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998668, "uuid": "acc9b391-3de2-4dfc-a2e1-dcf250d4d21d", "value": "12288:K72Y4b/l0Dp6E3d51qvii3mmm6AV5Cqylkg5ZQnXlV5Za5Za5Zj:GcyPd5kRhAVdcpmt44F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998668, "uuid": "1fb595a6-4c12-43fc-a331-845f2d559750", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998668, "uuid": "481bd53b-3923-45d7-835e-be4bcd691d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998668, "uuid": "07fb34b5-09b7-46ee-857f-0903721aa520", "value": "b9b4d9a3664e7dc937f220d2d293dd48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd41e78-3128-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690975963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975963, "uuid": "aa549fc0-1305-4230-9e71-91628677904a", "comment": "Malware payload (AgentTesla)", "value": "809e678154131e24dc8ed0e05fe367a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975963, "uuid": "2670a07f-69b0-446d-9c33-de8413940e1b", "comment": "Malware payload (AgentTesla)", "value": "2fed75fb1b7aebeb5399686b962604e4db24a8f2a0ab33e2c2f3d4d98711a44e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975963, "uuid": "2fda995e-350b-4e0d-9405-8485cf757a57", "comment": "Malware payload (AgentTesla)", "value": "86d4b0f603a869ae6980957dfa4c8720126851c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975963, "uuid": "adeb3068-b150-4160-b14a-8ae043c2313d", "comment": "Malware payload (AgentTesla)", "value": "f901011b04dc8d1cc81216b09cf3e0e8de4fad0d06802c83709ba20fedda4430086b96eae039282c576881940c9e25e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975963, "uuid": "9ed0dda0-b807-4d17-91c1-5769ce94ed34", "value": "T197D40255A7E0917FF47BB372AC70518206B27DBE31A1C7EF598170DEE066B010AA16B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975963, "uuid": "2637bf00-6555-4aa4-b048-7022fdd6f871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975963, "uuid": "eaf33186-707b-43af-a6c7-2353c0d9d48c", "value": "12288:ug7JzQOXWGnfFrpWdsppJg9uGTmGaxiK8UDV1OqXGYL0Q0GPVrWL6lk:ug7+gWGnNrpWdKfg9uGTmGDK8A/XGuPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690975963, "uuid": "0e0638ea-f196-4681-8046-58276e85dcd5", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690975963, "uuid": "28f44998-ac07-496f-8298-4fae5f080941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975963, "uuid": "fec77fae-42a6-477d-a683-e1864923a5aa", "value": "809e678154131e24dc8ed0e05fe367a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ac43e4-3156-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690995817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995817, "uuid": "1615e33f-e945-43fb-a2c3-afd58e677e7e", "comment": "Malware payload", "value": "7294cbe7d4960cccedfa593f3d87f0c5", "object_relation": "md5", "Tag": [ { "name": "comfoo\\", "colour": "#EB612F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995817, "uuid": "4055c266-bf7b-48db-ae8e-115b16ab715d", "comment": "Malware payload", "value": "31556578da34ee215d3f6979060a96d5e6f4fb354624a74b951788ffd640692e", "object_relation": "sha256", "Tag": [ { "name": "comfoo\\", "colour": "#EB612F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995817, "uuid": "ee9be7b7-7de8-495a-9861-50dea56911fd", "comment": "Malware payload", "value": "0b5222b199eb9b0be083807fccb0880e4116b47c", "object_relation": "sha1", "Tag": [ { "name": "comfoo\\", "colour": "#EB612F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995817, "uuid": "cdebd4eb-ed92-4c2f-8d82-4eb02227f642", "comment": "Malware payload", "value": "ed7ba591f70183649f9d68b8cf4d45c3fbd881207e83ad1f41a383e0ad2b64e3fe35ddde3a562d77175b9fd439c2ebec", "object_relation": "sha3-384", "Tag": [ { "name": "comfoo\\", "colour": "#EB612F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TABCTENG", "colour": "#4D686A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995817, "uuid": "f88799a9-f4de-41e5-a25a-f95fe3207fd8", "value": "T1B9523B93DEB607F5D5B0023024B92B7A5636BAD42D3DE6B33B40CE24087F341A525B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995817, "uuid": "2de9b929-3bd8-4592-a3e8-f9eddca6f19f", "value": "886253b3437bfb96cfdab167c97d5ad9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995817, "uuid": "66612d29-fde4-4ac4-aa09-61648b0500ab", "value": "192:9fw8RKMkd7/USWF5DSD8PX1/4XcbMcRORbHjCBBkNEfb0fcKpJ8tb9fNMgYautpk:4MIAFMcQyB+fgbnMnvpvi+1st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690995817, "uuid": "62241116-9113-4ca9-a589-9306efdbf830", "value": 14360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690995817, "uuid": "bf7d0742-84d1-4b55-8333-46fbddd29484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995817, "uuid": "0bb96194-0e11-400f-bfc2-ed0eb7bfd5d7", "value": "comfoo2.malz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b5d9d2-3100-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958989, "uuid": "a1632c5f-f0e1-4017-8010-70597853023e", "comment": "Malware payload (AgentTesla)", "value": "90c3ef12b4f7d2850fada7144499b9eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958989, "uuid": "6223bd22-3591-4cc8-9c7b-6450deccf09c", "comment": "Malware payload (AgentTesla)", "value": "318dc447444eae0a0b26dbf5f28ca77c50722aec7139822f728de92f0506dec9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958989, "uuid": "51954ab3-26e6-48f6-9273-1130090d7acb", "comment": "Malware payload (AgentTesla)", "value": "210d28411fad65fef2deeaf3f1d8ca1ed3313fd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958989, "uuid": "e5e092b0-1924-446f-bfaa-b7f6e1187a6b", "comment": "Malware payload (AgentTesla)", "value": "e9271f30a104d494098e47f1b438400dc0cba4efe9d1a77adc20612f386ff88bf39511f6c80df859f286e26fc562ccc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958989, "uuid": "8a51bca0-0536-4a62-acb5-a4da622c5f53", "value": "T1CF451244B2BA9518F9C72E73832D52019CD9DDB7609CAA02FB9ECD36DF450B0499AF70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958989, "uuid": "80346e7a-d0ec-4f63-a14f-20c2f19a681c", "value": "12288:bpiRSej8BonVvRyaPuzrfMChwVEv44jZVMri5OVp9fw0z41MUNhHHKm7PH:bpiR3wyVv4aW8yyE53OVLwugMEHKg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958989, "uuid": "033f06da-7610-4d6b-b9a3-367275222ca4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958989, "uuid": "29cc0cdc-639a-4a18-acda-9c7ab24ed640", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958989, "uuid": "9c684714-74c1-458a-842a-1f9e858d52b1", "value": "SOA.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1a54de-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690964179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964179, "uuid": "b95527e1-12af-484e-b267-64b5a565c7d8", "comment": "Malware payload", "value": "63c33b9d07ff4983194bedf7786cd23b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964179, "uuid": "fca24384-a0fa-43ba-bf0a-99335c2f46d5", "comment": "Malware payload", "value": "31b68e4822d688e5c10083d27167add9da531f4ae838498d0e5ff6bd30e796b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964179, "uuid": "2d897b6a-8eb2-471a-8c9e-2139e02a9740", "comment": "Malware payload", "value": "dedb3585bafe05718e25c064612b4173b74af317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964179, "uuid": "87baa89a-461d-4b23-ad34-fa6c2ed1f8dc", "comment": "Malware payload", "value": "9d2820e9de6c31690bf21d5b14379c909dc69c8cfbfbdf734f67e95688801d70c69db35033c6df1afa49113b94090103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964179, "uuid": "0454a2e1-f73f-4b41-947f-650bd46cb5e7", "value": "T184459E3178C58172EEE730BA46ECFA3682ADE4B0471915DB07D85BEED7606C16F32582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964179, "uuid": "e8272551-9e41-49f0-9670-d6869a2ea103", "value": "e36b2dfa63d47a142f46b2643f4cab93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964179, "uuid": "49acbad1-184d-4a75-846a-3ec58a249a91", "value": "12288:fwiWirGTk3Wv5OJrnVh6f9WHtRGzQMF4TMvrsjtrwgul3VRv6WU4l:fwTk3WvQJrnVh6Z4wjXNF6WU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964179, "uuid": "3ea80d5c-daac-4524-9a44-9c23da100be1", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964179, "uuid": "8a723e07-1210-4edd-87eb-979f58fb71ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964179, "uuid": "d0c74bd9-0a4d-46aa-8bf9-950dc907e71f", "value": "63c33b9d07ff4983194bedf7786cd23b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2882d9-314d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690992123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992123, "uuid": "cd498d0c-3f26-4175-aa5e-45aca7cb11a0", "comment": "Malware payload", "value": "de8169e2707963743591529483506b85", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992123, "uuid": "cc4f92e2-441b-4b25-bddd-c0d844808f3a", "comment": "Malware payload", "value": "327a1ad6228adca42a92cf0c054df5ab68cebb0794c3e8a34d6cdeb7751cf5ff", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992123, "uuid": "fbb47761-3912-4655-a9bb-ad5d0fa3d784", "comment": "Malware payload", "value": "dca874742694fb3c125c60cf9da0f9a06ad0952c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992123, "uuid": "82361ce5-5697-4bfc-abe3-6bac8460c93b", "comment": "Malware payload", "value": "6826fefaab190a57c328dfa400777cac6ee682c8216fb3cb622300c174d225cbd013d433de982715d1e2c48e5d3b3d9e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992123, "uuid": "a7e39909-f93e-4a96-a97d-6b9a84e60b67", "value": "T14B16334AF5C6D739DDAF0272A68F53218325FD349E524017225A6A5F3EF24A423B33D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992123, "uuid": "8b71477a-49d3-4b21-abab-4e13e0568334", "value": "98304:YY5AJHnvXw3IdEDhquv4KUlbhwtPWTQ2cw/n255NXH:oHfwBFjwp6pf2cW65NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690992123, "uuid": "7cc7152c-9d5d-4247-ad11-f82f11ee798b", "value": 4214784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690992123, "uuid": "01d535c1-6a60-4c9f-8d0d-3d2cf991a4e4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992123, "uuid": "4b5ba99a-4828-4ef1-bf37-9c1565f9f338", "value": "z1Intimacao-eletronica.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4595081d-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966074, "uuid": "653601a3-c037-4909-8366-04299da25017", "comment": "Malware payload", "value": "8fd497870926cbca338475287214572e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966074, "uuid": "2cd6dad7-5f91-4aeb-9504-763d4dbcc675", "comment": "Malware payload", "value": "32e1eebf2af8d36857b3a9ea3a2653e8e7ad6b6eab8ca4665b252b5fb609d993", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966074, "uuid": "9b2072c8-71f7-43dc-8a53-75c2682e1327", "comment": "Malware payload", "value": "2626e891b55d0132eda86841ab648e47dd0d6bae", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966074, "uuid": "46c5c783-bdd4-416e-8ac6-a2e7ac7dc8b1", "comment": "Malware payload", "value": "f5d499461b0987d0085dc6e8e216097306528fa969d17a1a90d53fe6b998f2dca7e78b72ebe47934bb126af219e34922", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966074, "uuid": "267552b3-5fad-42c3-b590-ed9c89f2528c", "value": "T1DB31280C0BDA0715C2F2CE3698BEA311A8657C42ED938F5D01D056C43816311F871D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966074, "uuid": "cb184f72-b8ee-4e00-80f5-02c70c6db040", "value": "12:8f0m/3BVSXzZUBW+fvji4vPywMY+L1vP3iN37+lbYM36:8fJ/ByUA+fv+4v6wkL1vurabb36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966074, "uuid": "ce2d135a-bbcc-4611-bc75-d7e98cdf9ca5", "value": 1546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966074, "uuid": "f6197faf-0004-4ac0-a231-fe2373e2c30c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966074, "uuid": "994fb084-e258-4e96-829b-9c97428cf179", "value": "Information.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e9cc2c-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690957250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957250, "uuid": "5fa3e43f-0ead-49c0-941e-64f43143a06d", "comment": "Malware payload (SnakeKeylogger)", "value": "08a2328781ea1a31a981c4474c0d097d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957250, "uuid": "6a1adf24-f104-42aa-beed-785da6001317", "comment": "Malware payload (SnakeKeylogger)", "value": "3331e4358de7df247634699487afe492edf9af859cd588304ce9f0c6cb542cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957250, "uuid": "5a2328c8-caab-4ea8-89de-d94733a6bc32", "comment": "Malware payload (SnakeKeylogger)", "value": "2eb7fbf701e8739c80ff27134a67eb6fee6bf4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957250, "uuid": "71cd33b9-fd80-424e-a5fc-772f34bf678f", "comment": "Malware payload (SnakeKeylogger)", "value": "09bd2cbeba753ef8ab96a1efe124ea99d689cfec49088fbb39853381cd30c9c0c6b2bd7f7b4f27f5e8612ac2d72b286a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957250, "uuid": "46ab9913-fe15-4b53-8745-130d06e5ac49", "value": "T151D4CF05B269ABA3F43E8BF49514418007F557BE706EE78A8DE2A0EA1B61F540F40F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957250, "uuid": "50f8eee1-c8bf-43c9-9149-5a5435f24d3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957250, "uuid": "603e0f02-3e69-4ddc-a769-d7a9a5c42208", "value": "12288:S5MY96e21JbOD5fzTmzqLLb7p8tRLPT9pDF/U:S66v2LbOlfzqGP7YLPT9pDFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957250, "uuid": "676a5206-103b-472d-b8c9-ab816c242ca1", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957250, "uuid": "18d7a462-060e-4c6c-90dd-abe23334d594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957250, "uuid": "dec84710-5139-4e4d-999f-97bc6ec2d800", "value": "Siparis 02.08.023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e50e70a-3150-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Blackmoon)", "timestamp": 1690993040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993040, "uuid": "63d9db37-8b6b-4b0b-a170-4a9f45162780", "comment": "Malware payload (Blackmoon)", "value": "71ebcd544120ce467d5893ea2ca547d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993040, "uuid": "b10c6c9c-3e76-4078-8d42-d4e2458ac2fb", "comment": "Malware payload (Blackmoon)", "value": "334e79c968449a9ef5bb99de5379b43650f9da703eebe72c9e797d487b3d6dbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993040, "uuid": "95729b6c-ed66-4786-91ee-13a4668eed70", "comment": "Malware payload (Blackmoon)", "value": "dffbec23ca5e2fb78310fb27661177f8034e5b15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993040, "uuid": "d247ef9c-bd7a-47b2-9e27-2f07074b1a5a", "comment": "Malware payload (Blackmoon)", "value": "6110263d051d8f6525c46384c82bf45364e2e1b757139036d55540c3abf854872bb6f02c757cf074381e345cbc5a624d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993040, "uuid": "6d414fa6-348f-4d92-b52a-813272f34d52", "value": "T14FE3123A64305E00D1AB98F89DD36D4A787FD1892C4B4F496A983E4FCDB8FD286432D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993040, "uuid": "de33dbff-d5a4-44f2-94b0-61c7a97812dd", "value": "248e89c3d007aa7c77b145cb40f90dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993040, "uuid": "6a0d60d7-78b8-4c39-8638-3525bbcd5335", "value": "3072:ref9rpDNfhU6n+ENWrfkaPTMW4k4TwnOSVyMxmHqqyoQAi4:izJhT+ENEfkETMeOwOSUMxmQo64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690993040, "uuid": "e87339cc-456a-4b7b-bb98-656440125340", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690993040, "uuid": "053b4328-2547-43d6-8648-3a02c8d78de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993040, "uuid": "453451f0-d299-447c-912a-de97470ca98b", "value": "71ebcd544120ce467d5893ea2ca547d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2846245d-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690967313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967313, "uuid": "ae792c2b-5c3a-4993-9612-a9f3f8c06d07", "comment": "Malware payload (Stealc)", "value": "8bbd52465d743855b7194d0de0795392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967313, "uuid": "ace14ed4-9205-4368-9c3d-65fc58b785ce", "comment": "Malware payload (Stealc)", "value": "3357368c0de34a4cef5c6d90e92b5876586f302f7b9255c00d7009e64c51dc87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967313, "uuid": "89e386f6-d599-4fde-b3ba-195d11dc25e3", "comment": "Malware payload (Stealc)", "value": "28917a114061b758fc188e3cdf4b52a7d44cd0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967313, "uuid": "cdfb5242-3be9-43b1-be7c-51a2f54fa051", "comment": "Malware payload (Stealc)", "value": "583fe4781f79159bdb5b55be0aca3aca40816ef152e17b37b5836451a0ec15242866e24863263d472470674dfa76ad91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967313, "uuid": "d747e802-2b4f-4d47-bb4a-61e2a92ab51d", "value": "T131548E0262A4E421E5274A324D2BC5E47B1EFC939F6467F722543E2FB9B13E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967313, "uuid": "a6c2112a-99ad-4696-8cd7-cf9dcc1bc1e7", "value": "94188224113cec6f774a38879ab75dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967313, "uuid": "bb509dd5-2598-40f0-a328-569a8c872c1c", "value": "3072:RRFz7kt1bA5f0KfaHbxvwyYZKaEhqsoYAgKLkdscoIJjkK:vFXG1bksqmpw2TqTYlKLLco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967313, "uuid": "e46aefc7-a9c8-4291-9ff1-b70a7519a5bd", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967313, "uuid": "d08c8b75-8f25-455b-a971-5ec3f8b2e6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967313, "uuid": "21acaa63-a4a1-4d30-b2d9-c95e81abfe15", "value": "8bbd52465d743855b7194d0de0795392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d717aab4-3149-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690990370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990370, "uuid": "b5497fa5-2fc5-4071-bbaa-504e9bd93c1d", "comment": "Malware payload (SnakeKeylogger)", "value": "a3a0f7c65d064edfcb7e72361aacc6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990370, "uuid": "7043b640-122b-46a2-877a-7ab4a140e98c", "comment": "Malware payload (SnakeKeylogger)", "value": "3399fc936d74594ca467f3e0224eba655e854ea064f0c11f311ce6c72f3dc009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990370, "uuid": "0b2ab660-bd7d-4025-9991-cddc7cd83fd1", "comment": "Malware payload (SnakeKeylogger)", "value": "ce1635ae1b2e9efb91030ed135069513d226c262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990370, "uuid": "a239d8bf-902d-438e-9d61-d4005d4a080c", "comment": "Malware payload (SnakeKeylogger)", "value": "6b5d9e4f6139e85e050d255502ac6c9654b8ccd4e9b3ad72472a45c4457447613df9abdd9783b006751045e76ab0e44e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990370, "uuid": "65792a02-c1be-4a4c-a6c1-92f5be8ca8da", "value": "T1CFC4E80432E16EB1FC6D63B568BA344403F068BB5872C35EDDC325DBA7A8B9605CD993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990370, "uuid": "2f9e517e-2abe-4c80-8e26-5383099e9bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990370, "uuid": "8952b260-1ee2-4ac6-9412-032e5aacb70b", "value": "6144:JEDeFkyh1E/65Q7nEbxFUPKpgr3UGwh1E/65Q7nEhe82wWMaYEYbxFUPKpgr3Ugs:WDeFSp0465c2Jc6Zeq91im6omxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690990370, "uuid": "534a3097-7eda-40a8-87e3-5b8ea326d9bc", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690990370, "uuid": "68543bfa-90dd-4f8c-b4dd-d48b57ec4b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990370, "uuid": "bdfbc213-51f9-4bda-84c0-0a11527c9037", "value": "34567898654345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e0b723-314b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690991145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991145, "uuid": "00945a15-24e5-4f1f-8e29-15a103dc1cac", "comment": "Malware payload", "value": "3315c5db742c60f16f85a14f81ad2f37", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991145, "uuid": "23aacb88-7bb2-4d0c-8bd8-8b87e11ebe11", "comment": "Malware payload", "value": "33d926d8284d38fe097eaab7867baa0fc5214a1eab517807efda4ceab45f0edd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991145, "uuid": "12f67420-68a8-45d8-84a8-ab40c9dde0e3", "comment": "Malware payload", "value": "1d32a5f4bb85f199801fddeb23114ee4da3814d5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991145, "uuid": "cd877078-d60b-4c6b-993c-f2a5a2c79184", "comment": "Malware payload", "value": "919489ee7a340ad3ff7f8976d23c19b6dc83cbec4b64a482a060b36675282c6b58380ac3781109f28292956e31650659", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991145, "uuid": "e59b5213-12c4-453b-815d-5a078132a881", "value": "T1B30412E412D1ABFEF2DE8577821B782FE175252362B0526ED374C22C8AFF58E1652143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991145, "uuid": "d09c8f20-3812-4875-b582-4660ba5bb5ac", "value": "3072:Eb7TzfMeFSONum4bxW9Sb8FPIQtfm6i4QXEwMmvzxcDxe8bbd4:e3jMeH8TAPxe6iX0wMmlcV74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690991145, "uuid": "2fe4ceab-a0b3-4e37-aa19-39c11f1209b2", "value": 179079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690991145, "uuid": "66f7489c-87a8-4105-994e-06b47b04b91c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991145, "uuid": "0653e48a-f110-4920-8d3d-6b049f6c8776", "value": "New_Order_Inquiry.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bd28f7-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998310, "uuid": "eb13a298-5e69-409a-9532-9d5305d2169b", "comment": "Malware payload", "value": "bd1034deed6e4e911d220770eed6fbe5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998310, "uuid": "9e4c5a92-6639-4b30-a400-d0c72ea08e8f", "comment": "Malware payload", "value": "341033562d0b516e03b824004e8f43a88bbb0a6a7b22a4b937cec3566c430a51", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998310, "uuid": "5d8e31f5-0314-405e-b6ef-895cc6f714ab", "comment": "Malware payload", "value": "a85be7fb82f4249c0736f873c7cca4b9a9613a39", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998310, "uuid": "c2d71eca-399a-4669-a82b-84408b63465c", "comment": "Malware payload", "value": "fe1fc836b26afdd465b8cc2c0106bea9bfaf1c26dc70b9260972a3535ff6f6cdb48db7b100c30063f3ef87e1b215f43c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998310, "uuid": "38604601-e27f-4295-b9f2-d8136556184c", "value": "T129D4239FEC350709E8426D3DC8E628187A0F6EA2E8396DC1D742E33E96FF4654461A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998310, "uuid": "be0e8110-0607-4d4f-a897-d1e8fcef1104", "value": "12288:iIQTweo72u7Kj6ainYBPmGd4oZmS+jATovF2jtAdHj36hzO:tqno72eKj8YBP5ZmS+sTovmWD0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998310, "uuid": "9503b533-823b-4b64-9ed8-7761c4ef2b57", "value": 635938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998310, "uuid": "ad36b1be-d915-4509-8352-44c45bba51ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998310, "uuid": "9114b18d-15d9-47b1-b663-cc3d84ea0949", "value": "Request for Quotation.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0145e3cb-3113-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690966819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966819, "uuid": "9665e6b5-e830-4bfd-9913-546f6ec7b08e", "comment": "Malware payload (GuLoader)", "value": "bd5b02844aa6410f0369e0b07fcffcb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966819, "uuid": "61cb291a-5528-4c1b-b0a4-64acd2317db5", "comment": "Malware payload (GuLoader)", "value": "363b7aaa875c65c3c134a3c2051a4bd8fa5a9a1376597609f95a43b219e56bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966819, "uuid": "50436082-f0d0-4aea-ac07-72346437b8d8", "comment": "Malware payload (GuLoader)", "value": "a87a1ba2cda550b43502a3afcb355f59e86a9ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966819, "uuid": "a7cd0566-ed8a-4f87-b3fa-7e838985b0b9", "comment": "Malware payload (GuLoader)", "value": "d1c21434762678fec09b50e14eae178cf9a22879dcb9a84412a69fc625dd26e6167c84cb5a978e4b6cb2c5134d671a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966819, "uuid": "dfcda062-5ec9-4af9-a47d-cc68e4c2975a", "value": "T1D9746B49E763ECE9FA660339257159263F819C5F60D9285D228DFB263C32213509BCFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966819, "uuid": "c084fc35-cbb6-4060-958d-0313b3adbeaa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966819, "uuid": "af68ec16-c2ed-4fa4-941b-5bee3fb86ff4", "value": "6144:NQ606x3uwBN3FrNRm9vtTpd0NZtQQnS0EKlsT6JIyy8T:nhBNM0pEMsT6By8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966819, "uuid": "4ce779dc-58a9-4027-9b41-336ad8527fc5", "value": 340429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966819, "uuid": "dcab06e1-b2c7-4efc-9fa6-083ee2b84c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966819, "uuid": "09a542d6-fd80-4acf-b80b-73869348cd57", "value": "ASCD23104 SPEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a115a1b-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690966619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966619, "uuid": "4cf8efb0-da7c-42e8-a6ff-1f8c71762956", "comment": "Malware payload (Formbook)", "value": "bdea29f090c2e2b8d29df152dab1649f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966619, "uuid": "ece6a005-0203-48d9-ba16-e7559e90f276", "comment": "Malware payload (Formbook)", "value": "367426620ba8ef291443c9bec1236ee3a3a36fdd8043d9f0052c83e989595716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966619, "uuid": "f121fa3a-6c2f-4b47-8914-654d3c546aab", "comment": "Malware payload (Formbook)", "value": "482b470745c8f93b22f5b15c04d43ca99503e3a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966619, "uuid": "292b9ccf-12e6-4c4b-a2ba-b658e2bc3b42", "comment": "Malware payload (Formbook)", "value": "4996820e446a3f96677c9abc30f09768d664d67f2546244bba517785addf70e589d6a36273739dae6505b26cecbacae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966619, "uuid": "3599d96c-e8cc-4662-b247-770c06f5d974", "value": "T1A4D4122503A8C3E4CB1D4BB2293A403703B65C8F92A5D5993B97BA9F2773BA14452F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966619, "uuid": "0d33d42f-ec39-4591-8222-78c117578ebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966619, "uuid": "449494fe-2522-4ca1-87d0-d95bb7abe61d", "value": "12288:sk2iN8JJRLsAk8mzNPrEJQBCtG/Pp6T47Djbr8gaqS8NQ40wbMX:sk1uJfsAk8YNfBCiA03ZbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966619, "uuid": "a6216cd3-bd96-41a3-aaff-b275b05a5e4e", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966619, "uuid": "31a35f56-530e-422e-a172-02c723c2b633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966619, "uuid": "1bf9429d-a618-426e-839c-7e20270a6be6", "value": "SAMSON A.\u015e.%30 AV.\u00d6D.DEKONTU.27000EURO.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be80979d-3110-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690965848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965848, "uuid": "6732b29e-cad9-4254-9862-9e7b4789d7c9", "comment": "Malware payload (RemcosRAT)", "value": "8aefdd630923829f049eff1bbb1aa807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965848, "uuid": "34df3b3f-1218-484e-b235-145b24af3d3c", "comment": "Malware payload (RemcosRAT)", "value": "36f8e4eb768b6f4bcb732179cfb4d8795452c285d565e4fc4998455de0006f51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965848, "uuid": "d3d5a87e-7383-4f4b-8e07-0a7968148221", "comment": "Malware payload (RemcosRAT)", "value": "d1fd7bfccbe9fec7bdaf032ffcb9899baacb7ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965848, "uuid": "4d50c1c6-a943-4fa1-8450-0fc0cb4fc55e", "comment": "Malware payload (RemcosRAT)", "value": "53d2c19bd5917607e6bb0bd9a8d8c045da636ab3686eb914929eae6b195a17188fe991a7067c1b9dc25375cf9fc33e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965848, "uuid": "df80b5a3-d007-412c-8652-d5856f39bdd5", "value": "T19325F13A2531CB88F14428310EEDD88FB6F5A57D53AA61FECCB903A344C53293959E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965848, "uuid": "9d3b1282-55f8-4d6d-9038-4982a7582265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965848, "uuid": "7e2451bb-6a02-45ea-8a87-58a3f08590ee", "value": "24576:Cw2qj4ss2NvJhmEjf42Dft3e4kcYF3TAGxZIHlYYRnLvh:AU4cNBO6fNe4EFDAGxZIFlhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965848, "uuid": "ee7d8b6b-16ee-44ee-9a8c-346df67b45ba", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965848, "uuid": "3125655c-6801-4a95-9108-9a8292724840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965848, "uuid": "573dcda8-f310-4211-b8d9-bd65abd81562", "value": "PO21019612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cac74d-3105-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690960847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960847, "uuid": "8bcc2055-f6d1-4ff1-86b9-97703fa6e227", "comment": "Malware payload", "value": "f74dc7d23182d2a9fb6ac97e5a6bc1be", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960847, "uuid": "9edb1914-0c5b-4339-8607-7b2385f86742", "comment": "Malware payload", "value": "371209388c24526ef491d039397f840b5f78d011ed2a0a0041353a70b38bb874", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960847, "uuid": "44445b00-66a6-4eac-a03d-45add06418d0", "comment": "Malware payload", "value": "13cbe5ea13db52b3e31c686a53dacb42c2368376", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960847, "uuid": "f0446a12-f201-4ce2-9336-8515ccd1209e", "comment": "Malware payload", "value": "5977cdfa84fd6c2c05b23beea9500efe59ca96e268035b892425193943e686964d59994e2c15ee390ffd1b114817b857", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960847, "uuid": "c07abc8a-da43-4105-a28a-cd5e8ecb4289", "value": "T12C35ED347979BC2043DBDA1334F14BA65CD9168FC5703A3B199AD423AA346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960847, "uuid": "11617bc6-8db5-40b9-a0a4-b10bb52946db", "value": "1536:6/NrOyciwGMO4fdqEiI8Cqihu7sFsICFhBsqRdIkHIm+lIWF/afY4XyFcygHbOM8:6/NrOyciw5O4FqEia7hu7sGHFhBdNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960847, "uuid": "da24cb1a-a8c4-41af-a145-c9b32768a950", "value": 1156006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960847, "uuid": "745bd42f-2abe-4543-9763-f9cca991ff2a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960847, "uuid": "8109b343-5a1d-4c63-b70f-beb641fab671", "value": "Loading.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95aecd0-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966778, "uuid": "3280d2ab-07df-48c2-8aa5-f786daa476b0", "comment": "Malware payload (AgentTesla)", "value": "2678f1fbf5e634acd6f296cc43951a34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966778, "uuid": "de7d4d39-78ea-4ecc-b308-028f266ad8d2", "comment": "Malware payload (AgentTesla)", "value": "3737b5c20d569b64fe8301b58da485fdd8b5e15ec27a6563aa8ba148296bc484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966778, "uuid": "3f550e09-5a2f-4443-b1c3-044b3a745033", "comment": "Malware payload (AgentTesla)", "value": "5b96e8b029c5bb43e484109a995dfa221b51f793", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966778, "uuid": "3a768ff4-c3c7-4fc0-a85e-ca7d2019d173", "comment": "Malware payload (AgentTesla)", "value": "892ee400910508e9b41ae7c86c58646740204b4156600295285d10241433958fb43afe108cd217794e2b14b5d44ef5eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966778, "uuid": "ff72ec23-909e-43ae-bfc2-05330cfe54eb", "value": "T17A45E0063348CF12D51F25B6C9A3C2F81327BF40DC419BD776C9FE5A39B22AA6A51493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966778, "uuid": "918d5f30-b03d-4a89-9483-5ee7c0f23fe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966778, "uuid": "130d9767-4734-4ef0-81d3-992a07e65edd", "value": "24576:VjAzuSnMflcSfa7C6yG0vJvSinwbwM3YqU1QzxV:VjOPMtcS0C6ytBvSiwbwM3Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966778, "uuid": "ad7f70b5-06cb-4c7c-8fd6-5390ff8bb7a5", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966778, "uuid": "bdf02306-ae62-49e7-ae03-76fcc55dc927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966778, "uuid": "6f4d49e6-8924-43d6-a236-efb35e26bad5", "value": "QUOTATION_JUL7FIBA00541PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169fe951-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690965995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965995, "uuid": "25fbb8db-b760-4fb6-bf81-54b8b172d904", "comment": "Malware payload (SnakeKeylogger)", "value": "b1553384deba6a98d1a0caa98468d0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965995, "uuid": "8e31427a-455c-468e-a825-63c40fa5adc5", "comment": "Malware payload (SnakeKeylogger)", "value": "37840987b437459b8f5774cfd36eb5a271c61808ccfa5e4aa63b005db127f71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965995, "uuid": "49adc4b3-294f-46ce-8fac-31b6a8c8ea96", "comment": "Malware payload (SnakeKeylogger)", "value": "f63e052ba7f25077d625f841241e2d2aa1ea7011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965995, "uuid": "cf44b1b9-4629-48b7-9d06-eb3e536120a4", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6cb8c0dca7c267d40c1cdb617da808bcbf26fafcfcbf8b6682d1d9457d5b679e17ad8a3a082e9d0f6cfd6cb14b212f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965995, "uuid": "437ab6d7-ef0c-4544-a577-866a80f5b963", "value": "T15D22F75177BCC227C636077388636742173AAB116CD2DF9FBC80691F6DA13808EA2A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965995, "uuid": "7f4eaf21-9dd9-44e1-944c-c05eb9a26f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965995, "uuid": "7e390574-12ea-4cf8-b144-0527c5160364", "value": "96:JG/woST6RfWsr/Kk+M1k4XpCiwe5KhBC14P3R8jleB/TA2ezNt:J6RfWsjv+M1k4XFw0Kva4P3Slc/R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965995, "uuid": "8d06b770-5aa7-4535-b0f8-e393a0e1206f", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965995, "uuid": "99ff5f76-8a35-4344-a94a-dc10427c1e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965995, "uuid": "fcd42858-bb87-4167-bdde-8b291b870e45", "value": "Hahza.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8293e7-3105-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690960987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960987, "uuid": "b6de41cf-f6e0-40cf-8b51-9402113841fc", "comment": "Malware payload (AgentTesla)", "value": "a8cd4eaa803c78d7d60de36ddea14cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960987, "uuid": "124a666b-923b-4667-8aae-f91eaac21a74", "comment": "Malware payload (AgentTesla)", "value": "3a04516d71e6a24f0f20da46230239ca177e6c1d76cb887948344694e2a376a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960987, "uuid": "9387138c-b901-40b2-ae3d-a2abd23b1aa6", "comment": "Malware payload (AgentTesla)", "value": "c5a605e276de95ece9098f8effd28d54aaf41edc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960987, "uuid": "42949e97-ec55-489e-8121-180a2e14b8b6", "comment": "Malware payload (AgentTesla)", "value": "3a6eb925b23ba23cfd3a56089ac66d7b7670ffeebd6cbbc026608bd92fc0d271bf0a89c95653819390d7dddb67e5b857", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960987, "uuid": "9cec367c-7acc-497d-a38a-d3e61e6661f6", "value": "T1E2E4124977E4823BF0BBB2B6EE3041854A737EB57AD5CAAE448431CED47B7001992367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960987, "uuid": "d5d22b0b-2d8c-4880-ac6c-bb7d353b800c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960987, "uuid": "8e904e49-a67c-4d12-879e-0a0b1ec664d6", "value": "12288:3g7JduIEEnU6ANYZZQkyVy55elgBrjwt1GyR07zjzMxsFleptgRCtQoHb9HBENmC:3g7yIEtpYLQq5omwtQoKz7F+iRCmoxwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960987, "uuid": "f2bcdf01-7032-41e4-a422-47073a76e3a0", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960987, "uuid": "37b309ac-10b3-4943-b4bb-7f35db271608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960987, "uuid": "bfe152b8-acdb-420b-b10d-f12d261dcd18", "value": "Shipment document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66204d9c-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690957968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957968, "uuid": "f6066c39-1b05-49d6-b4d1-279ced8168d1", "comment": "Malware payload", "value": "798dc26cf1eac4b0107b737a248704e7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957968, "uuid": "4b8e9040-4aac-4448-80d5-cf2c9b459380", "comment": "Malware payload", "value": "3bc3dd9c15fa1695ae8d1d78b483f6bb40c8230113c35cda9376a86e20e21e48", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957968, "uuid": "aaa3c926-2614-4ba9-b0ac-3bb76bd3cf98", "comment": "Malware payload", "value": "3b50c698712a678fc94c91fe360a554a2fca6f8f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957968, "uuid": "d6b5558a-2a74-4405-bde5-5889d1c7a93e", "comment": "Malware payload", "value": "fabb06dd52916ea86ab6d3e91833a37524fdb56287157c21c2d62b2740fcb7d06d072c93be2f2b4013740b2afccac23d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957968, "uuid": "f90093c4-6e1c-474b-9518-4b9d7c958ffc", "value": "T10C11A3054D8B873322B6C470D7152549F27FF20F3E5C84A5F16260915DA92898EFDDD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957968, "uuid": "3a1e469f-53f2-4ac1-9715-b89431c7464b", "value": "12:1vb6D9nihWOzpzHipHm1lqKoI8BbgAdfKLerEbm0yy5No9kj2rxvbHVC3s8cViuT:l6DUBzpzHOwhoI8BgAfJsyb20BHVCNuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957968, "uuid": "97f99dfb-6fe3-456d-a4c8-259b57627b7b", "value": 883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957968, "uuid": "702ce8d7-f843-4ce7-84d2-843431383795", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957968, "uuid": "dd61d947-41e6-4f99-a8e2-d4f385c89d5c", "value": "69946.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b408a35-3164-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691001678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001678, "uuid": "3e743c41-a39a-4758-bdf6-3bd5c6cd51ed", "comment": "Malware payload (GuLoader)", "value": "11918dee7fc7db0c4b2c9bee96e9f9d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001678, "uuid": "79f08a88-48be-4d04-9311-14c7fb17f6a3", "comment": "Malware payload (GuLoader)", "value": "3c609fde5e771ccb3cff10b9e5fcc216848d94f7065eaeda2075b12ed44d2be7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001678, "uuid": "9b2758b9-4389-4d2b-8a72-2b080204e046", "comment": "Malware payload (GuLoader)", "value": "119dedc1768e7971dc2aa621fd06787e9ba4e62a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001678, "uuid": "a64403ce-2b81-4b62-bbcc-ead27259a8e8", "comment": "Malware payload (GuLoader)", "value": "860e9d711336f0d9d48f0f39d0d1296a1ae88797b2312c3a3eefefdfb1c45d277b56263c67580b2bcde26ab8a32afb13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001678, "uuid": "5c844f97-78d3-4be4-91b3-dde04560f152", "value": "T11584CD26099B547FCC8177B0797FC25483EF7C91FE11B5F652482A2BA93D2EE1A460C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001678, "uuid": "a2ce60fa-ebf7-4b3c-ba25-9bed29e78a9f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001678, "uuid": "296ef8f0-709c-44aa-b300-585bbe51c4f0", "value": "6144:UBebKFxUGBNCRKSUmGRuVdToB8RT40E9hKVzpht/OiYbU+KLR/ElhKtFGCd:1KFxcRDGRudsBgSS1nIU+KSlgFld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691001678, "uuid": "59ced059-cc52-402e-a043-0dcd5ea6eefa", "value": 374208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691001678, "uuid": "cdefe757-6cc8-456e-8706-4744fc564aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001678, "uuid": "1b506b2f-03f6-4f24-b953-c723a4c5dcd5", "value": "11918dee7fc7db0c4b2c9bee96e9f9d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f72748-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690957718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957718, "uuid": "0cf47c77-6b06-4826-a242-6cca893287c6", "comment": "Malware payload (AgentTesla)", "value": "fe809b4f9027a85b91f32935c8462a6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957718, "uuid": "d4badb00-5b92-46ae-8b48-ce6ad89b791b", "comment": "Malware payload (AgentTesla)", "value": "3cfdf7ba4102e356819a52f06dfc23138def7b10b8338d6ac7e6ada986621b53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957718, "uuid": "922d2ac9-30ca-41a8-9bc9-d039c9b30a53", "comment": "Malware payload (AgentTesla)", "value": "0332116a7bd923f67696b8e0cd9d4ac1e8ecd0aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957718, "uuid": "4687820c-ed7b-4a5a-9b0b-783c5b4e1c77", "comment": "Malware payload (AgentTesla)", "value": "be1de703863e06eff5054b68d401314f4417318cc0104c88fd0b15c2367e4140fbd0271a41f1fb8758cb945e86034eb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957718, "uuid": "e7a19771-e9bb-4ece-8fd1-f3fe05961f1c", "value": "T12B327D6E9DA541BDC33B51BE41703429FBA8BB6EE624420E5970AB55E0E33BF5303315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957718, "uuid": "e664428e-1199-4d31-9754-e6eaf70df1d2", "value": "192:oya0NksVeWG4N5eNA2A+EnVs+mg1SoBRWJYgO36PvJKAXtY9pcWecGWL7P:oyXksVeWGu5+A2bkBdB4JYgOqP9X+9pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957718, "uuid": "671687e2-0e85-4c2a-ba8e-7dc24f5055f3", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957718, "uuid": "30af23c7-2932-4a1d-9908-1e9e4da88444", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957718, "uuid": "67a1a377-f076-413f-823e-32f839f636e1", "value": "remittance020823.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfa2120-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1690967296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967296, "uuid": "1dd63b46-9b05-4635-80ad-d7b9ef6f6fb9", "comment": "Malware payload (RustyStealer)", "value": "d5d506f616d8c1eecaf2f8daafe1e95c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967296, "uuid": "d8e0e286-bf69-4618-b296-8b55b566783f", "comment": "Malware payload (RustyStealer)", "value": "3e53b145657f33357a41f79761757404be0d8814f5c290633eced02eb60c105b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967296, "uuid": "e8ef44a5-d687-46a9-b97f-225ab18a1d31", "comment": "Malware payload (RustyStealer)", "value": "7dea2493c2b708e5581a763313001dc81402b3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967296, "uuid": "889efd4f-1cf0-4b7d-8800-aa590be4b6cb", "comment": "Malware payload (RustyStealer)", "value": "6f7ed00d93be3cb74b15d89c5a8ac37a0a64e28a2149d7e957c7fbf9aa7be1eed8eac2de8765c9f21717a8872525b9a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967296, "uuid": "2cf3b270-d03b-4dda-b989-f2ed80a4962d", "value": "T1D2645C12FB8624FDC49BC434834556522B667CCA1B35B6FF168452293EBA7F4AF3C248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967296, "uuid": "d35a656e-2027-4238-ae1d-dad1f28ea2c6", "value": "7cd0bbb42d4b316f99f5cabd76b4bcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967296, "uuid": "d9f90de9-fe69-49b6-9d8d-e54c7ea0c757", "value": "6144:Xcbwp64Ojt1blbSiXsitti/jOmaxutrgno:IwrO3lpsdirEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967296, "uuid": "d057e7d9-fb8b-498d-a25e-3bff43391450", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967296, "uuid": "0d7ca1b9-bf42-4bb8-90f8-028363dad82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967296, "uuid": "5de09c0c-c903-434e-8c97-9deea1aa026d", "value": "d5d506f616d8c1eecaf2f8daafe1e95c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a9aa08-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957567, "uuid": "6f692ce4-0817-45b6-aac3-b498a935f604", "comment": "Malware payload (Formbook)", "value": "0e98684678a1ba9f6714252d664c4846", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957567, "uuid": "a7122980-9f3b-4733-bd5c-f358dc3959c7", "comment": "Malware payload (Formbook)", "value": "3f3286ad4b2a5b24b81cb0fabba45deb7a1d5ac39165564f04b3d46d62d9e3b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957567, "uuid": "bc6d0ca8-786e-4912-a14e-b6806009ad5e", "comment": "Malware payload (Formbook)", "value": "8c6ebf93f79447d2acb7d2ce57f1e30cd68d074c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957567, "uuid": "bd39e25e-0362-48e0-aba1-7d896aff5b28", "comment": "Malware payload (Formbook)", "value": "45f539eddf997f729178dd5d4e511d798a005cce4466fe77cf81c1db7eeef86bf76422cd869a67dbf6cc557ea7b0c025", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957567, "uuid": "18e17164-d5eb-4a50-9cdb-20bf7aca0d20", "value": "T1753423805DC99F75E78C572CAC5421B3964B96A9ADE2C422E7079AA0CFC3C0367F1869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957567, "uuid": "0e10f313-bce2-4ad2-a823-dfb432d7e6ff", "value": "6144:Bq/jmGhzFr2QjYN8CknYUpbbdv7Y2s9r+S:QnhzFrdnnnY8nNEJJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957567, "uuid": "dcc2b046-80a2-47f8-8349-a74f3b931b3f", "value": 241988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957567, "uuid": "cb7acb1e-8210-4cf3-aab3-f7153f67542b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957567, "uuid": "35507aec-8f0f-49b0-8112-aacdb69c6487", "value": "swift103.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e5753d-30f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690953691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953691, "uuid": "0c1eb5f5-d602-4e98-9ac7-509eadae2468", "comment": "Malware payload (AgentTesla)", "value": "ed470d697622053cac541f1ccca3ae67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953691, "uuid": "1637e5d8-3905-4092-b31f-8a372f8a1f30", "comment": "Malware payload (AgentTesla)", "value": "40756cb5af00d5acb4938d6579432718053a54ecb682145a91bc1ebd94efc002", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953691, "uuid": "90dce0eb-db03-484d-9315-5b25a24e6397", "comment": "Malware payload (AgentTesla)", "value": "83cc4d4654352482e8d0f20302934d155bdf559c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953691, "uuid": "e06dd872-3874-490c-bf26-fca4d032fcc0", "comment": "Malware payload (AgentTesla)", "value": "28d6f1fce5a12743a5490c1830759f45520ab78bfd4c62f372d7585b035e6555d5c9dc61206debe4aba23d8e094de796", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953691, "uuid": "fca3a859-e76e-426d-831c-76d37483d812", "value": "T143E4330A2B4DCDE51B117BCA067C41FEFB36FC2AF85293B5EBA81911D9815EE17204E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953691, "uuid": "aa53b58f-be01-45e5-b88c-9d60a9293e24", "value": "12288:Qq22vBr8nMomzBgi7+4aHbEuHGzK1ahM5bh5YOx95birPQedb5j:hBr8OeiMHbEuZQunYOx9RCPQyb5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690953691, "uuid": "9919ac9a-45e1-4e73-97cb-3c0f4d374b91", "value": 669376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690953691, "uuid": "8788a50c-e23e-4e22-907c-1a3701560a17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953691, "uuid": "6ee2fcd9-e39f-4b7c-b6f4-b9220190a7b1", "value": "NO. USF23-24072 IGR23110.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090190dd-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963396, "uuid": "3185966f-ae10-40a5-a60b-5dc6cafacdcd", "comment": "Malware payload (AgentTesla)", "value": "4a42f9817aaaee146c4454259baf1333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963396, "uuid": "c62d5104-ee7f-47c2-a305-f859286e06c3", "comment": "Malware payload (AgentTesla)", "value": "40ea8804c950d48871a44d15ffca0abdfd33756864d6a83229c03fd9bfba3238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963396, "uuid": "ca6ee184-256f-4c45-888c-db64ebe19116", "comment": "Malware payload (AgentTesla)", "value": "bb3150fc57bb3be03c2181972cc41a25ca0bca02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963396, "uuid": "d901a343-5398-4ddb-9635-119d2d2fcf3a", "comment": "Malware payload (AgentTesla)", "value": "e6d708e31ca0b8708090750640b74a5ae6e52ee5d8a1f6fa65ed1e335b4484398ef52f212b4fab3305666347fc69ed3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963396, "uuid": "752fb1b6-98c3-42aa-8ffb-2e4a165d6ab7", "value": "T14AF4D014726CEBA7F43E87F55014818507F557BE70AEE78A4CE6A0EA1A64F500F80B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963396, "uuid": "d6ec2d04-99c4-44b7-92ad-4d68fa702e97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963396, "uuid": "6f54e72d-f299-4b97-9a53-7ebab13afae8", "value": "12288:b5MYPOh5TilBBzueDpDVaegi972G9V0aWY2o98duOim/m10:b6SFlLzutegi97CaWYx9Ahiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963396, "uuid": "97ada6a5-3bea-482d-a8c2-513801e6cb5d", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963396, "uuid": "514580d6-f0fb-441e-bec7-239c6d89564e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963396, "uuid": "27152043-2c35-45a6-b96e-f38c2c8cf557", "value": "4a42f9817aaaee146c4454259baf1333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df2cc76-3129-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690976423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976423, "uuid": "87c1fe78-7c86-4ff7-bb41-f07a7275cf59", "comment": "Malware payload (AgentTesla)", "value": "7c98917e747848e925c51aaabe8bb420", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976423, "uuid": "c08cc435-d4fe-4a7f-8352-fe85ffd32ab2", "comment": "Malware payload (AgentTesla)", "value": "40eb74064d46f594cd3d63268f447fec2ca0b420c3ef89a40a6d2cbb69a2d37a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976423, "uuid": "816152b5-50f6-4bdd-b0f8-d4c7ccbc41de", "comment": "Malware payload (AgentTesla)", "value": "2d3d8fffe418f1c746207e1c50187cb6fd40ebd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976423, "uuid": "2cb93b8a-8ded-491a-b6e2-48a674b67b68", "comment": "Malware payload (AgentTesla)", "value": "eb2d03dd5981b44dc82dbc15afd8e5cfb0bb9e61d5a59d80746030e42c2fbab764ea0b77fc8751191141e3593db47c29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976423, "uuid": "03fece8c-4e36-40f6-aa45-a987d0584386", "value": "T1A005E626417AA0B7DF157ABC5A13D87A35C86B40B1B6E188BB2F38C7C5C61121D3A7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976423, "uuid": "e5577ed4-6743-4332-98ae-fa8f3e0b4ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976423, "uuid": "af33497d-d4ca-4d49-ae9b-158b03c8e57a", "value": "24576:uiPpppNpppppoOQpppNpppppoO0uayAeUWEJyisgzsjrNZg5YIdZ:aO7O0AAe5y5iPg5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690976423, "uuid": "e0a20698-5e0b-46c3-bd6e-ee006c28429e", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690976423, "uuid": "08176c53-f57d-42a1-81cd-65f0962f911a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976423, "uuid": "81b6fffa-9653-4ea9-87fe-3ef08f9f7b56", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27884.16263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88166f5d-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966615, "uuid": "f1a22cb1-a4ac-4e0e-92b0-05c9b827781e", "comment": "Malware payload (AgentTesla)", "value": "e02ca3bc39b49652bfe34f5a937c3464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966615, "uuid": "1ee4610c-a03e-471f-adc2-14bb2fcf1217", "comment": "Malware payload (AgentTesla)", "value": "41cc436ff239f814a313cea6f211b9bd91e8aff835f5f3bf2ed0ccefbd324149", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966615, "uuid": "bea0f9e4-f320-4ad6-979a-5847162b37ff", "comment": "Malware payload (AgentTesla)", "value": "35906095a033cf3fde4713ee9bcf03bbc591024e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966615, "uuid": "52389d8b-66fa-44c3-91fc-17d90d92f0a1", "comment": "Malware payload (AgentTesla)", "value": "25a5310f88dcb402fd403c041c2fda5c2abb2269e9b3d4173e1c0c110409bd2c7a5cebb52348d26f8d1a610f1ffdde35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966615, "uuid": "e56ab410-b7c8-4c25-80e1-d615ced361e4", "value": "T1CD256ED1F150CC9AED6B09F1AD2A953024E3BE9D64B4810D5A9DBB1736B3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966615, "uuid": "5b9337a3-7726-445a-a877-3bffc8b6d1fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966615, "uuid": "dd6574be-aadc-4705-b0d0-2ba1f812c5f7", "value": "24576:B+u8KYmQ377Za9vMXxxcFsR3MX0vsWRoaSSf:B+u1Ymw77Zs4qFsQWRoaSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966615, "uuid": "7601742f-eef3-4ed8-905d-e25ef4e73496", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966615, "uuid": "11e5d891-5002-4df0-bf41-cb9ef10a0034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966615, "uuid": "6c107676-f279-4509-8080-574c452ea35f", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f36816-30ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958230, "uuid": "d911e8a3-9b2f-4cde-a23c-72c8ac4c6c0d", "comment": "Malware payload (AgentTesla)", "value": "abb0557a54fd5a6ecd611a231a631d2d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958230, "uuid": "ca632cca-2c41-49ff-b3bc-1c26d8776928", "comment": "Malware payload (AgentTesla)", "value": "4319a91c5dc310c2d97a808681e3c8b27b0f4d30ce21c7592d46c7b6e5d0dbed", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958230, "uuid": "f4cf91c9-ea74-4d8c-abe7-25cf16556e59", "comment": "Malware payload (AgentTesla)", "value": "b3b3d23f947b3230753923d635d4e66ab503433b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958230, "uuid": "914cc699-8b96-4479-b604-73c278da435f", "comment": "Malware payload (AgentTesla)", "value": "95caa2763d5cbc4e59a1a1e5488632e3ca9c49965224a2b6fc4b7cadd0c45010ec765cf2e20b00f7d1c85953db61953d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958230, "uuid": "9e48ce68-0681-4a43-bea2-79678e3059e3", "value": "T149B423B99846AB51F1F182D8A8447F9376F8F1609C7457EECE20A25B105EA13D233B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958230, "uuid": "af5c43c8-56e1-4df9-9360-d4b32c9c6fbc", "value": "12288:t3BvNcyeuug/gbso2nF4IR8fAdp/8huIOpUfCV/gX8fzSQ:t3BFldcT2nF4IIA7/8nDW/Dbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958230, "uuid": "b880b489-2ba8-425e-ae58-8e1ce23c8657", "value": 541065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958230, "uuid": "b1a66183-9b5e-4c0e-a1c7-3a32a120ae96", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958230, "uuid": "2856953f-d133-4723-b13a-0b5a4dc2cdac", "value": "103603-81075327-LBP23103603039.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3290331b-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1690967331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967331, "uuid": "2c3d010d-25e8-4055-86d9-9e063784ae67", "comment": "Malware payload (RecordBreaker)", "value": "9494e546b003b80987a521858553242c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967331, "uuid": "b63df640-45fc-4203-b445-3a810149f8a0", "comment": "Malware payload (RecordBreaker)", "value": "432c2a73d8964d29b539c57e5c7f2d5eda6d4eef667c02e95b4c26a1c37d58e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967331, "uuid": "df67353c-3d0d-43d5-925a-90b02121f189", "comment": "Malware payload (RecordBreaker)", "value": "6bdf37f9bcab9340a1658a27a11ea96b9f290a0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967331, "uuid": "3461b020-ba1d-4ffd-9b44-3da49267dffa", "comment": "Malware payload (RecordBreaker)", "value": "e83d7ca15e3a29e5929192e0f79f1cadfaf22f1bfb8b1a84b81745c802c8d41e797bca21d9782180bccc8ec143014c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967331, "uuid": "202dcb46-6fec-4159-b31c-88116d701fd8", "value": "T1AD44AE2276D0C072E0A756315871C6922F7BBC62AB7196CB33983F3A5E712C01E7A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967331, "uuid": "64d7f183-37b7-4974-b89c-51991ebea7b4", "value": "a01249a11ad56cc27bb7173ed6438e32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967331, "uuid": "3d62ac41-25d0-40d6-bdbf-1eb8c5bab70e", "value": "3072:NnRF0+Pf2fNuZIeYY8ltlyOqMf3Z+e8AnJgwjtIMmC4lHD7j1s:NRF3X2VuZVYTltJ/+e8AnJZtIMrOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967331, "uuid": "10758ff5-f012-46a8-a062-75803fa3715e", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967331, "uuid": "8a54f10f-f780-4620-8859-4aac9a336533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967331, "uuid": "f05c85f7-9e8b-46c8-8530-b5a5f2fc85a9", "value": "9494e546b003b80987a521858553242c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75a3191-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1690998585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998585, "uuid": "43e56d85-db8d-4d49-8645-0618e9e754c5", "comment": "Malware payload (QuasarRAT)", "value": "0ca5019063fce209e224900beee1c94e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998585, "uuid": "03640ddf-45d5-43ad-b494-cda54a6f337d", "comment": "Malware payload (QuasarRAT)", "value": "446394f68754ec8ef7d4aa622921b8a5fd77b0dbea23a1b39c366d905fac4489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998585, "uuid": "c0e9a70e-9ceb-4c90-8147-171f9620516d", "comment": "Malware payload (QuasarRAT)", "value": "49a8406b06d5162d713a799de53fbbf5b5f13753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998585, "uuid": "ea8d632b-f442-4c00-a84c-566b73f57c76", "comment": "Malware payload (QuasarRAT)", "value": "3acf1295a7bad8b456d691bacc3f556e58e907e29c9514d24970c1c0abdd3b86a9cd3c4215011f5511f0feee23a90683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998585, "uuid": "7ff4adf9-b97a-4419-8866-70d7451c0496", "value": "T12365E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998585, "uuid": "de4f3f17-6f0d-48cc-bc54-8e8d3ddb52cd", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998585, "uuid": "dcfabdf9-aed1-4189-b394-90a8cdaeaa01", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998585, "uuid": "b3bd3719-5700-430a-9e8a-9b44c59db7e7", "value": 1437440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998585, "uuid": "c3306a74-38d8-4986-9e0a-70827049e72f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998585, "uuid": "3fe04aca-f322-4e07-98f1-1d641d9df405", "value": "0ca5019063fce209e224900beee1c94e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469e34a8-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966076, "uuid": "2eb030e3-1c18-4985-aa44-8f3ae43cc7ed", "comment": "Malware payload", "value": "82eb32d941b6dd63957a37453c9b0333", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966076, "uuid": "8253b420-77fb-4dad-8fb2-dfef45556175", "comment": "Malware payload", "value": "4466017fd40c4b5fa9923928b7be3acf03825b4dd8c5fcf088992aee398b8c2d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966076, "uuid": "dccf5ba0-0edf-464c-9983-1d6d83939500", "comment": "Malware payload", "value": "f27a374044c73a6a5b2d926bb9468daf570b8bfc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966076, "uuid": "309424b1-f063-4379-be4d-f6037f0cf1fa", "comment": "Malware payload", "value": "f15e4c76e38617bfa4cdce674840f88bfd83d15ef7fe2e19baaeca79f64a7bc47fd8f58b6ec52fe2777e9412a480d32f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966076, "uuid": "3e2342d8-7074-4cd9-acd2-521b49815e0a", "value": "T16F5190186ADD5721E2BA8E7318F6E2009532BC51AD534F2E108107CC2863E21EC76E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966076, "uuid": "46db9352-77cc-4565-8ac6-5a654b3ef866", "value": "48:8UPbdNZZ51syDNd1jmJCZZawXCi3Kai+SY:8UPX/D9m8CyK+SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966076, "uuid": "449c8e1c-f11d-4816-bd9d-625f13167068", "value": 3149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966076, "uuid": "2cfc1453-e2c4-4e60-983e-7e7c077919ea", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966076, "uuid": "080b0350-8a81-4287-a207-07a13c62e9ba", "value": "Roshan-Bandara_CV_Dialog.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dce6af-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966184, "uuid": "1d0c5be1-633b-4328-8375-15d950d2709c", "comment": "Malware payload", "value": "75b7811a49d646d1f24d21dd5463ad7e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966184, "uuid": "e363cf93-c552-4982-aab4-828f79ebb24a", "comment": "Malware payload", "value": "44cfa8be9e0260b2c8aa3d47b466462badd040a773e223d2d8fc9f4d1c9a5518", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966184, "uuid": "76ad474d-fc5f-4946-9ff2-620373a4c9c3", "comment": "Malware payload", "value": "45edf08e19b2de5c14726f5bcb73ae79119b991e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966184, "uuid": "4eac933a-106f-4d17-a11d-3cac58558ad2", "comment": "Malware payload", "value": "e4bc3886cfb1a805b3dc7df04f31e3868bd0d93e896f0a6b6db539a04276e5422482e497af391d5b406b9587a0621064", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966184, "uuid": "5ee39435-e29e-4491-812d-78443dadbfdf", "value": "T106E423BA4507824533CDB466AE23C1C90EE39EBABB15511BBC808E496AD70FE535C74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966184, "uuid": "323a3b44-24ff-4e9c-8de8-21d1e26ecf7c", "value": "12288:OEnWiDSvwrih0zWrt0TGjmVhGFReB7gdRQWSrLY+sWlXjGiWNxu1C7C:flSvJR0HwA7gduWkLKcqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966184, "uuid": "7280a10a-61e0-4a40-8052-1c176d7838fb", "value": 673623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966184, "uuid": "3cd38e9c-d889-4fb0-aafc-906572ff4a6d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966184, "uuid": "167f0cd1-98e1-48fb-be1c-5d579b65a0ee", "value": "Packing list & Invoice_20230414006.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9cce43-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690964422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964422, "uuid": "cef410ef-a8fa-4061-b857-92a69d407023", "comment": "Malware payload (NetSupport)", "value": "5ac0132ad47d0c6f191c919b53c1e40c", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964422, "uuid": "a2421244-fc0a-45b9-86fc-dc8f1f20bbc0", "comment": "Malware payload (NetSupport)", "value": "44d3da908dd94c6711a9d9c0ec633c16e17673d5214aa2c537108929198ab758", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964422, "uuid": "35680d0b-dfd7-40f8-917f-1d075cb88186", "comment": "Malware payload (NetSupport)", "value": "4c69491ab7367da5caecbd606b85738d999a6ca1", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964422, "uuid": "e039eafd-f450-4e89-a857-a36694d5b3ea", "comment": "Malware payload (NetSupport)", "value": "eafe9c717eb1f06aa8eb3757b0b641c940d0d59b7ab65471b3da2f2544814a3c58b261be6da91e8489514de2be0c8a44", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964422, "uuid": "949064ad-5630-4284-bcd5-cbe6fd192412", "value": "T1CFD05E5D0BC28B5B0428D0EECB7A5D4DD06944187E99174A9A284D6EC425889BAD7246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964422, "uuid": "04142bf4-3cca-46f0-9c6b-f13a20281d3b", "value": "6:CxBR2hn23f9QSkCfFlCe8UlLAHbKx48HKmnOB1hn23fQRnn:cnW2ONCfFADC0vTmnOJ2cnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964422, "uuid": "5f8dc64f-4832-4ab5-acff-6a24e26f3635", "value": 247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964422, "uuid": "a4001893-70c9-47fb-a01d-7ff080c4c15f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964422, "uuid": "5048f0e5-fef7-4580-a9f1-b3e39113e27a", "value": "sett.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab8f570-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690967318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967318, "uuid": "2dcc71eb-6891-4098-9e31-9c5b47d7cdcc", "comment": "Malware payload (Stealc)", "value": "124ccd152e58fc7d308bc99cca9d3b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967318, "uuid": "e22717e7-e9f4-44ee-984b-1d39f5e26c59", "comment": "Malware payload (Stealc)", "value": "459c657cb3ebf8b8ac1233ab4544f8b497b68cb1ee7a471a6a111367cbf5de6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967318, "uuid": "5f9acccd-a39a-4ecc-8b20-3e1ba154441c", "comment": "Malware payload (Stealc)", "value": "b530dce5a4c0983e90f5293203592c192e30ca0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967318, "uuid": "7cf1144b-a74e-4bf9-ad17-e4e3da471ba3", "comment": "Malware payload (Stealc)", "value": "0d9a8d473342e7fffb650f204c89ca4f9647dd4e6666b80c4b5f544367f1b600f6b46e2d6e80bc5980ee6146958eef7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967318, "uuid": "c4cc12b9-b699-493f-8d0a-ea1232b489f8", "value": "T117549D127591E832E5660937AD2AC2F4252EB8B18F195AD733847F6F28312E3D776343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967318, "uuid": "8fa5737c-3d37-4034-bc23-480504a16122", "value": "fc216a175a8e46e9a4a49f4ecfbdcb0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967318, "uuid": "bfb06657-b1dd-4a71-8bda-2ef830701091", "value": "3072:gdb3MfJcaEtfuZu7S/L4xQGCtSU85mSblDlFO1PVf2srQKgqGEg+gpCDlCSwSs:glhaAuZu7mL4x1fBDluh2sryZvp01s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967318, "uuid": "ed8ee46a-bca0-4a4b-a46a-882b754f0260", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967318, "uuid": "e360bddd-5d41-4f43-8f14-e0f477421ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967318, "uuid": "01e99fbb-8e0c-4370-a1c3-92f79f32f234", "value": "124ccd152e58fc7d308bc99cca9d3b07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ce6434-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690957216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957216, "uuid": "c95f35f8-d788-47ad-bd4c-23496c4bef43", "comment": "Malware payload (GuLoader)", "value": "4b3ab60d5ae729de637ead9dd9e86726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957216, "uuid": "629e39b9-6250-44a2-a9b5-9fb94b399117", "comment": "Malware payload (GuLoader)", "value": "45e1b4fd24b95c21773cfd5af6bd5000ae95c5a0a1e1019bacd55bd365e5a329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957216, "uuid": "0abacb35-6f6b-4865-9b22-bce3231b60d9", "comment": "Malware payload (GuLoader)", "value": "6b493415559671c90e45068ee1e7bd87c01e22a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957216, "uuid": "349a2b51-cbef-480d-a92a-ca302ce57125", "comment": "Malware payload (GuLoader)", "value": "dcfacdd5e46744db79e2587288663f8be887dcd2c95c4fe9520f0e41f695481dd0eec5a51763a9d79d6e291a457bf55e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957216, "uuid": "7f3575f7-81b5-4ab9-aa4e-1665d5bb64b7", "value": "T1CA841206B193F82BC9B50E787878DDAA9AEEED41AC62270313457B2D3C77684436D303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957216, "uuid": "eea5529d-abb6-4e48-b125-652fca214dfe", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957216, "uuid": "06e82861-074e-4137-bae9-56223c9df733", "value": "6144:1qaFH+9PxCMCeX8S6JcoWjX7NM8ir2U4mTmMSPkTdlgWtS+KyM:f5WxCMCeXToWrJ8r2Uj4PkRlnTKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957216, "uuid": "0d38298f-6e85-4348-afb9-374e753a02f0", "value": 388432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957216, "uuid": "2aae3044-7778-406b-a50e-212b16ded0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957216, "uuid": "c8b12267-cd89-4e44-9cf7-99b6c422cb9b", "value": "ORDER NO 21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7139ab-3102-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690959855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959855, "uuid": "b423be3e-dcf7-4adf-8b72-e74215de77d2", "comment": "Malware payload (AgentTesla)", "value": "97f65414b331bda98d55063e56bb4a91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959855, "uuid": "e48730fe-9ae4-4595-b335-2d787a08abe5", "comment": "Malware payload (AgentTesla)", "value": "45fd36c20df0c6d0bc44a80a1377d379aad5901eb80418c848249d57238a33c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959855, "uuid": "f3248ed8-ac0a-4415-a963-e7cd0de0d51b", "comment": "Malware payload (AgentTesla)", "value": "dbd84e5b5a6e191e3c5cf5f74ab67e661a318ecb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690959855, "uuid": "6d31e34d-57e2-415e-a4df-dfafcee18ea2", "comment": "Malware payload (AgentTesla)", "value": "880dc0b5661170e7b0890612e36d9ac3b1a9b7ed4f650924e865434f66c1e00f2c2ad99ffe5d747243a2ff42fe3f6873", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959855, "uuid": "f87282c6-fec3-4083-81d5-fa761d31beb0", "value": "T13305D526413AA0B7DF197ABC5E13D83A35D96B40B1F6E198B72F68C3C5C61120D3A7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959855, "uuid": "b41c2757-273b-4647-9897-46964de91e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959855, "uuid": "061b31d5-9ab1-45be-9311-1d1825a9ed58", "value": "24576:F1pppNpppppoOQpppNpppppoOX5u+enW/j5n:F8O7OXXl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690959855, "uuid": "25b4ba4b-59b3-4b1a-bd90-6df788446758", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690959855, "uuid": "50e391d4-3d5c-4c63-9028-e457c21d6d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690959855, "uuid": "b40d03bf-78cb-47a5-9b89-aae9ce0e5ab6", "value": "PO H0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319f274f-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963893, "uuid": "2c5a1795-8470-4135-a013-b0d8c8321eb0", "comment": "Malware payload (AgentTesla)", "value": "92fd19e4845a39b2c74c43878a86a994", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963893, "uuid": "e4f53dea-f6e8-47d1-88dc-ccba3eae7810", "comment": "Malware payload (AgentTesla)", "value": "466e8cdff477c01fee77c3e5ea5f719f5053785e7807b99aa09b464256adad8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963893, "uuid": "fac5888f-42fc-494b-bb99-b749f9d3a2dc", "comment": "Malware payload (AgentTesla)", "value": "f0f059755bf03788cd072175c6eee1d861ae193e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963893, "uuid": "dbc63c11-0ab5-4cbd-b43c-9883b4b02b21", "comment": "Malware payload (AgentTesla)", "value": "0804018fa68ccd6f6de789c12972fb1f4bf47812ca8d194c4df8f655345292f6c24c234870581e29556066837dd0bae6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963893, "uuid": "2345d2ee-7f19-49d6-8481-ead57cabae90", "value": "T1D1C423D9243373D696F1FDA4000EAEC4821F1164E4F7C135AE34975E9AA79FB283A319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963893, "uuid": "dc44689e-6dc4-4375-915d-704f8615e711", "value": "12288:DNPmLfDWyjx7WVlvgYdi/pDGvKSdVMDNQJpLTfsMK4CjaJ:D1qWyjx7WVJgYdOqbMDNQ3LDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963893, "uuid": "214db7b8-e0ff-433c-a936-55dcd566eb67", "value": 559809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963893, "uuid": "36adfbe2-245b-4f37-b569-e0c2696dae85", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963893, "uuid": "2390b889-88b1-48b8-b948-a7ed4795c7a9", "value": "57m\ufffd LPG SEMI TRAILER 7 NOS.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5272d975-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690998308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998308, "uuid": "aa512234-0ef0-4209-a360-2a5bab9c94a5", "comment": "Malware payload (DarkCloud)", "value": "34a46ba17e1e14d3641e8dc506f35436", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998308, "uuid": "9b6b4e50-496d-417c-850c-66d2b92fd680", "comment": "Malware payload (DarkCloud)", "value": "4715d0fa523a32f9162dfba45a7fbc845a0b28fdfa9631d477168fd422fdd271", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998308, "uuid": "79407a3f-b394-422d-b75e-551aec42537c", "comment": "Malware payload (DarkCloud)", "value": "907e05a009d2e297ac91c9015328916f2da220d5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998308, "uuid": "549a7a4d-49c6-474e-a5d1-95256157e0c8", "comment": "Malware payload (DarkCloud)", "value": "5fd202916659d5a3ad85aba7c8f8b0946e1205321728270e0974fcd309a549639cb86b520ffe57dbbfe542c00b73f9fe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998308, "uuid": "7990c535-47c4-4491-b97b-be1bccdcbb04", "value": "T1A815DFD97214B5DEC417CD32C9641C25AA61AC6F9B0BE207A06336EC9E3E6978F111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998308, "uuid": "f0db822e-9e0b-48dc-81dd-98aafb22e15b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998308, "uuid": "a0946177-d8ac-429b-a70f-2c9d686b9d37", "value": "24576:px99w9wgL5WkOcLFgEGzPFILniwJBzT2FV9:/99w/mcLW7zeLnXBzT2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998308, "uuid": "fba9d690-ade3-4ff5-9f2d-c5f9d06cc88d", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998308, "uuid": "9cc37a7d-5963-45dc-9740-2d0684622d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998308, "uuid": "1eec4363-8b3e-404c-9c4c-87e84f0d2a65", "value": "DHL AIR WAYBILL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bf442d-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998335, "uuid": "201392f1-491f-4626-a870-a85644135cea", "comment": "Malware payload", "value": "ec30b70609bd5542190692d073c1d38d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998335, "uuid": "d1b97b56-b2fb-402b-8609-2c9b69f28a52", "comment": "Malware payload", "value": "486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998335, "uuid": "7e7002e7-a1d0-4762-9cd6-b1757fb968e7", "comment": "Malware payload", "value": "afff3baca43a3c39dd589a34e096706745cf2da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998335, "uuid": "50e3132f-3ea4-46e9-87f6-f660df3d519d", "comment": "Malware payload", "value": "2ef63fb6b813738add40f262c11f308cf77cf75b13e125c720960b22dac7ea6f964bb7cb6c6f89903a68aec14fdd5d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998335, "uuid": "84438077-509c-41a0-87d9-2a8abb8fb5a3", "value": "T184163300B7D36C3CF2631CB88A619414BEB67EE904FA4051DF39DE1F81B5ADAA875523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998335, "uuid": "bfd0d0ec-5cf2-4fdb-b79d-e89e34d53946", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998335, "uuid": "e1eb6c1e-1ab0-4bcd-95e8-c659922f2f7d", "value": "98304:Q1xcPAX7C+m/FsujkSdQ/mtQTIaSYvX8Twk+VCg:lPVH/oS0NSY14g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998335, "uuid": "c7245d9f-e0a2-43ed-9a35-b7715d5a6fd3", "value": 4153763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998335, "uuid": "cf532f55-e8c5-4615-a564-241e27a4ccaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998335, "uuid": "c1f03de7-12fa-420a-a6ae-09958aa48a83", "value": "The Last of Us Part I update 1.1.0.0 - 1.1.1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263363f-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690966552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966552, "uuid": "6998c47f-08c1-4617-9de4-79dddfdf1609", "comment": "Malware payload (Formbook)", "value": "2f3a3cfb5b91580e6d87e8642f9d8439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966552, "uuid": "063399fa-6774-4d02-a105-0ca380ca2a5c", "comment": "Malware payload (Formbook)", "value": "490129df3b9f148b27f875a33d9e4d584a3470250d46b5ef5bfee336644081b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966552, "uuid": "4674ac2f-8c37-4792-8f16-2f4c72df911d", "comment": "Malware payload (Formbook)", "value": "69be5027543c20ef71c06d00cf8d2d33cf9d51f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966552, "uuid": "c806373f-4d71-4e9f-a427-9d93971be8f1", "comment": "Malware payload (Formbook)", "value": "037a66205e91185934802ee670656743659411b17b2061e3a5cd0cac190ab6504237aaaa9a8b0427f5a3ca10d5542169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966552, "uuid": "8674309d-92d3-4150-b5fd-cc93ff9936e7", "value": "T172E4233015B4EF2ECA3B0BBE0971405113F2965E3530EB2E4F8576E96A317825B56EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966552, "uuid": "cf21c120-9bbb-478a-b867-743a7e47ce95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966552, "uuid": "c5222cb2-9e26-4512-b486-a7145bc5813d", "value": "12288:K+uZw/YmJ+37zZaI3So1Ww2TndPGSOhT5aU1Lt23+8HcjjsG+aHD8:K+uK/YmQ37zZaIl1GTdPIT5PE/cjI+D8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966552, "uuid": "dea5e0da-1a11-4410-ad56-ff44b9c2abfe", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966552, "uuid": "8569f39f-fbe2-4918-b52e-96710e691599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966552, "uuid": "725188d3-f12d-4604-9c9e-3f3a1befa6a3", "value": "FedEX AWB AND INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68269241-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998774, "uuid": "9e9b2bb3-2c78-48f0-997a-f51968242d37", "comment": "Malware payload", "value": "79a124b150d13a5cabb55419feecb2dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998774, "uuid": "592e1f5a-c3d3-4a90-9633-8c456eb25bd3", "comment": "Malware payload", "value": "4b450f3eaa7d11bbfd4a4ce416cadc531df62611a6e4be19d97d62fafa1aba9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998774, "uuid": "65611317-ad64-4254-922e-7ca2269d64bc", "comment": "Malware payload", "value": "ca95c200fcc4d29d39e2248dec332a54182d923c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998774, "uuid": "068fbfc3-d5ae-4e55-abc0-752d1d44ce0a", "comment": "Malware payload", "value": "bb453921477fc17544bf5ca8164c14fbd4cb771fc565c5a2d505e525dcfd5bd956ce107c79a96894d0d561792309ce0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998774, "uuid": "796835eb-848c-4ad2-9e2c-116d9722a85f", "value": "T1B4E47E2178C49176EEE320F683ED7A7642ADD4B4032951CB4AD95BF6E3606C27B331C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998774, "uuid": "2ddcdc07-5655-4fc3-9731-38f50cc1455a", "value": "12288:hGq5ja7/2MRukiwFAHuP2PPWfhKffHLPgDARn74uV5I:95ja7/2MRukihHuPmWfhWPPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998774, "uuid": "f199156f-5d9f-48e7-96bf-faacc503efb2", "value": 707315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998774, "uuid": "04198de3-c64f-4ee4-82de-bd03a084f413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998774, "uuid": "a01a4a92-9ea2-43d8-89bd-e255f9994f94", "value": "79a124b150d13a5cabb55419feecb2dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32632af-312c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GurcuStealer)", "timestamp": 1690977908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977908, "uuid": "a38b4e75-eae0-46e6-9564-256c9386b79d", "comment": "Malware payload (GurcuStealer)", "value": "b6ba4c0a0d8a6137a2953845c03ab249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977908, "uuid": "78823f73-080b-4ee8-ad5f-6f86e77556be", "comment": "Malware payload (GurcuStealer)", "value": "4c6359593885cdae14233966dd15cd5b0fa207b97b4bf13c0817f2e124b07630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977908, "uuid": "94ba2c3b-19c0-411d-9201-6807eaf5c29d", "comment": "Malware payload (GurcuStealer)", "value": "15ca8b91a4bc2d7b2b92922abaeb9e663a144caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977908, "uuid": "d09dc504-d37e-4630-9832-6426f192beea", "comment": "Malware payload (GurcuStealer)", "value": "cf2aabca2dae4e97cf2ea307b4c4e20759bfcac087b6c0776287584c1e868437812b4341860d0d83823e6e9776be365a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977908, "uuid": "8c60f03e-0b69-40a2-be6c-2d157cd29e73", "value": "T17184D022BAC084B1D4A508351ED2E772BB7DBD301B258BD757847B2F5F340E1AA36693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977908, "uuid": "40a90d58-801d-4e09-a610-7f0a9b0d780c", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977908, "uuid": "2add30e5-2bc9-427b-8630-bbdf40e1c2d1", "value": "6144:EN3DB60MGC1DI9cV2Qb91CWIoZsBvukHLM8ms6ONg1KyJCsy3Y+:Q3DkEGDINi1EtZukY8GONM9ryF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690977908, "uuid": "85d58ba9-8552-4439-80e8-bd210b27b844", "value": 393820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690977908, "uuid": "3db07811-084d-471a-b7c3-47905730dc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977908, "uuid": "69870e43-bcad-4d6b-8540-89f6d829fb7c", "value": "4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f584dc8f-3126-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690975389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975389, "uuid": "fcce73be-a050-46c3-9502-6f8dff8f2282", "comment": "Malware payload (Formbook)", "value": "7f6b7a553e35963e81704ea22e7827d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975389, "uuid": "e2322aab-e318-4306-ac4f-5fc7e9ae92e3", "comment": "Malware payload (Formbook)", "value": "4d698a32de4877e432bf6d6af790d86746adb3bd352844451a7505fb3d8b3492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975389, "uuid": "551da4f9-748f-4bff-a4a1-b1ad03d5a709", "comment": "Malware payload (Formbook)", "value": "fd21dc21dbf54fdcf6f79978acb90b8b50430a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975389, "uuid": "c2b780b3-7d2c-488b-a94c-357094b19f67", "comment": "Malware payload (Formbook)", "value": "b2e9d2b83219241d2bff09810dbdf08252cfe100256ae78f359d8fa1c7b543c8e634aed44bc08cd95eec6b17f89c6f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975389, "uuid": "9ecd2c3a-41eb-4163-a356-a057be42a640", "value": "T1C35412C4ABFD915BE66641B042BAC649AF74CC264021F61B8390F96EBDF61D18D0F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975389, "uuid": "8aaa1cb2-4803-49f1-9ea4-e6b963bbc935", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975389, "uuid": "1ff768ba-835b-47d9-a00f-ad728da34aba", "value": "6144:AYa6BxEbDzexNkExlLidN6BQgnYi00PAbRgNj6pM/IONV4GSqCWG:AY7xsDzskEfOwQgnYi00PAbChLDfHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690975389, "uuid": "b09d6eb4-0a1a-45dd-9bb6-d9d1523b8643", "value": 304093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690975389, "uuid": "847e0fe1-f3e2-4533-b8fa-74793e22ccdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975389, "uuid": "05061377-6715-4c25-b33f-c33c6cbcd724", "value": "APS-9840270 Rev2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f22e6-314b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690991149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991149, "uuid": "ac76897e-0c37-485b-a95f-82089d6c1a33", "comment": "Malware payload", "value": "e3955c33726958d510272014a4366b2c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991149, "uuid": "55309068-7aa6-4991-87ea-bfbab2992bd5", "comment": "Malware payload", "value": "4df7f3544376606a6ec272c9f0bc387ea535f475c8c94cff3897adf5afb80b43", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991149, "uuid": "d1f3534a-f6b0-42b6-afbd-ab185dcfaf33", "comment": "Malware payload", "value": "452b6b3c0ad52b8311ae86298b84a982174385fb", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991149, "uuid": "be99f62f-a99e-49e1-b88f-4ebe1ce4d6b9", "comment": "Malware payload", "value": "e0dfb6914c6f154b4ce89e63b45edf9467e91b5e8e011c8e48de370abf1cd9762f2ac1a6970a7e8d70c612200a79a139", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991149, "uuid": "a175d181-2193-4557-8253-bdd6f08fbe68", "value": "T19074124DDF83326AF0C89C66144683D1BD9653D790787FC5AACA5A031F043CB9AAA4DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991149, "uuid": "3a89d5f7-5dd4-4bab-a671-d3dbc46aa90a", "value": "6144:yohwcq6uYjgr6EAlTRiwl+KKlF9J7eQhrVuoWvlspLS1zKXdE3:B5kr67Ewl+BlVJhrMVmLtE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690991149, "uuid": "39a84503-ecb5-406c-add5-efde4eb33546", "value": 352718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690991149, "uuid": "03856191-b5e8-4fba-98d2-aeb2550038d6", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991149, "uuid": "9eb31e92-1f12-4024-81fc-93fe5d57f3e7", "value": "invoice.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8805ebc-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013136, "uuid": "5a2ae232-ce2b-4a85-9d77-b872a48c8ce9", "comment": "Malware payload (Mirai)", "value": "b2fe299db365f2accbb6cbb54846027b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013136, "uuid": "0c045b88-2c36-4957-9ffd-0c84bbd536c1", "comment": "Malware payload (Mirai)", "value": "4e28f502dc87a628fe7a3a9bc8f02c9af5f4aec86bb12e250ba654b0e718cd6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013136, "uuid": "5d5845d4-a248-4ccd-95f4-25220400d371", "comment": "Malware payload (Mirai)", "value": "dadb830f9aad67324cdf99dfc2c3d73a76a7e98c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013136, "uuid": "0d3e587b-841c-46c0-a40c-6602c6c0f68e", "comment": "Malware payload (Mirai)", "value": "bc3653b3bcb004712bbc23f6041c2a726174ce88f219a7072fa7bce8b5914426ac0a27918d320d26a8dd17283a3ecc56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013136, "uuid": "29ed9e49-5109-41dd-9681-4497b2d07b59", "value": "T1C1533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013136, "uuid": "6a394012-47ef-478d-a7be-5ebe3664d2d0", "value": "768:me4gpsM204GEkRbjveXJ/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozWyC:mo3EkRbD2oiz6IFn1X48B2SEzNfAuJ+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013136, "uuid": "7846060f-384c-4c28-b8ca-0a5d1020feea", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013136, "uuid": "5fd1e55d-91b1-42c0-91ab-336163839526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013136, "uuid": "5c9d04e1-f9d4-460d-b280-d4739a60f58a", "value": "b2fe299db365f2accbb6cbb54846027b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7602133d-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690967444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967444, "uuid": "45f20b44-d04e-4518-9851-4c2c8dd076dd", "comment": "Malware payload (AgentTesla)", "value": "f7687a10bf31777ddad97b1d0907bdc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967444, "uuid": "a19697d1-f26e-4a23-91b7-829021175cda", "comment": "Malware payload (AgentTesla)", "value": "4e8962c45fb4aa831a15ec2c5db19d6949c7426fa65ed3ed58ab794ad09e9f04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967444, "uuid": "2265bcba-acd5-4ee7-8e20-4a2551244901", "comment": "Malware payload (AgentTesla)", "value": "85c1582ebcd476730ec5e098b58078c8d803063d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967444, "uuid": "59d35aee-f805-429b-a6c6-64018ddb1c22", "comment": "Malware payload (AgentTesla)", "value": "bc580e66953d7ee8f7cf1be2b94f94d64f0ebcf25e0bea2af60096c213c421649a4376c4cfdeda70bbde84f3fe96f2e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967444, "uuid": "cd443274-3937-4868-b832-79b52d890d20", "value": "T1F9F4D0047168EFA7F53EDBF49414519407B593BE706EE78A8CE260EA1AA1F500F40B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967444, "uuid": "ccaeb65d-bd58-44ff-be27-c5806c3bd103", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967444, "uuid": "c9525365-f6f2-4d6f-ae66-bd8d200dffbd", "value": "12288:S5MYOdXvdBXN+kkAABjVyfHyvWzR9MHSECeuTivne1bttQfPkp6:S6Nd/dBXhkAAq/NjMHSECRTivSbIfPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967444, "uuid": "59ba7e15-3fd7-4724-9fe5-4a0351c12657", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967444, "uuid": "99d4dd35-afd2-4922-becf-aba2a0041ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967444, "uuid": "4b85ef96-d5ff-4cd2-8e9a-114d85309ddd", "value": "f7687a10bf31777ddad97b1d0907bdc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe12309e-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966813, "uuid": "20bf99d7-3fb2-41e8-9364-e1ec1b89e859", "comment": "Malware payload", "value": "b2f5f203850a837410291dde71a8cdbd", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966813, "uuid": "863d8ba4-670e-4fbe-9777-fc83ef350bc5", "comment": "Malware payload", "value": "51d5c3539614ff753cbf9647e59e59a6bcd1c5aa545f4436f1ae9a8e49b2354e", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966813, "uuid": "a85ebd79-af05-4e3d-8d87-1c8e324c9448", "comment": "Malware payload", "value": "c359d52776c9e0e22627883e7545a6e7397950a4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966813, "uuid": "f9ffcf57-70cf-4f13-85d8-197fd463e067", "comment": "Malware payload", "value": "e36aaf4122dacee9bd1ecbda3c651dd50a47b328c6552952a1f56299b7b7b41a2127ccb6139ccb7834a09f9fced2459c", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966813, "uuid": "60f82bf1-7749-45e5-95a5-5f6b494fb1a5", "value": "T1B9541236577AD941DE63D8BBF5B09FC3C1CF2DA886DB612DC84D19CD890AD3681A402E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966813, "uuid": "17e6918c-ca07-4f4d-bffd-34053da2357d", "value": "6144:oStFjSO8edglaOoyHz9U49YN4K9LuCB5Jtk9XKUs12:oSLj7dWDHzmKYN4K9hj2aF12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966813, "uuid": "4910e81e-08d9-4e7a-acc3-3dab88cc9ba5", "value": 305799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966813, "uuid": "8a62f561-d86f-4d89-89e8-ccd84e22d52e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966813, "uuid": "e008317e-8241-4f86-8d0b-adfd90722398", "value": "xE7in.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fd0074-313f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690985728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985728, "uuid": "a43532bf-5d4a-4788-b3c2-6fbb68ac1c46", "comment": "Malware payload (njrat)", "value": "25089cd9c39895a2fbbd2b3299312d89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985728, "uuid": "e94b839c-5fec-47da-a1a3-9d4466634b7d", "comment": "Malware payload (njrat)", "value": "531685db1f4e52a25cee46bcf387f4ec26e4d3fb1f6c5892f7fc3f8c9a77d854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985728, "uuid": "cd88dca4-af57-42c3-9c87-c640eb3dba55", "comment": "Malware payload (njrat)", "value": "7c2be14776ad16c54c2a993f3dccfcd5d61a5be5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985728, "uuid": "7e34a465-f031-4a3f-854f-be7a0471ec65", "comment": "Malware payload (njrat)", "value": "468b42f60b3071d33969cdbc03ac04dd345eae229b543afd1384520c810c41239a23b0329d96084a7e80f00f2d638aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985728, "uuid": "ba01acaf-acab-4440-b110-cfdf5aa783f8", "value": "T126049E593FE68D5CC2AE59BE07F2C02555FDDC42091BCA23CE7278AAAA35EC43E414D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985728, "uuid": "a934a37d-24e6-4401-9706-db43403cd4e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985728, "uuid": "af7e10f6-7b74-4ada-8b76-e974fdebfac1", "value": "3072:fL+agwtu+yJaw+lXd3ep46u9glxyUyqWIFcz4aVg6IgyFyP129qNkdi1RApv49X:D+agwp2ed3eu6u9oyiZcsaVg6TyFSs9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690985728, "uuid": "cb24a61e-daa6-4727-ad62-8a5cbf421b0e", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690985728, "uuid": "55034e09-f099-4d4e-a68f-7d39abe7852e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985728, "uuid": "f7ea86f6-7208-418a-89cb-05c3696fdadd", "value": "25089cd9c39895a2fbbd2b3299312d89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a56413-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690966046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966046, "uuid": "a3754000-8ebf-49ab-81ea-60722170a8b0", "comment": "Malware payload (SnakeKeylogger)", "value": "26f6b83f00ede490164483e6f396a7b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966046, "uuid": "c53da0f5-5250-4845-b29f-01a8b872c12c", "comment": "Malware payload (SnakeKeylogger)", "value": "537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966046, "uuid": "9ffa1a9e-5726-483b-a099-7260e5ab2b54", "comment": "Malware payload (SnakeKeylogger)", "value": "0f14bc46b93ddad1bf071b28b578e8489aaa3787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966046, "uuid": "98e8fe8a-7108-44b6-9009-7c43e3aa9dec", "comment": "Malware payload (SnakeKeylogger)", "value": "a10201d233e6fb3c596769c42a322c6e682990e59c650ddcdcf1bafed974a893cac7c0177fa9731cde50e457d3002186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966046, "uuid": "d10539c7-07ec-493b-be61-eb33997e86ad", "value": "T140D3174C3BF88804E6FF8A7315729121C7B5F852095ACE1D56C1F56A2EBDA408D1AFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966046, "uuid": "9092166d-aa61-4e4c-815a-7dcd36a12210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966046, "uuid": "002e1044-e85e-4010-baa6-e1399c55fbc9", "value": "3072:VJemedcYJyJUq2YuVAbzoZObCp4IwBtXnbY:VeGVTumbbJ3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966046, "uuid": "5c8181cd-cc12-4723-9a61-ab2e77b5508f", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966046, "uuid": "944e03d7-32b0-4d6e-a1c4-5d16b674502d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966046, "uuid": "47955b01-e31a-46ae-84d8-a83a5ef9d20f", "value": "26f6b83f00ede490164483e6f396a7b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33943358-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966044, "uuid": "67465224-6839-4a9d-9e73-8a7089cb5282", "comment": "Malware payload (AgentTesla)", "value": "18ded225e71e677d41793954a3992b3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966044, "uuid": "e3ae3d1a-8b68-439c-8eda-33280bddf38b", "comment": "Malware payload (AgentTesla)", "value": "54bfd99c3c0f06b36fa49b7ec029a586841cfb691099df5407bd134c16ba7d5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966044, "uuid": "77ac1e50-929f-4e59-8d61-cf3bc0a6bcb3", "comment": "Malware payload (AgentTesla)", "value": "eb5a89d380ca5d6cf0241daf6ebc5b277b648560", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966044, "uuid": "4900f3f9-9064-40e0-bd85-3434ee2c23b3", "comment": "Malware payload (AgentTesla)", "value": "d80592c1f78b8907bd65574ea15d56901cb1ecfdeda605d4e55278d0ec0c0cca48b1880ec62a49c10983b5156ec04968", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966044, "uuid": "e8fe92d0-61c6-476a-b788-8c0e66ef3e81", "value": "T1AA849F64AF931F5BC6D8D1FD40C6D166C9A9FC5DC2B2291A37B2CB86FE00544ED2C286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966044, "uuid": "4fb80a5f-7ce9-48fa-a55e-736785a61b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966044, "uuid": "53feb285-aba0-437a-945e-666f801772db", "value": "3072:diCsrHmDhgBdafeLmCdF/dBotTnxDHQzFZ4HsajDNb6FX2t:38H3m2LmSd3gnxDCmsajDNuF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966044, "uuid": "8895ce7a-8996-48fd-8bab-a5fe1a1acaa0", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966044, "uuid": "32990213-327d-40b9-97c0-d4908f99dfa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966044, "uuid": "05485767-9991-4939-b0d1-c0fdea9e4d89", "value": "18ded225e71e677d41793954a3992b3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77bbb95-313f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690986129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986129, "uuid": "bca40bc2-9830-4d06-b4fc-8b1647fe7f26", "comment": "Malware payload (Formbook)", "value": "9b0183aaf76bb587e4f5feb7b3998831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986129, "uuid": "66e3c6a0-6bdd-4c8f-98b6-94ef38ca5f26", "comment": "Malware payload (Formbook)", "value": "5527b09a684164d601e9fcdc900f44d1710f67f5830917f5f8b3b611b135090a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986129, "uuid": "c2cfb717-a73f-4b49-ab28-b7e1862069a0", "comment": "Malware payload (Formbook)", "value": "20ff0827d7c82bb6361c0dd17c74e330170f3b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986129, "uuid": "f9787235-61d0-4269-bce4-4432137ebac2", "comment": "Malware payload (Formbook)", "value": "0f5ffa3e2b6b198f29b228c352722b7d036096a467236413a6bbd5c23595e8ff0d8a02be0f1e563af85aa9c97bdbc641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986129, "uuid": "0d86eb2c-1283-40e0-8edf-040d8f6d54ac", "value": "T179C40122BAC1C572D86608350BE5A7B2B73D7D301B264EDB97482F1D9F701D0AA39763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986129, "uuid": "5b9a1e34-2d33-4102-b809-f70c33571c53", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986129, "uuid": "45485036-454c-4318-ab1f-4d9524df1416", "value": "12288:pjOtvHMm5xZT+tkxP848re63Kf/STAUX1jupSufXiEtv8JN:lOtT5xDVP8r5MIAUlSciXiAv8JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690986129, "uuid": "c215d2d6-46bd-4d93-a11b-4172f8aac153", "value": 577661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690986129, "uuid": "8159f8ec-497a-4a2b-8a34-90b2f761d30e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986129, "uuid": "824df654-2b96-4bde-a143-a2456d8fcb1e", "value": "9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe6132c-3125-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690974943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974943, "uuid": "33b9d23f-66c6-49b4-ad99-00d5589826a5", "comment": "Malware payload (AveMariaRAT)", "value": "3016babaa9d5ac82ce060501a1c743d7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974943, "uuid": "2a74cb0e-71eb-47ee-9519-95038d2520d8", "comment": "Malware payload (AveMariaRAT)", "value": "55334f31717b5e840b39cbd24b441f3f51fc66b5e8ebd9214b5c5160e836415c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974943, "uuid": "7329b7a3-26a2-4438-b884-1024bf720602", "comment": "Malware payload (AveMariaRAT)", "value": "a68594ebdca9d9542e769bb998205bb4e3432d5e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974943, "uuid": "1396a3de-8f73-4094-a10f-f340456b3b67", "comment": "Malware payload (AveMariaRAT)", "value": "61058ba67f48cc45132947675e2366c066696645d5197d709b2b2492972592db8fa97b1a7402f06b9a8e6fa16f5664d7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974943, "uuid": "8c4dbaec-a6f1-4280-a7f6-1d669638d395", "value": "T1E9328E2D9DA440FEC35F11F65160B49BEBB876AFE229070E5DB09A50CAB13DF4312714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974943, "uuid": "9d4ce991-6286-46e7-9195-d0ae7e3ba22c", "value": "192:Pya0Nkb1bWr4N5eNA2A+EnVs+mg1SoBtJYNO36PvmKQ1EY9acWe0c+3SE:PyXkb1bWru5+A2bkBdBtJYNOqPG1B9an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690974943, "uuid": "9d783a02-9804-4ef9-a276-f10f253d12f1", "value": 11495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690974943, "uuid": "805a0c0a-1c93-4f2a-9389-4df4a5f61d31", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974943, "uuid": "221bc7fb-66d4-4aa5-97e3-be11f63e6426", "value": "July Statement of Account.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e2e6ca-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690998040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998040, "uuid": "21ba60e2-bd39-41a1-9a52-51d59e4f6de6", "comment": "Malware payload (Formbook)", "value": "20184887cc360cee738b358dd896d315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998040, "uuid": "a674c91b-30f7-46e6-b831-5bd9ab6e1f09", "comment": "Malware payload (Formbook)", "value": "55ca03b4f0a73d8c2fb54ded501c1b537d70cd7dd7b11bc6760d0180afcea5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998040, "uuid": "a8c9cb43-ce5d-45cc-9515-dc3054cefc28", "comment": "Malware payload (Formbook)", "value": "2e2cde781bef22778afe217ae92268b112e21196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998040, "uuid": "c5018c35-c9b6-4480-93e2-6b934984034e", "comment": "Malware payload (Formbook)", "value": "2196055d35a81a0a20afecc062d5855d0e64cb27fa4058759d17180b8367ad278c60d99d47594f486f870b225db5218b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998040, "uuid": "6f10a0c6-6fae-4c45-bb1d-1c88c7efcd50", "value": "T1A8B21AA2FA2D90A1C3148B3BC5979141C733D5C260A7CEBEB54B235A5C07FABDD261C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998040, "uuid": "2160c3d9-53ba-4185-b271-d2c6a2e90ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998040, "uuid": "c55a3b3e-f778-42f1-867e-b77d72302016", "value": "384:9xg8LhcvtTqguhLZxKsNKdEPpcclXmFr0kA1GMIvP3wxffH:9xg8LSvt+lhLXKm5PGIXW5nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998040, "uuid": "8e8c8889-77c6-4274-ae57-fd04863b676e", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998040, "uuid": "59b768d8-b33e-4adb-8906-9ca25f9262b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998040, "uuid": "7df0e6be-a746-4596-8889-400784cfb8cf", "value": "20184887cc360cee738b358dd896d315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0103c341-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963382, "uuid": "4de090bb-70a0-4dce-9999-3f33e4c92d14", "comment": "Malware payload (AgentTesla)", "value": "4988698644f51b49860d75366bd0da92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963382, "uuid": "e56d0201-8204-416f-9e96-a66a33678e42", "comment": "Malware payload (AgentTesla)", "value": "5603f5b634043cc267f1a0e39828de7e7701af2fd614f757003471ebf7bc10ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963382, "uuid": "50394f15-2968-44be-be6d-74908bad50b6", "comment": "Malware payload (AgentTesla)", "value": "f8994d2bab29fdf58e9204f72da7033a8a8e2408", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963382, "uuid": "a277a999-2969-4750-a494-b8f83de7ef75", "comment": "Malware payload (AgentTesla)", "value": "10ee2d14f3b2e0035fa72515f413f40ffd2922b797a6eae71741d48331113eddb970e9ccd0a51c2f75861812872879fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963382, "uuid": "010bd355-01eb-4328-a4c5-926b2d446f80", "value": "T1A433D16DD38F0169CF5212379B6A1A9441FCBB3EF38512A1346C837933EED2D51262B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963382, "uuid": "48584dad-5236-42d1-908c-9c3081ae4fc9", "value": "768:GwAbZSibMX9gRWj1v45iGuA05vmMQxXokM06zV2TmmvDbk:GwAlRx5iGuleMlgIV2ymvDbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963382, "uuid": "576af428-433e-4564-9a46-f425e4ff544e", "value": 51430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963382, "uuid": "5befa48b-16b7-4617-a03b-3599128c7a97", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963382, "uuid": "c86abb9e-1504-4772-8679-d0bf796bed93", "value": "4988698644f51b49860d75366bd0da92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ff531a-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690966556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966556, "uuid": "b2ad8ea0-1576-4542-a810-58a28f527050", "comment": "Malware payload (Formbook)", "value": "e7d5dfc4be79a2a8be4fb10e53897901", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966556, "uuid": "b95b9013-05ae-4fa0-b395-2122989b9d52", "comment": "Malware payload (Formbook)", "value": "56bd5f09dca8b8ad2850e4c678dc2405a9d629dd05eb08a96ff85332fd1fcdad", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966556, "uuid": "6aecb4e9-3c4f-4d4e-be63-ff82ae051485", "comment": "Malware payload (Formbook)", "value": "e2ddc04f1cccb2b1346f745105399683e8c8c338", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966556, "uuid": "16ad5d1d-8255-43ba-899b-4c5832385185", "comment": "Malware payload (Formbook)", "value": "fea5fd9b4b52105fe2ae4df81bf78bf1cd38e4c44191b3650b0636225acf918501e19447be22e0924e79dcbc7b6df547", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966556, "uuid": "4c5f62f5-a776-4945-8b9d-fd91c64a68e4", "value": "T1C4E4D005726DEBA7F43E8BF05514518003F992BE70BEE78A9CE6A0EA1664F504F40B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966556, "uuid": "fd130290-457d-4ce6-a18f-29daf38ea61d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966556, "uuid": "2ddcb34e-aba7-4f02-86b3-369b4d09c908", "value": "12288:O5MYPPQpwWhOVAQvBKMqLfz39rYjZG3PTwreqoAD8Tn7E:O6yIyVX03vN81G/Tw2AD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966556, "uuid": "2b672957-56a1-4aac-a7d7-a34dac475ae1", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966556, "uuid": "49b12c44-e81a-4582-9c8d-82e4921cefa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966556, "uuid": "be03172d-8ae5-4bad-822c-69463c4ad988", "value": "DHL_AWB_907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a94f926-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998348, "uuid": "46817c6f-d158-4d28-98d9-eecca9cd3b57", "comment": "Malware payload", "value": "facd7d13ffd63000e8ad511c9ec0f1d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998348, "uuid": "a1925681-25f2-4b35-9267-22c71279f559", "comment": "Malware payload", "value": "56db29944b6202259048987f21728cb0d28a3ef213c47577559cc0a9ed6cdeee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998348, "uuid": "22a1f3ab-8cd5-479d-aae9-d05426ffd0ec", "comment": "Malware payload", "value": "eac965594626b59b4c4352c8ea877c607ea10707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998348, "uuid": "efdd11e4-daa1-449d-9a4a-ffda0cd8fd1e", "comment": "Malware payload", "value": "a50882fb8de0824296cb9e2f7dd933ba8e8cc2922617c1751faf76b43bea92646c03db47dfd31677926bdd3c75f10332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998348, "uuid": "06c0c3f1-24ce-48bf-8f4c-f03ba1f638de", "value": "T178A48D9238CA756FDC2F4635035FEAB61A755DE0739208AE4F40361E4C36A4A90EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998348, "uuid": "8244d9f3-fa36-483c-a3e6-cf1b75c6d353", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998348, "uuid": "716b6364-24ff-48f2-8400-b7c1e979f442", "value": "6144:WqC56XPZVheNA+ff0iJpNF9p4zqtsBtvGmYkv13WgbUxA2jjCS90PZxmueMfh:hfnhe2epNp1sBlbNe5+WwTD75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998348, "uuid": "6cf7d4c6-1690-43a8-bd07-fca3a76ba88b", "value": 472048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998348, "uuid": "49c92c5e-0206-4f08-8c64-c33875fb0b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998348, "uuid": "ce98f670-3da2-4105-8827-77f37bd49dc7", "value": "Justificante Pago_es_01082023211570182_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b158f5b6-3157-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690996320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996320, "uuid": "16fe7b50-5238-42a9-bff3-7de5e84a6f94", "comment": "Malware payload", "value": "4516f5182bcaefb6a8dd7f53ce0c429f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996320, "uuid": "6c409cdb-6194-4282-8587-9fe35de0517c", "comment": "Malware payload", "value": "577403a4c07eaf6bade5f5ac6165b0ee87a4fcfd2d8e3894a3defdd5e33e9e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996320, "uuid": "fee0c876-6a50-43a2-8c09-034c63cdc527", "comment": "Malware payload", "value": "eca27762ec651c3072213262cea7cef198e827e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996320, "uuid": "6758c0ab-9555-4258-b19a-65b08347ddac", "comment": "Malware payload", "value": "d2baf9ebbd893a42123f5f2c38a0296c8f03339872f81e55451e86354453e8794c41ae16bcfe722cdfe1b9ea088e197b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996320, "uuid": "a2ed8cc7-a821-401a-a32c-5269bb52969a", "value": "T140057DA3698477B7D3CE0C3360BA651D93A5E869A79FF7473002A876E4273659E007C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996320, "uuid": "ff183b4c-e921-42f0-addb-9efc4e0a685e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996320, "uuid": "a55ea0a7-4a21-4217-adec-41945721f8bc", "value": "12288:ilsUCeelhOBEmUeRHyhubiMLnN6fMZTjeVzvEKlT/tZmG:nUYlhkRchubiMbNI1M+/tZmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690996320, "uuid": "cf920f13-1b90-4885-9cfa-3ee131f3b41a", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690996320, "uuid": "23b1a3d7-f3df-4067-930a-8abd35559685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996320, "uuid": "5ca057bc-07dc-48c2-a730-769b70be6cbb", "value": "CrystalUS.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebff8cac-30ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958622, "uuid": "4aa1768c-b0a9-4819-8cd6-c711f338c7c6", "comment": "Malware payload (AgentTesla)", "value": "cb86e07dc946cdfa403435afb42fc3e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958622, "uuid": "d5a038b6-9a20-48d8-89c7-2b39b964089d", "comment": "Malware payload (AgentTesla)", "value": "5785727df0f1a3fe9e7508f077cc08faa9c685c76d8e67c4144b14354d19a23c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958622, "uuid": "b0896538-45d4-4c37-8351-484263bf70e7", "comment": "Malware payload (AgentTesla)", "value": "89b1c7dca6e5dfbd69904f77ca570de65f420b06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958622, "uuid": "8c8c6e57-8015-4e91-ad66-d17603d30bd6", "comment": "Malware payload (AgentTesla)", "value": "78d384abf5fceb6efe31a29c8f94c4c26a201edfaf0def9cb84d015fd8f88ebc51083cb80932f78863fa5fe0363153f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958622, "uuid": "29d72528-a39b-40b6-b4f4-686af01dcc63", "value": "T17DC42372E0C63CE3AD3C45F009A9D55CB97D12D22979D4B6326A38DD08B0DEC562AF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958622, "uuid": "b3b5ada3-8786-481d-8e27-d1c8f3fb76b7", "value": "12288:LmeUT7/0bXpeFKyQ8qJtF4DH1WZDoGgSGia8qY9AxlyKt:C748/Q/TF4DH1kUSGiauulX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958622, "uuid": "95b71efa-3305-42b7-8d10-0b7b80d31719", "value": 548392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958622, "uuid": "85410e5e-bc99-4b0c-9987-fe6c5d0c94d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958622, "uuid": "3271df86-8327-4120-a9ea-d052f7a09b7b", "value": "QUOTATION 1307-RFQ.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43f729a-3128-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690976219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976219, "uuid": "f76075ae-dad7-4649-a75a-a8faf364af5f", "comment": "Malware payload", "value": "eefbc5ec539282ad47af52c81979edb3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976219, "uuid": "291930ea-3bc6-4a0e-a196-3d4805b9acb6", "comment": "Malware payload", "value": "5b018d8382e33713eba0b60b394e6f69edc0cd20aee7e384f5004403264d2781", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976219, "uuid": "9b7ca9a4-6afa-4faa-abf5-7c46a9b422cd", "comment": "Malware payload", "value": "aaec03da8855551b2a02e10a1a854773a59d927c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976219, "uuid": "24052d41-6301-42d2-a689-2cf319761d07", "comment": "Malware payload", "value": "631bd2414f2a2060a8f907fefb7c0d1bf45278b3062d89a5bbcae80d37d16ea109643ec3635cb205a05889de75655e15", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976219, "uuid": "94400334-ab90-4c0f-b519-c169a528a5ff", "value": "T1A897F107F49541D6C4F5E2B488218262BA717C5C1B7963CB2B60F7B52F32BE05EBA790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976219, "uuid": "ff58b19d-fa7b-4e22-8e5b-7a2413c677e2", "value": "fea658ef5e945c869597063871d04057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976219, "uuid": "5cd21169-62b1-49c7-b435-4f5f6e44d64a", "value": "786432:VM8WEOFy2FEFX1aJAH8uvJ8mSehmtFP1VF1ZK3wUKx69gabHrteE1:EFyxwAXCmScuJZTKa69ggHrteE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690976219, "uuid": "54e456cb-27d5-41cd-8f29-56292024d44c", "value": 40169832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690976219, "uuid": "52bd5d49-dfe5-44ca-9a92-14eded9e4a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976219, "uuid": "9d834bd1-b159-41c9-bdfa-35771abd76b7", "value": "eefbc5ec539282ad47af52c81979edb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cb1d37-313f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690986065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986065, "uuid": "bb493272-3ffe-440a-9a81-a7e35146a86a", "comment": "Malware payload (Formbook)", "value": "7676d190a2a572a61972464293c7ba38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986065, "uuid": "bd375bbf-1b69-407b-ba7c-007e2620e347", "comment": "Malware payload (Formbook)", "value": "5b45d82c1bdeb0b5b91c84cd61c0359f95440e2a02ccc46258e76d4f4f679030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986065, "uuid": "404d487f-4970-42f8-986c-d75cde14cff1", "comment": "Malware payload (Formbook)", "value": "9b5b992e855d4139d7b074149a68b05b04eca27c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690986065, "uuid": "a2a7289e-cdd3-4247-8915-443ec7e0acd0", "comment": "Malware payload (Formbook)", "value": "ba4afb8f619697ce1646c68979f0920bfae50884e9efa750b84f39859cbc33639e5b5f7983c5cbe35577da2fc49e0f8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986065, "uuid": "d97bb1a9-04ef-4c9f-add0-7a899e54aa49", "value": "T1D9641239766B779FD079B1B65DAEFFAC42F2526584078A6BE81F231836C5380942103F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986065, "uuid": "999f8310-81c4-4c27-8f7a-3dc6ccec355b", "value": "6144:J1jCUYVklKf/STDbILwh4seUp3Op3kfgZzjXLOEDfvMs/clN:J1jH1lKf/STAUh1j+pS2fXiEDvXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690986065, "uuid": "59562cb1-6258-49e0-a2c7-a38d94632450", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690986065, "uuid": "beaefb12-7715-438c-8ff3-ef742c9cfb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690986065, "uuid": "828ba6c7-7ca3-43f8-a83e-e2de4cc673f4", "value": "76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3ae898-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1690964312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964312, "uuid": "b9668f31-97f7-44c1-bc83-6f908517bd03", "comment": "Malware payload (CoinMiner)", "value": "bf2f2ff6aeba535928b65cbfd3890dd3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964312, "uuid": "8f0d3761-5084-4319-91ec-df85c303ce42", "comment": "Malware payload (CoinMiner)", "value": "5c8cda2e3762ca39fdc3479693ec0bb7fe1ab6a8c9d650b699ca63f5c27689c5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964312, "uuid": "a1053714-6166-4a40-9a58-9d93b0b6269d", "comment": "Malware payload (CoinMiner)", "value": "c53534801af64bd6c3e74d33d7a84163271602e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964312, "uuid": "0b86a2a7-df47-446c-bb76-3d299ee725e6", "comment": "Malware payload (CoinMiner)", "value": "ad7d161ccb1a066f3c5314caabe5c2d13746f3d7d98a033d86d3f259e27de87caf86c6e48ac1293a119991fbc1485588", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964312, "uuid": "a5ddff79-747e-4f3c-9b91-f9d6b4aac68f", "value": "T1DFA3494B77A500BBE1768678C8934E05E773B8650760ABAF07A0465A1F233D19D3EFB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964312, "uuid": "f385aede-378e-4a2f-baba-3a1d230316df", "value": "4c7168ff604aae68666e77130d6c4c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964312, "uuid": "ab2f320f-ad1b-46f7-999f-5704997daf42", "value": "3072:EMVz9PYVkoLvIkqUjZdJB8rVYPbwIgtDzy7URPlxu:EMbPYVkockqkZH2/Flxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964312, "uuid": "8825c32e-2654-40e1-8d4a-fd38e54a2e61", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964312, "uuid": "69e6bd42-e9af-4e75-88d5-27c25c13251f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964312, "uuid": "2b3441a9-c763-446e-a179-8df5fb56ee78", "value": "bf2f2ff6aeba535928b65cbfd3890dd3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadfd809-3103-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690960231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960231, "uuid": "3ef3b5c8-7a87-4db8-9f24-e5272d4c649b", "comment": "Malware payload (RemcosRAT)", "value": "790a58bf01ba16bc9ff9f7ea82eed3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960231, "uuid": "7734f18e-cb7f-49e5-9ad1-35b6f37cc198", "comment": "Malware payload (RemcosRAT)", "value": "5d1822386d4442afee85485de8a6d05ce2957cba609b6e34777f372f59f92339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960231, "uuid": "44801059-0cd7-480b-ae0e-31825ff1b661", "comment": "Malware payload (RemcosRAT)", "value": "755b4bab77c582045dfda9ad486dc0f604660579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960231, "uuid": "36362086-0b4f-427c-9211-da0a5a2115d0", "comment": "Malware payload (RemcosRAT)", "value": "55eacf0f4aaf6b0517d406a951d3a4b64662b779d205574bc55440fe8766b4d82570ba95ef510a3df594a211858230e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960231, "uuid": "3594f1b7-664e-4865-9cc1-e172fa5100d1", "value": "T1E7254B0432E16EA1EC6D73F5287A244403F0ACAB5532C35ECDE235EBA7787978D89587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960231, "uuid": "4d4193ea-da3b-429e-9164-350c3eb2d0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960231, "uuid": "55afb5f0-4a9f-4546-b26f-42f38aec56bb", "value": "24576:yeFmHxc1CQx7y0Xa4lRTI53zCkQi2ms0:e6RRU5DdKj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960231, "uuid": "14f15836-c173-4b27-bb2c-15a86418b51e", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960231, "uuid": "f103a675-6ddc-4f60-80bb-e87ae9091c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960231, "uuid": "ecd3f73a-5033-43b5-ac13-04033f040459", "value": "RFQInvoice302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc4c217-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1690967407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967407, "uuid": "465b410a-e36e-4823-ad06-d958e085d916", "comment": "Malware payload (DarkTortilla)", "value": "44c600636abcf1a605c30b2740f81fda", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967407, "uuid": "2745360a-2129-4a5d-8b8d-d0acaa15cf66", "comment": "Malware payload (DarkTortilla)", "value": "5d95c10e8122a51e32257074a96464232e99923864532e6b6c4d2b245a7a852f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967407, "uuid": "8e0ef59a-4b8b-4b3c-b7a9-1a72c98aad30", "comment": "Malware payload (DarkTortilla)", "value": "6b6788f45129d2d065de2f157e73b15b9bd204e9", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967407, "uuid": "7efecbba-cfdd-40da-8e54-ba2e94788d60", "comment": "Malware payload (DarkTortilla)", "value": "82b7f7b1b0266d3a3dcfb9b5b673d177686b5bc171b827967a4a2986a06e8bf81debf167e98d9ed1b6901135d994eaff", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967407, "uuid": "b9dc2d65-74ab-41a4-93c3-49d1dad3eb3d", "value": "T16E65E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967407, "uuid": "9ff3096e-7eb7-4b53-8d7b-346efd12e802", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967407, "uuid": "824ebd2b-6f4e-4c61-913c-d43da5cc0770", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967407, "uuid": "4fcdd85a-8d62-4fa7-9b06-5a3a3264bf89", "value": 1437044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967407, "uuid": "26a50701-91af-405d-9782-efe3243685ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967407, "uuid": "7b2f1cb1-25cc-420f-8266-52c3e50e5335", "value": "44c600636abcf1a605c30b2740f81fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e960259-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998812, "uuid": "6001ad8b-c545-4589-a3f3-5636eba29fb9", "comment": "Malware payload", "value": "c115bb7a5a9badae8d584241ef378d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998812, "uuid": "868f496b-9655-4818-93c9-690a2d13e7a4", "comment": "Malware payload", "value": "610f3aba3b858e63e88c9f3faa2e4958756881213e85257e7656179fc4e1adf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998812, "uuid": "39a2a084-9c09-4da5-9b87-528e21d70b46", "comment": "Malware payload", "value": "e4202f7a0e24a6d56c0cc515b0655c6ce9ae2fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998812, "uuid": "edc8bac0-c282-4fdf-8744-93d39631fa61", "comment": "Malware payload", "value": "3accec8711b922df2cdc40b5d3fc12f289d98080ea382604b5282c18e0983a028dbb71be51bfc28c963e9466f3359b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998812, "uuid": "1da984a5-ef79-4bba-88d8-c46f6bb517c2", "value": "T1B8C52352B685ED27C80C12354C0B96CA6B70BD165E5363237758371FAFB73C2FA0668A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998812, "uuid": "77885136-63bb-423b-9fdd-5518973c3e8c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998812, "uuid": "189e9401-55b4-49bb-bcef-bc45441e62c7", "value": "49152:+aWn5ZHQRdEuYf+r932bPmGKam8HZo2VH7VPy0Jr:xOZHQRdERf+rt2rmG/ny6hac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998812, "uuid": "f67cd416-299f-42d7-a8a0-bfa3482306ab", "value": 2588246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998812, "uuid": "eda0dd37-a544-413c-9ea2-796afb0906dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998812, "uuid": "4081d870-74cc-45e8-8bd8-cd2fcccf28cf", "value": "c115bb7a5a9badae8d584241ef378d10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b169bfb4-3156-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690995890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995890, "uuid": "10c7e526-0ff6-44e2-90ce-19b8c6700f39", "comment": "Malware payload (GuLoader)", "value": "398168319933805c70238c679be79bdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995890, "uuid": "68ab38c8-37ad-4ce9-ad66-1e86ce908065", "comment": "Malware payload (GuLoader)", "value": "617edc0de1e77f1822ef3e93986f705758ba7ee38b59725d01cf6cabd5d98ef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995890, "uuid": "b652a78a-510d-43b9-a10c-a86c46d5a816", "comment": "Malware payload (GuLoader)", "value": "8e42c9f4283d9544b63b77fe886abcffea2efe14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995890, "uuid": "805917d9-c8eb-4e23-8d51-a7406cf7dece", "comment": "Malware payload (GuLoader)", "value": "d4a22a9d49afdb0f83fd26c8b7467ac32ab0c21ea3ef85227ffba736cad89837e5a9a86a6bc828592bb8b81d9a682d70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995890, "uuid": "7d38234f-719d-4960-8f6e-7e939013068c", "value": "T10B6401551587947FDC416B70AA3FD265E6FFBE40BD12B2EB13180A63883C4FE9A062C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995890, "uuid": "74d2b14d-9c81-45a9-ba43-4b0a7920137a", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995890, "uuid": "58f84240-1b3b-4ee2-b38d-029da17240e5", "value": "6144:jBe4i9+vu/x+TjVA0uIfeDcGyguqfWrUU4aeZk7v1jEoTEvFGCNE:7i9nuxuI2DhuGsf8W7Nj/EvFlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690995890, "uuid": "b6060eb1-145c-4ea9-a47c-dacffe00e67e", "value": 331448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690995890, "uuid": "87bdf1de-fe3e-43c6-95a3-99a983f0382b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995890, "uuid": "4fc73b1a-257f-49d1-9f9c-e317c44ddc90", "value": "398168319933805c70238c679be79bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a00334e-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690970269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970269, "uuid": "7c02282d-ee9c-4b8c-acde-0176e7f71b2b", "comment": "Malware payload (Gafgyt)", "value": "65407e5cb246a1f4c5f7a78693705352", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970269, "uuid": "febe9713-db6a-4eb5-9fff-b04a1c370aae", "comment": "Malware payload (Gafgyt)", "value": "61b1a18506cc9a60e8babd11fd2bc1ef940064ad5d5e92fdbf6d2078c8fbdf4d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970269, "uuid": "2e4e406b-876f-40fa-a53d-076594a227c6", "comment": "Malware payload (Gafgyt)", "value": "97658fb3c6002db1ac95aa8da4e41201f0ac1bc3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970269, "uuid": "caf9b52d-1fea-4e77-8f2c-493beb26d469", "comment": "Malware payload (Gafgyt)", "value": "601c018db17c09a1c6c3126916d87f39a6b14f69d30aa014d483bfda935b3e6b275d0b844cb0d1c22a209bea6a140be5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970269, "uuid": "fbd70ace-4937-4a03-bf96-e8eb767f4c4f", "value": "T132D3291775D1D4FDC8E9D5B44F9AA13ADA72B02C1238B16B27C4AE272E8EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970269, "uuid": "1943965a-e6ae-43fc-ba3d-2126730776e0", "value": "3072:PntX5NE6wQ4sjiuaogvXpmQXx5pMV9FFE:PntXaWCXZW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970269, "uuid": "451a2416-b28d-4687-bcf8-a7e042b6c645", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970269, "uuid": "41f06e60-8f4a-437b-95f4-9929ed19146b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970269, "uuid": "caed9d22-5206-40d9-9ee6-aebe2427b84b", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da28e9d-3164-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691001682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001682, "uuid": "373bdcb1-ab0c-4bd4-ab32-e4bef0004e03", "comment": "Malware payload", "value": "8e285d434922e63d303da4e3639fe13c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001682, "uuid": "48b371e3-c8e2-4ae6-860a-d39ccd240f90", "comment": "Malware payload", "value": "61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001682, "uuid": "69d21bb4-84ec-47b3-a10d-5aacb0256f1d", "comment": "Malware payload", "value": "9c9abd13fbc6bb81d4fa17ffa7c2be6dba81c5f5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691001682, "uuid": "f2bd27fd-cc7a-446e-b654-29d26ffbf27a", "comment": "Malware payload", "value": "63923008e84a010888043ce5e8857a9d4400b88865ed480c6acf7406b15fb93ff647b321d923dffe0fd373dfd8ef7aba", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001682, "uuid": "50c3ee43-0153-4f91-bdd5-8382eb5bb364", "value": "T13AB412242B70C3E6F2515E3580D911A368FCBA11AB38B3B7B2456AFB84D223667CD553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001682, "uuid": "89ad6d62-dd62-44ac-a57d-1a050e2af639", "value": "12288:Ut2vNqiSAH/EZ6w7Ns7fZdQrQY1jm5Uy8+xYRi/DWTbAr8dBXim7PHT:UtCNuE/hwxcfZsn7y8+3SAgjig/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691001682, "uuid": "2da797b2-e4dc-46c5-bedb-4dacc02ed6c7", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691001682, "uuid": "fb3c1256-9f9c-4f58-8d8a-3e5f2233b8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691001682, "uuid": "ff9c2548-f544-43a8-884a-eec2c1c72850", "value": "8e285d434922e63d303da4e3639fe13c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d67ca5-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966185, "uuid": "39b91dee-4aa2-4088-8770-457882e3c69c", "comment": "Malware payload (AgentTesla)", "value": "6b86fd4dc925c22ac9cf134fb525b3d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966185, "uuid": "1c24dc22-2e91-43b5-adde-0c020d1aa573", "comment": "Malware payload (AgentTesla)", "value": "62627ff53c8fb5e46571d1c7899dd0e0ad8bb37225d57a6be2d3a9a882d5fae2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966185, "uuid": "81e40bd6-f667-4019-880a-3c7adb5ce4d6", "comment": "Malware payload (AgentTesla)", "value": "23f2c7c225bd33eeb696910e89981afef4a066a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966185, "uuid": "6a0763a4-f29b-49b4-949a-de8e4e82bc8c", "comment": "Malware payload (AgentTesla)", "value": "16e35ffdedd55f339e9fc3cbc0855daa17e3742e46610250ea61ac7a191837af65e7e6e67a4536cfb4cedd0f5e5a1096", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966185, "uuid": "5ce96b02-0be4-4e68-9052-e009aacd4030", "value": "T1FFE43305EDB7407CEBD9E71D03BB00F2E72B73CA6E858509763829C1AC1919EA4A471F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966185, "uuid": "6016c498-ec88-4140-9a5a-bcb9a59ff7a1", "value": "12288:ce+6ifPQqUFC2kKIcgp3TZdwDN+zbaz3FIwXFojPHhB0E38/pa3Wp:ce+6wIlFw4gpVGZ+z23FPX+oyUa3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966185, "uuid": "2b7174bf-0aa0-48ef-ae2d-1907a263f4f5", "value": 710838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966185, "uuid": "01a806eb-d714-43af-9324-7fe71a5554cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966185, "uuid": "154f041f-13fb-4573-a298-c05ca2a304db", "value": "#cotizaci\u00f3n#especificaciones.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c64f4c1-30ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690958489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958489, "uuid": "8567b82c-c26d-436d-853a-1a9089ea6e20", "comment": "Malware payload (Formbook)", "value": "0db908ce62f0271f51ba08606a2c28d5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958489, "uuid": "ef963990-3627-4468-9edd-a036d0cfd4fc", "comment": "Malware payload (Formbook)", "value": "62ec177e08ca9b24a568a73d63206dccd492c9a754202bbffe80b91f4277ac69", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958489, "uuid": "d79802d6-4199-4e88-a2a3-134188b7c06a", "comment": "Malware payload (Formbook)", "value": "c84b80af6b633ef07c622872684e4e2193ce3aa7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958489, "uuid": "495f1ca9-cb54-467e-ad99-68bbb25422d0", "comment": "Malware payload (Formbook)", "value": "a0fef46cb01d9e3da96d39d46abb9b58ecadb23e3ab16e20aee639877fc66bed77b44f32fa98e233c13ddfbd83edc25f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958489, "uuid": "8a6950ae-ab53-4ad5-9961-49407ee6ebbe", "value": "T1AE34235DA3264A2990E03051061F44E7FEE6A4A75CBFDDFFDD22096491B270F48B7A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958489, "uuid": "45c02519-2366-4557-ad21-94f25b5c9386", "value": "6144:Vdr+v5w8uhDYG6Q4sEEVeumxd03OK3jawnDQsvcU2lwm0YpL9:W2qEP+u3OKz1DQskU2lxDpL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958489, "uuid": "eb4a40ca-9114-418d-b941-4178cf42571d", "value": 239355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958489, "uuid": "cc77689a-71b1-4c5d-9f92-4f310b153e64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958489, "uuid": "2bbfc012-d129-4a85-8d1f-45ee173c9d8c", "value": "SOA MAR-AUG 2023 PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb1fcbd-3139-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690983189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983189, "uuid": "c7ba36e7-77a7-4246-89ec-fc9d8bf03a1d", "comment": "Malware payload (GuLoader)", "value": "d4d886c2a26c7a0a2100dbbfaf7bd753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983189, "uuid": "4d1c6602-228c-401b-a3dd-b6609b73b802", "comment": "Malware payload (GuLoader)", "value": "62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983189, "uuid": "b1dfb3da-9dc2-4776-9b8b-258da29cb1d3", "comment": "Malware payload (GuLoader)", "value": "344927ad5d62cc6e27d5011bde0cd8209e5d7399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983189, "uuid": "22f74b78-7a12-4e29-a29e-f538c30213c0", "comment": "Malware payload (GuLoader)", "value": "b57834933c858cced896a09c4e66c420d5d080d5d887e3b905df9c50ff4cfb0f2d9f0ff0205f789e739b14bf56ba285a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983189, "uuid": "1e0bd8df-d238-4658-8e96-05b008bd37ba", "value": "T164750214246181C7F59ADF34F36AEAF147144632A4B3127A38BA597D8CF2F01BF291E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983189, "uuid": "423a1337-e402-47de-9034-30b077f170fe", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983189, "uuid": "8b09864a-c1b4-4fb5-8337-ce284288e021", "value": "24576:xy8I5+eb8yxWHy9+9tLFOsh2SwVgCuFAN2XyWjTmhdSxZycFfazuToXmJJRK/F5i:Lhruri5XyGugHB6mw7zLDwWKMkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690983189, "uuid": "e93ecbd0-ad2c-4298-ae9e-e71b8757437d", "value": 1575992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690983189, "uuid": "7c63676f-ebee-4247-b7b2-e6650ff7739b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983189, "uuid": "d010e07b-950e-4c49-84a1-5965646b4d45", "value": "RFQ from ITP Aero - 202308 Rev. 140502231\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611ee2c3-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1690966120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966120, "uuid": "9a12c656-8789-4a5e-b158-55b6771d76f5", "comment": "Malware payload (STRRAT)", "value": "f66a1cc277f6fc73f6fbb3983fd4507b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966120, "uuid": "a504d5f9-a87e-4fcd-ab55-bc328c3c0359", "comment": "Malware payload (STRRAT)", "value": "630677c95d018769c89fe2deafc2e7663067d8422d6d0f7f8d88cf72328ed7bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966120, "uuid": "55dbd876-b1d8-44e7-b1f5-89485a13171d", "comment": "Malware payload (STRRAT)", "value": "61c4d4b2edd9fd2b402eac34991948575f738cbd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966120, "uuid": "c38ca6c3-9337-43d0-8b5a-a5593c6b43c2", "comment": "Malware payload (STRRAT)", "value": "077091a7376801471a3cbde02ac442fdbe09f1ee090f7762cf80b4f749a0767f6fa92f32482ea2c1c2ff55c37f40515e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966120, "uuid": "d5c42233-8ed0-4971-99e6-25f244549daf", "value": "T1A474AEC495A29617C9BFE127C8A9B1174EB3C60A1D472CAADB697FCD7A625CF01001FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966120, "uuid": "d8a9c8c2-0508-4277-846b-c36812a8ed1d", "value": "6144:0fTRbUGCqphGThQ2iAnWHkVtIfLRKnucmRgAEZwPRXkrU+CE4hyh:QTSAphjwVtIDRKkRzEqPZp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966120, "uuid": "3c0fcbbe-466f-4868-bad4-65078b3ac609", "value": 348402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966120, "uuid": "282e8a7c-ced1-4a58-abaf-7262be7479d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966120, "uuid": "cd86c956-3452-4a51-b3b2-486945ee4282", "value": "Camscanner 34569787.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab613571-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690964097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964097, "uuid": "19f7a570-6ec7-44d5-adbd-51ccb98b0f12", "comment": "Malware payload (RedLineStealer)", "value": "1a38adb3da5556462715943aff7c84e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964097, "uuid": "d5a60032-aa79-48e6-b2ed-8dfb8b4ad318", "comment": "Malware payload (RedLineStealer)", "value": "65ce7ff06b911ad563fedfcc65b69e3734b00f16d5984a5eac1e10422843e5ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964097, "uuid": "e308e9b8-0827-414e-a8dd-ae4ec508938c", "comment": "Malware payload (RedLineStealer)", "value": "9ab28ea45379168244c5afed1f65f05c4ba40c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964097, "uuid": "106c68ac-9b87-4603-97f1-e39c7111e1de", "comment": "Malware payload (RedLineStealer)", "value": "2dfce69834ab1bc1d3a82f267ddbe54556b3ae8fae8724a3960a96dec927679f685512d0efd2f8090f7ad7e7ac2bc49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964097, "uuid": "cca8d415-a795-47c5-9336-3856b068e41f", "value": "T1A7C5BE3179C18176EDF330B686ECF63686ADE4B0072905CB0AD85BEED7606C16F32596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964097, "uuid": "bdd3db45-cceb-450d-b460-c9b408178422", "value": "e36b2dfa63d47a142f46b2643f4cab93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964097, "uuid": "89bc3c90-fbe1-42d0-b6f7-db6be8e77334", "value": "12288:hwiWirg7RQZRtGwPKLB/iKyZOuJsURwd42MeDVBwNuzua3Q0FFNdpfQ0:hwVRQZRMwPKLB/+w4hkVnISJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964097, "uuid": "64abdfc4-8159-4f08-8f6d-0f497cda3d0f", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964097, "uuid": "fc387b03-b5a6-49d0-8d53-076dd4c128cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964097, "uuid": "e1719c64-adce-4d44-9043-68e79124934a", "value": "1a38adb3da5556462715943aff7c84e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d00f8bb-3148-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690989655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989655, "uuid": "b00d96a9-6059-4d84-9b85-098a602c0d6c", "comment": "Malware payload (GuLoader)", "value": "fda4b83956f9435b483e7f7e8de80f4a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989655, "uuid": "795822ff-59a1-464a-8808-bda73e476cd7", "comment": "Malware payload (GuLoader)", "value": "66f77b6ae2f664a173391e4fd15b04e18f992016a56b2d0fdbd27e8003ef72d1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989655, "uuid": "928f9142-7280-4e53-9398-2257cf3b30fd", "comment": "Malware payload (GuLoader)", "value": "56fba4edcaa8532a946b59c6964178ee3e659d9e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989655, "uuid": "9c56f809-d791-4763-b149-b1db76ea1b39", "comment": "Malware payload (GuLoader)", "value": "e6104342365c7e1c81a30ab234993dee96ee2f4b8bb5fe687a3e1516348974d51522b0b29a7bbb05571c61512276a953", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989655, "uuid": "79758c19-c9c0-4fc8-9649-01e8720791c5", "value": "T1EC0533C48DCBB1E0C3CD34219F57B22860ACF90ACE57777A787948A99B93249C4DC399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989655, "uuid": "30cd28a2-bad4-4f1f-b2d7-4647382eafd2", "value": "24576:t1dVtZuSTO18wHm7fxvY6KOkZ1Az25vG8:x/u1EtpbUU25vG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690989655, "uuid": "10629ce8-c64e-410e-b51a-4a2e611886b1", "value": 841907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690989655, "uuid": "d7b52fd9-2a7e-4f72-80d5-848b93a953a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989655, "uuid": "7d65999d-9c11-4516-9f74-d31698b3c635", "value": "Karine Petakchyan_cn23_9472851349.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b28cd4-3122-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690973267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973267, "uuid": "91c1bc48-fb96-4e3f-91c4-9105c95a4cb5", "comment": "Malware payload (Mirai)", "value": "fc1b79a803952b9dfb2deba17e2b5012", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973267, "uuid": "ac27e6ae-a265-484f-bb1d-4833922fb1ce", "comment": "Malware payload (Mirai)", "value": "67ede50a6efeb5ccd525c9d990d97899092001b03d3d445a7a0e776dbf3e242e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973267, "uuid": "4dd65827-d0c2-4915-8b47-469f094fb6f1", "comment": "Malware payload (Mirai)", "value": "43f99b105ad9aa8de50f2c331a5c24460edbf040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973267, "uuid": "a47ca0d5-e668-4ee5-bbee-4c7c7df2b33b", "comment": "Malware payload (Mirai)", "value": "83986f7ef49bfca03f41c8d400e007fe95972c7accf239311ab363ffa7ec87fc015657063c9f46112468d009c47d75c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973267, "uuid": "50b9a164-7d36-4d13-b456-7ff824b71765", "value": "T15CD308C7F900DAFAF80AE33748630805B130BBA145925E372267357BED3A1D91577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973267, "uuid": "cf2935bc-8b0c-4a71-9892-8f2a53f0d2aa", "value": "3072:qiWLmtB7iCKE+HHQPAF5H3N6VrjbieLSRz0vyb7z4:fW5FHSAT3NILSRuybP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690973267, "uuid": "7697d650-7ff4-4d9d-8298-993509bea641", "value": 140448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690973267, "uuid": "fd7be32d-49d2-4269-836c-e1a1236ff2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973267, "uuid": "0f0f1c71-563e-4ed1-b6e3-2c805e81a1bb", "value": "fc1b79a803952b9dfb2deba17e2b5012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159bb14f-3151-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690993481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993481, "uuid": "9f8dabd6-d328-4fb8-92ba-626ab9ec9d62", "comment": "Malware payload", "value": "610b70e2ae23277732686f841b32c6c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993481, "uuid": "8051bd7e-ad07-4beb-9b29-3ec709beb256", "comment": "Malware payload", "value": "680d70454237c83813d80e8737ac8da953f9ba6273f4f8b2a30913d299adc583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993481, "uuid": "0f4e6ac2-e2b3-4b47-9434-93d4816b5ed2", "comment": "Malware payload", "value": "9cd759dd1a6475c6ac8c0c30b06c55e5b4cddbc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993481, "uuid": "33967a82-b1dc-448b-845b-a8a98487bdcc", "comment": "Malware payload", "value": "4e598c466f71dc5842dca139d6bb15c6f1a93caf4c4c594f03741b20f53bdee8f4098301d340fcf32a02a76703bdc62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993481, "uuid": "b59a9e74-c6b2-466a-8292-9eb2914db044", "value": "T14295DF03FF528406D15E007ACC3A6A9E64152E6D6801F9D377DA7F6F19F2743A86A30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993481, "uuid": "63175675-9b6f-442d-8461-e5d90a04b380", "value": "7f13baf4188aebcc322a567e9b8e195c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993481, "uuid": "1f77b189-c905-43b3-a796-3fcb40a9786f", "value": "24576:bVg0iyg9EMng9nXH0NCKQj+E0x7Bk2tFUiR+MahMrMGZgjuaw4/roH1S0tP:bVgGDB+jVnULX6NS/8VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690993481, "uuid": "7ee16af9-3008-4e00-b1bb-be9ab8c077d8", "value": 1880915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690993481, "uuid": "7d1ef85c-04f5-4a65-b119-987f734810cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993481, "uuid": "d89606b6-59a8-45aa-96c7-305e5ed13f70", "value": "7206931256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaeb3d6-3135-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690981679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981679, "uuid": "023388d9-55e7-4728-885e-f247d81eda70", "comment": "Malware payload (AveMariaRAT)", "value": "1ed1a3c75c699312d7ecffaf02f7cfb8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981679, "uuid": "12705796-b633-4dbc-8985-f82eae273bcf", "comment": "Malware payload (AveMariaRAT)", "value": "685d3ec37bf67fece0e5e5ff4fafb0087e5d24d2a1371180c8f3294cbf9482a8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981679, "uuid": "1d90ecfa-2f38-4e7e-814a-9ac736985bfa", "comment": "Malware payload (AveMariaRAT)", "value": "a025c19c044dc0c8d67653de67db501ab6b1f843", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981679, "uuid": "a76bffa6-3c62-4088-b9ca-118dd6c6d0c2", "comment": "Malware payload (AveMariaRAT)", "value": "316c28b3ddaa5fcfa25d710a3d6a15c26778d02f90276aadc2f7699cc74bd59d20f59baec2e7aa94d9908aecab8f65d7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981679, "uuid": "a69bcd3d-6aab-44f5-a73f-353cdd693dbf", "value": "T13F236A6DC34F0199CF62527B9B2A1A4542FCBB3EF28552A1346C437933EEC2D61252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981679, "uuid": "b8663794-c1bd-4a26-808a-3e3f46dd04b4", "value": "768:1wAbZSibMX9gRWjnyjEPuzwQPFAUcpmADU:1wAlRGyjEWESFAUcpmADU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690981679, "uuid": "a022667f-5d15-4fd6-9300-fc00af5a734f", "value": 46201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690981679, "uuid": "398c0f3a-49e3-43f0-89c6-a292f33361b8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981679, "uuid": "4b897ebb-be81-416b-a858-5df7b3c03f3a", "value": "1ed1a3c75c699312d7ecffaf02f7cfb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e04aae6-3122-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690973282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973282, "uuid": "5e2c7ebe-5ea0-486d-b983-27764de11836", "comment": "Malware payload (Mirai)", "value": "86edeba317de377cf5567db5c6a3ebda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973282, "uuid": "abf21689-c01c-44a5-b651-54f6cf863c45", "comment": "Malware payload (Mirai)", "value": "68aa461988773e6c35fa86a6a6f03e52dd18599c592989a281ee9f44235ccd49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973282, "uuid": "90356f38-6ddb-472a-a5f3-f28f95a7051a", "comment": "Malware payload (Mirai)", "value": "58e81dc5a2e349b7a7f532a402160d2f6d13864b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973282, "uuid": "00256cd4-cbd9-4554-b58b-c0b4ccbcd166", "comment": "Malware payload (Mirai)", "value": "b708dee18d719edd0d77f3704e7b487d3160054fe28618b566e729f35f374453d2393c4c3a24950c8fb5c178dc57b516", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973282, "uuid": "a913bd5b-0123-46d5-9e02-55aa3d394381", "value": "T161B35C73CC256F68D665E1B4B0B08F796BA3A950818B1FBE1567C3758043D8DF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973282, "uuid": "3fdb18f3-bd30-4272-b0d6-9f8f1167658f", "value": "1536:Ea0UAv6DAEAiKeCrKuRVdO0al/qq1WyHSqZntZb:E92AbiKePudalh1W+SqTZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690973282, "uuid": "548e8222-67d4-4dcc-a0a3-66ff07aef9a8", "value": 109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690973282, "uuid": "e4f31d39-7ec5-4849-85d8-200f89d7efa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973282, "uuid": "8a672f8e-7350-4bc3-9e99-ba3c67c11a7f", "value": "86edeba317de377cf5567db5c6a3ebda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71459cff-3121-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690973019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973019, "uuid": "8522d78c-1355-4da7-b27c-c9184c331f8b", "comment": "Malware payload", "value": "cc74cf81f442e922b077f6cf0f87fa41", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973019, "uuid": "f5042fae-efd4-4ad5-99a5-c4a351c5884e", "comment": "Malware payload", "value": "6a58399a333e0b20e9fe1944ee997585a7a1927776308048da1e3fb7734ef581", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973019, "uuid": "5ea26fca-ddf3-482a-b84a-a34ee9f439e2", "comment": "Malware payload", "value": "d8be8fcb85507d5b05a3025bb0cefbd0b614de96", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973019, "uuid": "e1ecc4e0-d812-4524-bb17-c633ab3e16c8", "comment": "Malware payload", "value": "9ce0e0550ab1f4a0c7cef385f2f36f44498f43634e257786450939987f7e5634fba31374c71f44cb9d1b58f2e72811e4", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973019, "uuid": "8a3f7943-72b3-4dfb-ab5e-602f18e5db5d", "value": "T1ED41E1BE761A550A54EE46D1F242C466F11EF402C54CC688A68AA47F53A4CCD739F4C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973019, "uuid": "0dc7aab2-f0c4-4c86-a46b-3a6ac4fefa95", "value": "24:VzNEa7DDmcKEK88leevTwKev5NaczevNDB4HK:Vz/7DPKEK8852Xt6NQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690973019, "uuid": "e3777a1e-5e23-41a6-a2bc-a223bff172ee", "value": 1908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690973019, "uuid": "57449913-a17f-4d4a-a928-b9bc3a0890f6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973019, "uuid": "8193759b-95ee-4eac-8b85-272ad3c330b9", "value": "11.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3004136-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998121, "uuid": "a7fdb9b0-40c6-42ec-8dd2-468a2acccbb2", "comment": "Malware payload", "value": "07851ba7cd87085f650755e234b91779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998121, "uuid": "46bc3210-1ba6-42a8-a081-9fd91476bdf3", "comment": "Malware payload", "value": "6b546799b8e97db7d2af60c7fe881c1c8ad95f1546ae53194af236872d3f8423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998121, "uuid": "e10fad7b-6123-46b7-9927-69a2e9ba1034", "comment": "Malware payload", "value": "6c5aeaa5ab849dc284371449ebad8bc0c39cc3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998121, "uuid": "7fe0093b-00d1-4a32-9d20-0115f3e3a8d6", "comment": "Malware payload", "value": "4ba96e215d28051ae2e91298c6407c34c343191245d711b43b4d9a7cc7bc68d355da3be62c0b948e4890bf213221ddf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998121, "uuid": "166ffb1e-a5b0-47a0-9015-ca56fcc6537f", "value": "T1DA063362FEE9775CFE0BC4B044AA2CF2A00D35DA96416BBCDAC690C7CC18695F790647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998121, "uuid": "a41716f9-2624-4a79-bc51-d66154e465b7", "value": "0c8577e027fc230dde84df1108d9f5f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998121, "uuid": "3366327b-42df-470b-98cf-d9646ff0b95a", "value": "49152:py3yFl4CUg/0khltFqcKkVNxNDYW0GqG1eUumGLpehMT85erI:pJkkHtY58YrGr+chHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998121, "uuid": "bc345b42-babc-428f-829c-a64a1b76e464", "value": 3738112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998121, "uuid": "749b20c8-2d3e-4496-83ba-aa060c27349e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998121, "uuid": "4fe6c7e5-f4cb-4b9c-92d7-aaa954ecb153", "value": "07851ba7cd87085f650755e234b91779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0249ab8-315a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690997687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997687, "uuid": "e282a069-2c66-47ed-b788-6b162d0423fa", "comment": "Malware payload", "value": "887c0911835ace94104d8c570632409a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997687, "uuid": "4a8dead3-1087-423e-8676-6e514a0f476f", "comment": "Malware payload", "value": "6c54458a3df80f3801df48d60cbafaa64b643f155bdd608140ef508134d52d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997687, "uuid": "24ab2fe1-3a18-458f-9492-15954e6ae11b", "comment": "Malware payload", "value": "3192b8b83d62a44b22dbdd9f627fde49d16e5350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997687, "uuid": "9ec5f3ca-065c-4191-a52a-742a3b85419e", "comment": "Malware payload", "value": "397247a5321de110228475c8b30299b804c3bd6a22deefe7692368892c000b3f420b7e2729aff64f8f912f3ade5d4a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997687, "uuid": "55bb3b8a-247a-42e4-b4cc-844ef34ad300", "value": "T1E796334D3ABB9222EF684C36ABCB545DED5C5D00538857540C89C3BFB098CBB58D27EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997687, "uuid": "c5dc4038-5b14-4054-ad38-805023bc2952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997687, "uuid": "d056cca3-19d7-4773-923a-5130bde22c8e", "value": "196608:4Z1+0PfiEOE6NJ8Jkt9KCS1r8ek//fCc3NbFmQLG:4Z1PSEz6GkLS1r8ek/CH4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997687, "uuid": "bcd94619-d80e-4300-8370-ff44b2f7241c", "value": 9381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997687, "uuid": "4ff3a8a1-490d-4114-8398-ccb8511018a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997687, "uuid": "6b8ef133-6067-4ebc-991c-6a87e2c0a611", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd10de-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690958052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958052, "uuid": "3a3403b2-4d17-4f00-a2d0-6200a3188ffb", "comment": "Malware payload (GuLoader)", "value": "07bcc852f4904166b509c3f48c461e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958052, "uuid": "7cf0843d-7a9f-42a3-bd59-30412dec2fd5", "comment": "Malware payload (GuLoader)", "value": "6d0f296869dd412ce3a96734eca75411e643583995138f4f057bf82334fdffb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958052, "uuid": "0de31e38-a738-448c-8086-8335e547eb07", "comment": "Malware payload (GuLoader)", "value": "cb7dcac3587f90e055a76f49e393394efbcddab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958052, "uuid": "2e1a91ae-c8ee-4cfa-875b-6027564f0e4d", "comment": "Malware payload (GuLoader)", "value": "35ce7418887d4a50fc71a9333c65e191785cb5d16c1a1b33072f572aa10f3cb4d8abf959e4af89fd6375409ceee2eca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958052, "uuid": "4dd27300-d094-46b9-838b-c04f26199d03", "value": "T15625F146726160CBE8235876C941A5A0ED51EC23671099F391A0FF3EFBF51D28E22B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958052, "uuid": "84f72337-a37e-41bb-b1e8-9af712966a23", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958052, "uuid": "c4808510-a4d1-4a95-b87c-11ea3662c593", "value": "12288:DsuK7FfsQ4nyEZyH9xNyvf/gB6ZOlCFtQ3/G0z1g+YqwBVifc4vNzY+iEi7d1zKr:Ds/55wUAf/66ZJPggw849YvzWcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958052, "uuid": "4cc1d416-6953-45bc-b70c-d1fbd17bad35", "value": 985232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958052, "uuid": "11df1870-8898-4ae6-b4f0-e7bf303a5a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958052, "uuid": "08fbcbfe-563d-4ab3-b5a8-3efcc678d3d8", "value": "FV-112-01 \u10d0\u10d1\u10e3\u10da\u10d0\u10eb\u10d8\u10e1 N33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0c5612-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690966056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966056, "uuid": "a2172b74-3a5b-4fb2-b9b9-42c1bdec9180", "comment": "Malware payload (GuLoader)", "value": "d7ffa2f0230caaa0ef7834fdbfdc1467", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966056, "uuid": "fd021eaa-9c4d-49f2-a9ae-494c849b5173", "comment": "Malware payload (GuLoader)", "value": "6d641a102305c0a62467fdf0197ff548473edf090d07c0c3faa3f1f9ea10c760", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966056, "uuid": "42bc4e3f-69b0-489c-8394-8661f992ab58", "comment": "Malware payload (GuLoader)", "value": "43c9a03ad4268e89fb22e57969ea912efcdbb1fa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966056, "uuid": "ac41811f-a478-4ca4-94d0-07b8491a10ab", "comment": "Malware payload (GuLoader)", "value": "daaa29690a0656ed77ed0271ad029ae4d78462e4af495bdee10da370f1783df7533c20d6008c73742db0362c09a63f02", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966056, "uuid": "b9dd91e0-b23d-4ac5-b27c-f5d68a811e27", "value": "T18D850103D8048B86D50C83F87E533DD94A0D7F2AB4DA7DDB06527F9B3A32A67492A50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966056, "uuid": "31317187-37ff-45bc-b0e4-4ebf05fc8355", "value": "49152:0QmmQ30Tupp6VLQmmQ3085n6VkiNhv3tBUXDnHgk6EDS:0pmQkTamLpmQkomkMhKDl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966056, "uuid": "e3d4b1b4-6a52-4ee0-a21d-e9f9e4ba7eed", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966056, "uuid": "84d806df-8d6b-4797-8ce3-ef0982cbd32d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966056, "uuid": "a13ff597-2c62-475f-88fb-0535d2fbe66d", "value": "Draft Purchase Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520e8d31-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690967384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967384, "uuid": "63946c81-6608-45c2-8c93-491677b1d608", "comment": "Malware payload (GCleaner)", "value": "654b2bbb6e3c90abb4f3ab9bd2f2bdbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967384, "uuid": "6ae6beb8-3a22-4d94-9c70-9806c5c41d61", "comment": "Malware payload (GCleaner)", "value": "6d6c82dfc506972c65fca56d5f836ed9fb2be714fd0d15da7ea942cc3cf78956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967384, "uuid": "ba396bd4-266a-4ff2-b2a4-c9ac7e77946c", "comment": "Malware payload (GCleaner)", "value": "65f0f172d8721d37ee1bf8d2b9aa445a83a69d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967384, "uuid": "25c61aab-458a-451b-9cbf-259e891e8c3b", "comment": "Malware payload (GCleaner)", "value": "b05290edadac7cb650cada72607a5be1f81c182e2b9c64fabb439637e26a502e95b4786be649f06664ddad16e4059c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967384, "uuid": "e1f44a6a-83a4-4e84-a707-1cae767e4525", "value": "T1175533C2958AD0B6D171FAB59378C8168B717B1428B9FC5036FCCB2D4F7B0C6981A29D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967384, "uuid": "46b0cb74-2ed9-43f0-b8c6-b0fc9d645566", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967384, "uuid": "0946d224-3d7d-4245-b10b-5c6e9dcd274a", "value": "24576:D2l6kdNFaLPdAHi+VEtBqLerNzeTay5xsVArl2O/DIK6vhU8G2dTbMh9GxanV:D28wXE6Hi2EvqarNzeGy5xxlHDdIbMhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967384, "uuid": "eed81229-570b-4878-86e6-82e179e04c45", "value": 1370516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967384, "uuid": "1909c0c0-4789-44b4-865b-9d11b83c0f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967384, "uuid": "3edfdfb4-fa78-4214-8b56-15e505dd3624", "value": "654b2bbb6e3c90abb4f3ab9bd2f2bdbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa873bc-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690957305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957305, "uuid": "ac043343-5436-437a-bc3d-43514d3c57fc", "comment": "Malware payload (AgentTesla)", "value": "c5b024dbaa29197b1860cab2b30f46f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957305, "uuid": "62d57820-cb5e-4e9e-9dd6-d8ac79234904", "comment": "Malware payload (AgentTesla)", "value": "6f05b19dfb413188d1064eefa18ffecebfa89ff3951c3d0c8a5e864e420346ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957305, "uuid": "3a3f9658-98eb-4cca-bb6c-536e62a5692c", "comment": "Malware payload (AgentTesla)", "value": "25de3279488209ac317d529ff87ec28d3e5d2d3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957305, "uuid": "56380639-be2d-43a9-8ddb-fb134b23e3a6", "comment": "Malware payload (AgentTesla)", "value": "4343a6e4412fa9cbf379c7d330f3b25f3c914fc793807f3176e3f243480690c2725cd0239ef12fa5c5acb7c0812120dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957305, "uuid": "f9391784-4852-4be7-b94f-bbdc336f85a3", "value": "T1CBE4DF047268AB67F53EDBF45514418407F563BE70AEE78A8CE6A0EA1A61F500F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957305, "uuid": "f725e7f2-fcfb-4c82-99b8-d2b72c1ca81f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957305, "uuid": "7be30b41-9615-4b7c-8935-d0128251904d", "value": "12288:T5MYLmfo1xLmf9KdvG01esc4gFJ51XDRJGksq/DAx0xU:T6WJ7LmIdb1354J3XDWksEk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957305, "uuid": "3dcc7a40-a44e-4e3c-bc6c-4cad0d1e35f9", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957305, "uuid": "3fa3e3eb-1571-4c2c-b544-70970f4fafb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957305, "uuid": "805ffe02-37b6-46c8-8865-1245b4967b3e", "value": "==TOP URGENT== PAYMENT REMINDER - S-386 INV 547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fe22ef-30fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690956680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956680, "uuid": "293be0f9-3ab5-4b21-9084-e594baf8278a", "comment": "Malware payload", "value": "44f6bce922d1aaf2fab19ed5656744c9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956680, "uuid": "65b928d1-9952-412e-ba7b-404d68f9596e", "comment": "Malware payload", "value": "707aa282085b505b21ec8df4f91fac2c83f43d67ec383ee0d23c9a3547aec12b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956680, "uuid": "b8dd667f-dfd4-4f54-a787-9f62851fd276", "comment": "Malware payload", "value": "1e66bf8cd8c4a9722becb251b6ce80dd0c1d143a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956680, "uuid": "44093c20-d749-499d-8245-23340ebc2979", "comment": "Malware payload", "value": "2698df53ed07903c68e2f66b87ec52efb88e76832929ca1a1136a2608e5a7de806a0967af897f0b1b1d7030743e45cbe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956680, "uuid": "831f7c6f-c101-43d9-a614-cc57fee84665", "value": "T1D0C495038C084B879468D3F87E134EAD6F5A2B0CE8957AFF04621ECB7F606665D5E05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956680, "uuid": "97b331b8-2ea9-486b-9cf1-c425742e56ac", "value": "12288:+LwLciPqcrRevcGbSnJgAZfPnu9Cg82J0Efugq3:+LYcxcovcrJgGfu91J0Efu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690956680, "uuid": "65ec2e20-07e0-4c2c-9f3d-9c4b9b4edac5", "value": 593181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690956680, "uuid": "336fa9f5-1185-406e-bacb-44a8d68fd720", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956680, "uuid": "f5615bb7-f40d-4f0a-bb5d-7f95db6ee990", "value": "Doc10.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5f6c8e-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690957331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957331, "uuid": "6e6eb0d2-5aeb-4bcc-b0cf-6b1015a63898", "comment": "Malware payload (ModiLoader)", "value": "df3fa09c2ef386f75345ece7ada81560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957331, "uuid": "3d63b737-5419-4392-aad1-76d4eae9047c", "comment": "Malware payload (ModiLoader)", "value": "70b81e7b9f03f3ac76bf105ce4c5925a208828f5d3c00f142019e0626210ae5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957331, "uuid": "606f53a7-dafc-4918-8e3d-482b3af62068", "comment": "Malware payload (ModiLoader)", "value": "a016eae041c4908c9f41c6964c5a8941d1243bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957331, "uuid": "d8bb2c1b-113c-4b6f-9ef8-b2cc57c6fc24", "comment": "Malware payload (ModiLoader)", "value": "eb39eb5dc8e2492ca0cb7ece6c266d5963283aa0e935b7eaf40033dfb5dffc697e9bd12fd5746de29e366ef69108b4a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957331, "uuid": "3ebb0e3d-f4e8-447c-bb27-c243a57ca3cf", "value": "T1FB05BF267290D433E1172975C919E3B498297E301E30E4BA7ED97FCCFA3D646385829B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957331, "uuid": "8819c35e-1690-4a2d-8f32-17218ab3b81d", "value": "8e06c93dcf3919c71d43e1595ee9d9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957331, "uuid": "f2726f41-a519-4442-901b-8ada1d7bb5de", "value": "12288:7q9zUX+2NAOdFyglsKMlCbuGg4Ut8wNCPAJFfsg72asGS99Spo+:uF8NAOLyglAlCb7gX/NCo5Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957331, "uuid": "4bb8334f-680d-4e55-a037-56f021ba39bd", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957331, "uuid": "2c8aefd5-5aa8-4b39-a746-e8d4e242b262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957331, "uuid": "a90ef02e-f1e5-46f3-95a3-9e726c1518ef", "value": "ShippingDoc00365483747848466448464PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464e77b5-312d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1690978101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978101, "uuid": "1993ae99-cf64-42ba-9316-ca16753c5dd5", "comment": "Malware payload (RustyStealer)", "value": "f453215c2377d18d1211bcfd3f59cc6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978101, "uuid": "01247640-b77c-45cc-9bde-337fc781c9dc", "comment": "Malware payload (RustyStealer)", "value": "70c874c7911d00fe6f5b50e95f45c81fa78494fc7115058daf5b8fc16b3144e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978101, "uuid": "6ebce0e5-7e88-4e3f-9081-10793784567a", "comment": "Malware payload (RustyStealer)", "value": "d765fee81397ee7fcc1a21c4c5eedcc9ad47c978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978101, "uuid": "6134f6ba-b09e-4fac-90df-46dd950dfe6e", "comment": "Malware payload (RustyStealer)", "value": "486d1be1377f28a304eaeeac4147fbf3ab920a7a99dbee85cb1a41e8d0da26eb302e596cd8add9f7d886377af50c368f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978101, "uuid": "bae91946-31f5-44c8-b98e-153123562a4b", "value": "T19AA66B47F7A140ECC4AAC0B482266322F672BC4D07247AEB5BD09B316F66BD06E3D755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978101, "uuid": "cf0b4402-e7fe-4571-9075-7cc13b17bfeb", "value": "9b7727ad52451b814a6345d82d97e6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978101, "uuid": "e5e5c1a3-485f-434f-8cc6-421e783fd2b3", "value": "98304:woFPpBgmSeh9ag3buoRz2TcQ2Atse+a2krAwnvuitcNgSju2AuEkg+sdrkQ:wQP7tSKhQckUhuXYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690978101, "uuid": "9afa9079-6b34-426b-827c-9a16707f4d23", "value": 10255360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690978101, "uuid": "e6173d75-4b8f-4256-9fe9-4b11e809e937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978101, "uuid": "ec3165cd-daf6-4adc-815c-910eb26a6c12", "value": "70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb5e534-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013143, "uuid": "5984c809-823c-4791-a24e-8a96a29f7460", "comment": "Malware payload (Mirai)", "value": "7747123ac7e3902e32db4988cb5d032e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013143, "uuid": "21ff3e51-cc48-4e8a-90f0-f69eb54bb05d", "comment": "Malware payload (Mirai)", "value": "70d7bfbc7f5c84f45b7bfc293742f4141371e3bd1d8d66b8d11d1fc4039d4dc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013143, "uuid": "5a5651da-1a85-4877-b972-8789d53decc4", "comment": "Malware payload (Mirai)", "value": "2b38530c34c5e62ec062118bb011fc07abbab43a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013143, "uuid": "13d6f8c6-ca4c-42e8-a0ae-bc0180b5d89c", "comment": "Malware payload (Mirai)", "value": "b095ab43ccd1072751ab87debcd79c59a5fd359287518219771ef8bec2e7891688e9f7de25f996bba575661c6645f6cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013143, "uuid": "a8e68d5d-fddb-4dbd-9613-2cb8ed73c16a", "value": "T104B2D135928668F1CC722434A66ECC4B97AA41FCD0FA7633116252F87B4B44B1DB9397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013143, "uuid": "efb28817-1590-4f51-b658-a70b534be94a", "value": "384:joBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1i5zJXHK27tFqXU6nBueUqB3hymdGk:7aNSq5sOHpTqncvsdDePiJZKMFUUEVx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013143, "uuid": "a09ef91d-c117-4dfe-b2ad-278e112d519b", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013143, "uuid": "61d1a94b-68ac-4a66-8ed6-b31df9c677cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013143, "uuid": "4d620f1d-bd07-4df9-a34b-bbd9ba982dd8", "value": "7747123ac7e3902e32db4988cb5d032e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3717ae-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690963777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963777, "uuid": "409329c0-fa83-4be0-acfb-d9ce4b8d01cd", "comment": "Malware payload (NetSupport)", "value": "8fb80e0a6f0c305371b8dc11db0c1552", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963777, "uuid": "747224ce-1758-4365-8fc5-839709f4b653", "comment": "Malware payload (NetSupport)", "value": "734666652f013df6bb435fe22fdd811274efb8e09e3fef9a2495396319d1d1e5", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963777, "uuid": "99d09b2c-e8ec-4e14-90e0-c040718cd748", "comment": "Malware payload (NetSupport)", "value": "6a526ca78d175b5ec46fd4dd5fdc3f0591cb4eb7", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963777, "uuid": "e271c025-9563-475d-bc56-c10a660ff144", "comment": "Malware payload (NetSupport)", "value": "9d170aadd8bda69bf1a22536ca0b8854a0904741ebc34e3e57a02b3cdd99eea5d1d2ebde8433aecce5b09b07846d9a7d", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963777, "uuid": "7bdea450-c771-4515-aced-89260df2338e", "value": "T158F0C00D75927460020365E1A267082BF45AE615C70E5488E154DBAC1C2080C877ADEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963777, "uuid": "f87ef141-b480-4b91-9d12-eaa8cbcf50f7", "value": "6:2LGXpLytGAv2FFOMv+AUVsSKh/m4Ek1X/eSOjKhQ1C02Yyz9H0+usBPzjLx1ATg0:2QlGGAaF9EkdGVw09yRH1cTE6Xqmu2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963777, "uuid": "45470a2b-8f9d-4ebb-9f94-7969ff09c53a", "value": 499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963777, "uuid": "d1e06194-3fd0-4c95-9410-552fdc8859bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963777, "uuid": "69b3b919-d4e2-4868-8734-73827ac9aa92", "value": "Browser_update16.0.5836.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7186ce3-314c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690991605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991605, "uuid": "8eef6a3c-ee24-4b91-a225-7e27a99709ea", "comment": "Malware payload", "value": "a3338e69afc75965689bd1733f997268", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991605, "uuid": "44e2a4dc-a9b4-4ef9-92a6-3f8b484fd022", "comment": "Malware payload", "value": "73e01ce8db8f5055c0b626d17070ad20ac81e0f27ec4c43f3341da57bce28434", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991605, "uuid": "f5e0f4b0-aef6-49f6-aa5b-7da0173bea76", "comment": "Malware payload", "value": "7fed5108ae2132db423f7b1fce876cc6cede1e4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690991605, "uuid": "f5945e71-bdad-48be-ad5f-def0c5515ff7", "comment": "Malware payload", "value": "e445c179eb646b4681f20f557850c49246bcd7c6a550e8d63604424796b3dc236844944b1fe23a7459fea8c8ffdfc44a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991605, "uuid": "07af135a-2dab-4ee5-b472-63371819811a", "value": "T1CD4512738616FDC7475E4DA1E1413A409D5CADDBAB3092E8BD8C0BDCF069924DE78AB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991605, "uuid": "f0aa7261-71e8-4445-8acf-78e965537dab", "value": "24576:IvVDYUyuFnR8LECshWVHyaMaUirpEwjkpEBCwPPUqrnt:kVByuFnqLE9EVHymapEIYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690991605, "uuid": "bc020ffa-994a-459c-bde0-ba98b2f2cb4f", "value": 1222174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690991605, "uuid": "1a3d0ad5-9f38-4cd9-b4e8-b1df598722d3", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690991605, "uuid": "40e6d90e-624b-4f38-9921-454f1754301b", "value": "rump_img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc5bd02-311a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690970252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970252, "uuid": "900c74c7-481d-4e35-9ec4-cbd79bbf7685", "comment": "Malware payload (Mirai)", "value": "86476046c742f2b13c53f341e843d543", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970252, "uuid": "e5639906-2a8d-4334-b9d3-7bc1acc8effc", "comment": "Malware payload (Mirai)", "value": "751d2f6569ca9275eb29e750169e8687b5b48abad1e899a1457e4dec45e64db9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970252, "uuid": "e4d49dc0-2998-4fe7-b070-40de239fe9ee", "comment": "Malware payload (Mirai)", "value": "344ab6eb901b606cc0c249c9012e3eac2daa3be6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970252, "uuid": "181cdf51-6496-44b8-bf6e-4672e8bfcac6", "comment": "Malware payload (Mirai)", "value": "805326b071c48b1d816dbb0263944436abae748257757abbda0fae2c78b4f44f96aa993a89deb7ed5f00541a15391954", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970252, "uuid": "f2d66b99-1593-423a-a9f7-3da7957d53c5", "value": "T19B735BC8BA83D4F5FC6309B25137A7728773E12A146AEE42C729AD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970252, "uuid": "bbadcd4b-7651-4d5c-a964-101cf073f23a", "value": "1536:ui0zOtnGHoKB5KAvMMZlpdtqNEloSjot0rjCeya:f0zsn4oKHCMfLt6k1j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970252, "uuid": "075156b2-28e0-43b9-afcf-ab28b6ca4017", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970252, "uuid": "e61108b2-973a-470f-bfb5-4c805e048900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970252, "uuid": "80ea4e0f-1c44-4e2b-b0c0-bf3adf0dc4be", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16e4054-3169-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691004024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691004024, "uuid": "9a247220-76a1-42f5-a6a3-713e0ebeffeb", "comment": "Malware payload (DCRat)", "value": "12826025c71dbd7b7b7b9b8ed8e73176", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691004024, "uuid": "a200ca1c-b8be-4cb4-b17a-050a06d43a52", "comment": "Malware payload (DCRat)", "value": "754c52185fa2fc8ac2d9f03290db41c4afede6933a55a6bd57c6158ce6d754ad", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691004024, "uuid": "c191238b-7126-453f-ac9d-da94974fd45b", "comment": "Malware payload (DCRat)", "value": "b129a45b5ccfdf0493fabcd3b9d54f9d2321f17f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691004024, "uuid": "2c781c8f-9daa-44e7-8793-7de196e0dd83", "comment": "Malware payload (DCRat)", "value": "b1a35f528715e413f017d9b5d5a79550f4a03b10c1354c1644ebb2d47c24b5ba404a5c4f12aa707f29b400c77a9d2e64", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691004024, "uuid": "128e1047-2560-4e6f-8dc1-055172247b27", "value": "T13306E1017E848E22F0191133D2EF45044778ED516BA6E72B7EBA376E65263937C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691004024, "uuid": "2175e4cb-f817-42bf-b957-378165883ae0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691004024, "uuid": "799758bb-16b4-4b2f-af6a-458f2b336349", "value": "98304:UboZN6a7pKnH5txu3hOVj0wycuXOI8jthCAPKr:U0XvUnH5i3s7M8mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691004024, "uuid": "60bd29fd-0a78-4295-b8ce-315e7f5d4236", "value": 3672242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691004024, "uuid": "b7506b7e-8485-4dcf-800a-602584a415c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691004024, "uuid": "8c85ab95-2713-46f7-8f96-93093a6ec53f", "value": "12826025c71dbd7b7b7b9b8ed8e73176.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299f7af9-30f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690954431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954431, "uuid": "cc57083f-2883-4503-a820-1f4d6591c8c6", "comment": "Malware payload (ModiLoader)", "value": "4aebdf169977adc208f384287dd4e9b0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954431, "uuid": "8d8d22be-a710-475e-9810-7160bcef6d05", "comment": "Malware payload (ModiLoader)", "value": "754d9105589fde2df12ce0d46d2ed49ad4e4c5d412f3b24f3f3867f19ff80408", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954431, "uuid": "4a31d5d3-4021-4051-80c4-c1ccdb21cc4e", "comment": "Malware payload (ModiLoader)", "value": "aec170b0927bd0d2eb1e4769003e0f5fb4e7c1a4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954431, "uuid": "9801e010-295c-45a8-a8df-ee1530c51cfc", "comment": "Malware payload (ModiLoader)", "value": "9dccc9087cd2e5eab5b5ab666833861cc5f26befb6daac9b0a7c99a115748b38e39a10780cf459a95ce15d843dcd05bf", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954431, "uuid": "c5e7c607-dc8e-4e2d-b94a-c61b9a57f07e", "value": "T1073533BB1C943171446AA60E2ED5790CEF5206D30E5F09BAC37363691EFDE4DE786A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954431, "uuid": "c450aee1-ed2d-40a0-ba55-fee965f7e6d0", "value": "24576:qru7LQPyg8OqZLJtcMrltmsidshdvbN3ZhoUDnbhgSNfxbGwyieXCqi:qru7LQqglqZTckyynvSUTWStxb9Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690954431, "uuid": "e05264d9-3d8a-46ca-af9b-fe068e6d5769", "value": 1139770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690954431, "uuid": "eaeb0a3f-ebfe-4184-955b-d72a8cbf3a35", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954431, "uuid": "58b66d15-d23a-4e44-b409-74a20636a35d", "value": "RFQ PRICE QUOTE.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e42ecf-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690957408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957408, "uuid": "4b4f3958-7980-4590-b42f-a3448e4a3b35", "comment": "Malware payload (AgentTesla)", "value": "0c957aa0fe19415686875001f5564f3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957408, "uuid": "27a08992-6d03-4c1d-89df-5b5f0e14947b", "comment": "Malware payload (AgentTesla)", "value": "769f8d453d15590d55a2673a012ad4ab54a3a81861c2d16389c7dca08d507a91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957408, "uuid": "06de5dbe-dbf5-4830-accf-ab10dd1ef46e", "comment": "Malware payload (AgentTesla)", "value": "e3ad2c84874552aa00d8778629b3eef2104d5828", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957408, "uuid": "532d896f-8fbb-4766-9493-211b35bc527c", "comment": "Malware payload (AgentTesla)", "value": "63beb4d729543a8e7812e50e9e28cee143f8a0a6791e9e384abebd820a8a1431e1d25d05113d8f4443a69d37e58f452d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957408, "uuid": "f14979b6-86b9-422e-9ad2-522869d29161", "value": "T1ABF4E004726CAB67F43E8BF49414529007B597BE707EE74A8CE6A0EA1B61F540B40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957408, "uuid": "d765e63f-c991-4796-8ddc-09cc25ad5d23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957408, "uuid": "d9692a2f-0835-4e71-a304-ff9f03e73f75", "value": "12288:/5MY7n5Ie0P4k0q6G/3lFHOwe7NO8Rsy/ccMSfZBxfXdj/Z9Aobyh:/6snSxQk6+3HHOwONV/dhXx/ZWJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957408, "uuid": "45b9ee21-738e-43bc-98d1-0402df783f72", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957408, "uuid": "c2398afc-38e9-4fb0-9d8a-09275ef785a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957408, "uuid": "de28af9e-a572-4853-9cf6-df0649db709b", "value": "2082023_ACB - 91xxxxx8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649b7329-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690963979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963979, "uuid": "cbecf935-7168-4a63-ab4b-10c5150b5545", "comment": "Malware payload (GuLoader)", "value": "5f4086f93e2ef0c3171104a9794258e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963979, "uuid": "b32b74cf-e8d3-4945-bc54-93e2976ae17e", "comment": "Malware payload (GuLoader)", "value": "76cbaad0b7579c0ec7d0579935127aedb2909141799e59821d8f7cc0972856db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963979, "uuid": "b43251c4-2cc6-4aa3-bd90-239f4349ddd4", "comment": "Malware payload (GuLoader)", "value": "cf16976dad843ad858c81c69a959ff6ab684936e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963979, "uuid": "ca65a072-f103-421e-9819-3b655a6a69ea", "comment": "Malware payload (GuLoader)", "value": "63c39b6498c01c319e39b436c5c80a783950ee0da95ec8f650ad839b93dc38f12f6aa47a231b4604eca8d58b7de3595e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963979, "uuid": "022458fb-6504-4e23-a8d4-d94d24d5e37c", "value": "T1E68412A3D3E08427D7D44FB41D351A6A96A75E3C2DA1E20F17147E2D3B3B5920829B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963979, "uuid": "7ddc1d39-e35b-4f62-951d-ac9958d11169", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963979, "uuid": "1477e37a-1def-4f7f-9223-41d597d87387", "value": "6144:WQA4P4MI5QfrwhyAN/2L4FJtRWITG5V6r7hPa10ym+elQbK/0wP+6Yvdz+/3C:/VfrzAN/9tRGwx/y8l5+6Wx+/3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963979, "uuid": "d3c9f0a0-b07b-4913-98e6-15970538376f", "value": 371184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963979, "uuid": "f0c1665a-2ade-4f08-8704-057b131898d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963979, "uuid": "bc5b11dd-b485-4d96-9983-81dbb2f957a7", "value": "PAYMENT_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045101c8-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690970260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970260, "uuid": "84a717f5-03bd-44d5-8c6b-438d64c8422e", "comment": "Malware payload (Mirai)", "value": "820db981909d1bc34edafb183b0506ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970260, "uuid": "61598d48-8332-4d62-9834-3f048a13a728", "comment": "Malware payload (Mirai)", "value": "77ba269d7e4885c26f7ea9e50381afd0f89270f6e283d42b7981410624bb2db6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970260, "uuid": "28770de3-acb7-43e4-bd7d-8b13c1666f3a", "comment": "Malware payload (Mirai)", "value": "9f3d531f788002351c3247eef1ec1f4300cca46c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970260, "uuid": "601a08ad-f5ed-447b-99b7-e83beb38f272", "comment": "Malware payload (Mirai)", "value": "04899c78bfdefc587602c92cef4df743c33d0b3da0ca5bd4dde8bda44f7f184af06bfb501a767e39edba2d5fed231ec2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970260, "uuid": "4f5a815e-27f7-4ed0-87be-bba0711e7296", "value": "T123D3F856F9819B12D5C111BAFE1E124E37131B3CE2DE7302AD246F647B8A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970260, "uuid": "59d0f274-f265-49c6-b91e-6011db6b2d7f", "value": "3072:EnaUYamXEXOmkcgxaGztzH/b/zCZVMVsq:FLNEXZkc0ac53MVMVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970260, "uuid": "d398d4f0-358d-4a1c-8e54-a296727dd999", "value": 131900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970260, "uuid": "2c66dd4f-bd05-4b4d-bb8e-25ae7aee2a25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970260, "uuid": "a29bf784-5ac3-4545-8662-3cbdf8b8e77b", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4f10fe-30de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690944398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690944398, "uuid": "222763dd-f446-4d7e-b767-6f1755f599ff", "comment": "Malware payload (ArkeiStealer)", "value": "0ccf1b8ef2cd11685911bbfff920c6a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690944398, "uuid": "ec000a55-a911-4653-afbe-63ffae999c0c", "comment": "Malware payload (ArkeiStealer)", "value": "780db2201a60a16938c09875bbb0c5de57f5262393fc84512c6307c7598d7203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690944398, "uuid": "db693b71-1d5a-46e4-bcdb-de6bd20b78ed", "comment": "Malware payload (ArkeiStealer)", "value": "7893b025a4425d393aa0b81be7b7f1dfb018faaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690944398, "uuid": "2fb465cb-923e-425a-a342-110b4fca5d8a", "comment": "Malware payload (ArkeiStealer)", "value": "830d71feb32c09eea3e1e03f414f6451650ee61d9527a2290bb1cc3eb51ffcf61c8dde04b53ffe24580228d2b8d673cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690944398, "uuid": "65f766fc-c88d-4443-bf4b-96658b5545b0", "value": "T15FF4821892306E2AC0C31FB07DBA936E41D42568E31DCEE65A7DDCB5F6EC8436D025DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690944398, "uuid": "8062802f-bb85-43ff-beef-07fb221f7a23", "value": "7d594973434539b63f110ff65422442a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690944398, "uuid": "ae614426-d729-4362-922f-326a5b0f4269", "value": "24576:1Ru16WYdRNDl0Et8uEXE6dl5H92r5HA9NY:LVNDl0Et8uEXE6ds1HA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690944398, "uuid": "345665a9-7812-4529-a088-e41c23e45bf6", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690944398, "uuid": "7d6d1546-b09f-4c5d-81d7-e7dcfad7757e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690944398, "uuid": "fe78e868-42ba-4f84-8de7-485190bb3148", "value": "0ccf1b8ef2cd11685911bbfff920c6a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884051e8-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690957596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957596, "uuid": "355ab353-67a7-467b-bef6-15b04948c0bf", "comment": "Malware payload", "value": "1a7378c1290c7eff1d1072ca112e6213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957596, "uuid": "627c27b0-dae2-4487-9280-f7efb1fe25bb", "comment": "Malware payload", "value": "787794897ba2b5d8f3eae435ae870d7401454683a1f9e7e969fcc6f4437b193a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957596, "uuid": "dc588e94-6e03-4360-a132-2bebf1cc6f2d", "comment": "Malware payload", "value": "e844700be18f8dece6af8a550df1edd1ccf5700e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957596, "uuid": "a54bb6d3-d152-42b8-9d9b-d6ec490e6d16", "comment": "Malware payload", "value": "66c06dfeff0ceec8be50620ea2768ea2ad855d32aaac92a1865349088fd462a6c260f387dc66535a7d0452794c556f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957596, "uuid": "57bfd072-f06f-4326-a8b4-7f7c9ed143d4", "value": "T167460111BAD5562AD0397BB88FDAD16D963FBF20C938D65F32D01A0F36618012F26772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957596, "uuid": "bbf9aa05-c5f5-4ba2-9ac1-d02811d43c54", "value": "011bf549dd78fd495799798844deaa0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957596, "uuid": "4935d50c-4595-42ef-afea-347724349520", "value": "49152:0TuaioeFEhFFToxxR5pmvVCBZ0SR5CtNSUhAgudb7Fj8VEb9RD2iQFbGRfatA:0TZPTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957596, "uuid": "65fa7b91-ad08-4bdb-94b2-85e45c3e4c8a", "value": 5358160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957596, "uuid": "5aca7c88-fafe-4953-9a8b-d7ec0a64605f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957596, "uuid": "07e6c44b-fb98-40f1-87cd-a724a2377f55", "value": "1a7378c1290c7eff1d1072ca112e6213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eccf009-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690998356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998356, "uuid": "92ad282b-e62e-4a1f-8d01-3ed7689de52d", "comment": "Malware payload (AgentTesla)", "value": "81949c85d77f76164cb360626ac65f64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998356, "uuid": "b06b7c54-b250-4c5c-aef4-3e340c00b1d8", "comment": "Malware payload (AgentTesla)", "value": "79c75f759d9a8443bdf2bbde5741af34b30e4c94bfa15ccf42dcb58f851e9a47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998356, "uuid": "2612842d-1d1a-4a9a-82e9-0029e1de7f14", "comment": "Malware payload (AgentTesla)", "value": "64371e3863e8ceeb40eacdfdf6a695106b275753", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998356, "uuid": "b114b0d3-72b0-4b94-bf43-80a608f17681", "comment": "Malware payload (AgentTesla)", "value": "f0e96ff0d61e54ae6dd0958c00f5c727513e1e1f396931e82eff82cd3599419ce59cfbd2a591da97970dcf1f8becc60d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998356, "uuid": "6d58637c-f1ee-4757-9f96-2370fa72cc79", "value": "T132E412A923A0563BF4BF33B1F930428106B62DB9B1E8C68F948570DED17BB415D526B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998356, "uuid": "e8793eef-f4c3-4361-ab7f-db1ed85bbbff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998356, "uuid": "fbf47713-be30-4227-a82c-69a838818dd1", "value": "12288:Lg7JXmSOlBvtD1IyEj6xn2G8ch9oOLDFEBhUvYkKltDfNWR:Lg7cSOTJ1gj6pmOKgvY9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998356, "uuid": "7d668a27-35bb-46bc-a79a-90dd16ab5294", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998356, "uuid": "85354f07-bc7f-46c8-86cd-b64f8d7593e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998356, "uuid": "d519af52-adab-42ae-9af3-35da31d5a7a7", "value": "DOCUMENTOS DE ENTREGA_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39cd2fd-30ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1690935791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690935791, "uuid": "10d33258-4b42-4344-9257-3454d6b24fe5", "comment": "Malware payload (CoinMiner)", "value": "768200a76def472e675539094047bed9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690935791, "uuid": "e99be7dc-b083-4009-ab7a-76d5aff72306", "comment": "Malware payload (CoinMiner)", "value": "79ff7ea339f95a557cec5e39d944118af6c105c29736e448d5aad60368eae5af", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690935791, "uuid": "00936dc7-8153-4203-abb5-148246a17812", "comment": "Malware payload (CoinMiner)", "value": "24bc17689541656a8a12902c7f19bd991193ca50", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690935791, "uuid": "342fce0b-5154-4f94-875b-8b38ed5d6972", "comment": "Malware payload (CoinMiner)", "value": "5240c36136f5c2cead42efbfe5a275624001b07b25d55788c89e06e687587d0a858814622d6b3c3e1ea79a6bd8c4f04b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690935791, "uuid": "33b31d9f-5bc8-4331-8c72-2f2109de7fa5", "value": "T1E69633C56DB04953D8EF22B1B8E721C7DD64AD61B651C13E3A6C340AAF315225F08FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690935791, "uuid": "35f827eb-ad9b-4fcf-83e3-c30d32073809", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690935791, "uuid": "d863dfdf-c1a2-47ff-be89-7c69f6929f07", "value": "196608:feGA0JQYKTrkAXQx6S7Ou1vtYgeW8PQeKLS0MJ9z88O/b3:f3A0JQYKr6tNPYgvRLkHKj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690935791, "uuid": "d17a1674-dc5d-4c40-9729-afa6e09e47ad", "value": 8802096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690935791, "uuid": "54b86959-ed8c-4617-9019-4e3264e74205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690935791, "uuid": "72b156da-a4ec-4978-8bb3-bf74f73f75cb", "value": "768200a76def472e675539094047bed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01db2e22-3139-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690983140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983140, "uuid": "a43570e7-e855-48e2-8c6f-6ac114f7ba9f", "comment": "Malware payload (Formbook)", "value": "920a2ac8ac8993128eb81fcbcb1e4b29", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983140, "uuid": "e2ca3908-7cd4-4ce2-a72a-87c8f4f02563", "comment": "Malware payload (Formbook)", "value": "7a54ae41f94966139ade0054768dd90833b2ba4203e14dd5fd2748325aeb7ddc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983140, "uuid": "89ce6691-69b5-40d2-81b1-d706b438f5b9", "comment": "Malware payload (Formbook)", "value": "abd5d06f4c3169864ed6da957a944f896c117256", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983140, "uuid": "471ca82a-12a8-4dbb-86e9-2917363e44fc", "comment": "Malware payload (Formbook)", "value": "2a791e4dc5582880346322d66ee163c631a2b6778cae0ce41fc5d8e85c3dc7720bb7e176948f1a468f0249685e810855", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983140, "uuid": "4a16a29f-75ec-4f68-92b0-ccf770ac9049", "value": "T1A6C4231693D2AB69CB6D09712F71460733AEFCEF012129527B1F46D394222DFA2C7D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983140, "uuid": "a24fa73a-59bb-4022-baef-be93d87a05af", "value": "12288:9Gec7NDoklmvNP7opQsttd/Km6wocDjer8gaSQENU42iZMw3CJ:e5Dokl4NhstaQAnrZMw3CJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690983140, "uuid": "343d275e-8490-45a9-b644-d1b6d739c6af", "value": 590178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690983140, "uuid": "d35a6d17-8090-4d84-8039-4edb37bf57f4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983140, "uuid": "825c3663-49de-48ff-ab16-0a265275b5ce", "value": "SAMSON A.\u015e.%30 AV.\u00d6D.DEKONTU.27000EURO.xls.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31acdad2-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690967329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967329, "uuid": "ba33d028-3836-45b6-818e-ceb4dfec744e", "comment": "Malware payload (RedLineStealer)", "value": "dd15adb1b67c341a81f1d9313c39820e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967329, "uuid": "ed82a425-12b6-47cf-ad6d-8fbf01f931ed", "comment": "Malware payload (RedLineStealer)", "value": "7c5926c682d4778d6644ac7e5edf29cffb3c03a15ece69d20668c92dd409db1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967329, "uuid": "4a2369e6-c777-4042-a40e-7f1dbfebfb30", "comment": "Malware payload (RedLineStealer)", "value": "6642a354cbae7cdd4935b2c33be555f0bba2d869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967329, "uuid": "319674ae-81f8-48d7-a155-3759c144515b", "comment": "Malware payload (RedLineStealer)", "value": "9bff784463aee044073ea1ea521cb958e8f4b8117b1f949702eff874758af4d83fad02aad48072b9d5f8ea644df65cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967329, "uuid": "dfa5ee28-8690-48f1-a475-b429a5ec744e", "value": "T135B40207BAD98573D8B517701CFA03831B32BC619DB4836B2786995B0DB26C5B631B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967329, "uuid": "465fb45a-b090-4e7a-8a84-9401e6b7497f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967329, "uuid": "6611bc1b-bf90-44f1-9152-b5c302f33ccf", "value": "12288:cMrby90WZudItVAkgIGfld4zOI1plgBYC3xEVNvEb0:HyTiLlla1p+zhfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967329, "uuid": "df7929be-09b9-4eef-a75d-4ca09f99ee48", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967329, "uuid": "0470e5f9-aeba-4dfa-8bfb-80fcb712de6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967329, "uuid": "1059c244-eea0-4b55-8362-8e08d8efb421", "value": "dd15adb1b67c341a81f1d9313c39820e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef7ca88-30ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958332, "uuid": "0304c9a4-b87b-43ca-b54f-95822845a81c", "comment": "Malware payload (AgentTesla)", "value": "52464fffea41150e38ae60b2b891e03e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958332, "uuid": "a6b69ed4-e4cd-45bc-830e-37b875cd99c1", "comment": "Malware payload (AgentTesla)", "value": "7d2c0ca2157f96e0b94061bce18efa6f4a3e4b278e5e86b3df2d0beaa4760431", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958332, "uuid": "f3e30181-aac4-4fa4-934d-b1c49cd07724", "comment": "Malware payload (AgentTesla)", "value": "792559e26b78231ea7486890bb0793225df08b2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958332, "uuid": "0a2e99de-d523-42ff-a930-121679980399", "comment": "Malware payload (AgentTesla)", "value": "2a612d67373c6ecd4be066d5538379736e33333c51ca86859b51c37fa08d5fecfc45296ed4d5a02bf34f088705b02402", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958332, "uuid": "eea8611f-e145-4140-9bc0-9a7bdbb9f47d", "value": "T12D328D7E9F6441EEF31B96B54060245EFBAAB7A7FA38030E59B0AA1880753CF4311374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958332, "uuid": "706d2339-55c4-4922-bb83-83b98d7918b9", "value": "192:6ya0NCEH+Ws4N5eNA2A+EnVs+mg1SoBOJYeO36PvTKmhjY93cWeMK6/:6yXCEH+Wsu5+A2bkBdBOJYeOqP1hE93z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958332, "uuid": "b94b6c21-67cb-4d62-a3d6-41a27f1de4db", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958332, "uuid": "5d140d50-ecf9-40b5-a7a8-602d5b9b9435", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958332, "uuid": "20858f60-e0b8-4999-bce6-1e62a24158a2", "value": "New Order_Letter.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388b36f2-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690967341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967341, "uuid": "927ed444-bfdd-4b3e-90c1-8bf87edc9fe6", "comment": "Malware payload (ModiLoader)", "value": "79e5648312a58377ef76d2346404ef12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967341, "uuid": "c02467a8-fe55-43c6-9999-ae0d474a4ad0", "comment": "Malware payload (ModiLoader)", "value": "7d537e6551b2b3274942aa184949fda010e0c2a1a5ce9b8a3924f34b6e79ad9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967341, "uuid": "ae352d9f-523b-4f18-a205-23c8bc1db774", "comment": "Malware payload (ModiLoader)", "value": "7ba3f5012e9672069493bc25a2b1ce01946ed68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967341, "uuid": "272a7b23-f0ae-4093-b313-0f548d148fba", "comment": "Malware payload (ModiLoader)", "value": "07bc022abc2ec2621202fe4064a1748ddcf08a1c830b4f61b93e20aae593ab5a96de10515c6022bf4cf800409ffdd13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967341, "uuid": "6f67ed58-1f3a-464a-ba08-6b5481e154a7", "value": "T10005C02672A0D433E21B2C35C95BE3B484697D342F34A4797AC57E9CBB7E78228241D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967341, "uuid": "3ae057aa-e53f-4eb3-9f6e-4a7097f2b5e8", "value": "8e06c93dcf3919c71d43e1595ee9d9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967341, "uuid": "94e93b22-ab02-48d5-a703-2cde80b7ff45", "value": "12288:7q9zUX+2NAOdFyglsKMlCbuGg4Ut8wNCPAJFfriiiag72asGS99Spo+:uF8NAOLyglAlCb7gX/NCoziiiXDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967341, "uuid": "852f8771-6ade-4074-91bf-d928cb5e29ab", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967341, "uuid": "a69dd1ef-dc28-4b99-88cc-1f95bd526c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967341, "uuid": "324d0030-19ab-45c5-aa61-db4ceacf556d", "value": "79e5648312a58377ef76d2346404ef12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186252a6-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690965998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965998, "uuid": "8732a1ac-e00a-44e4-8c6a-580fcc5866ae", "comment": "Malware payload (SnakeKeylogger)", "value": "4fb089125b75694036d39124584c0374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965998, "uuid": "6abf1f97-b03c-4ef8-87cb-da68b29da11f", "comment": "Malware payload (SnakeKeylogger)", "value": "7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965998, "uuid": "be3ca5c6-f646-4641-b33f-6068aa661554", "comment": "Malware payload (SnakeKeylogger)", "value": "0ce940199d1da05f9ce9834bf831be7b4fea0562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965998, "uuid": "fcb16620-9d64-4ab1-accf-75bf6f70c808", "comment": "Malware payload (SnakeKeylogger)", "value": "6abba67612b0f9a44aa880ebf8448b5d995d9b6fc723cb06978b37b07973d9e70e5afee48e3f8af691aa67da1a308952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965998, "uuid": "91bd7794-6a49-4035-94e1-570e644b0561", "value": "T156F4D0047268AB67F53F9BF45524919407B593BE306EE74A8CE6A0EA1B60F500F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965998, "uuid": "dc99f369-1d04-4ea0-8bda-e0c9295342eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965998, "uuid": "b46261f7-5219-44ff-b67f-41828ce1bb15", "value": "12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965998, "uuid": "d9a798a5-f133-4b86-b925-0c66d3d8a3b9", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965998, "uuid": "217f3799-ea3c-4c76-9954-74405ef221fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965998, "uuid": "b88d1f57-5bb6-4af5-ac14-ee821e6c2750", "value": "KVC PO1100538819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f412f3-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690998369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998369, "uuid": "d309068b-b9a1-4dc8-9463-0a41ff529e61", "comment": "Malware payload (Formbook)", "value": "338821dd09587cb3f02c99d2cc944055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998369, "uuid": "1e0cdfb9-2d02-48fb-8f0d-ae08b71dc9e8", "comment": "Malware payload (Formbook)", "value": "7fba8c621fc9192e73139b70878ccf8ed761b025fe13bef1bf74e1d5181ae48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998369, "uuid": "8200f830-c610-429a-9006-56fb585ad571", "comment": "Malware payload (Formbook)", "value": "bcef4faf8c56d1745cf781fc92cef6ef5c77270b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998369, "uuid": "1f4a3276-f163-41a7-984d-b5491ac4afcf", "comment": "Malware payload (Formbook)", "value": "0e5ca3e503b9e08d92b2da55dd192251a96df98be9cbad6d0380926c90b05c9a30a71d31b18ec0ef7fce26a5345c6a9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998369, "uuid": "3f94f1db-4d64-4efa-b04f-42d48bded1a8", "value": "T1C5E4E05976386C6BC73B21F9C055BD520BF1A82614DDF2DDACC2B2DA18EDFD0029069B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998369, "uuid": "ec7b6ac8-cd42-488c-a9e9-e61e8dad408c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998369, "uuid": "f8a84d91-c8a5-4f74-bc6f-905e254fd68f", "value": "12288:KwPW8ScNZ2D7xorQpDjqn1R9/vVbYvsFQr+Tz2qsHUNTEf5O0byWOwH6qYX4X4yG:+Yv6WaDy3/NbV2qsHwieWOwa3om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998369, "uuid": "3f023b00-0e16-4dd6-a775-ead52c46120d", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998369, "uuid": "d907656f-4bbb-4389-8a0b-8ebe18b12153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998369, "uuid": "a7c912ca-1c20-4424-9efb-cc28fa32db9e", "value": "ORDEM DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0939a8d-30d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1690942229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942229, "uuid": "a4d2e71c-c5ac-4335-b766-db924da8003f", "comment": "Malware payload (STRRAT)", "value": "995ca70970ba6e4d999ee2dfbbfc7f1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942229, "uuid": "ef642dbb-f30f-4228-8459-e3dacad57b9e", "comment": "Malware payload (STRRAT)", "value": "8099fc889ce5489392b542688188cd015f67328743bf009fbf4c5baad8847a30", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942229, "uuid": "7148f74a-8f1e-4042-b92b-d1da4a22dce5", "comment": "Malware payload (STRRAT)", "value": "7565846e823a178a3c4dc8890fc5ec6073b10ccd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942229, "uuid": "d9dd12ca-51aa-4cf0-a9d0-65adc6055063", "comment": "Malware payload (STRRAT)", "value": "8ab0ed218f2e7bafa10076483007513a6b7b9649f9debe3b63948bae943a78c9654c9335b27aa573d8bfa2eb72837564", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942229, "uuid": "31226277-3deb-4ca7-881e-ee28b7ed75b6", "value": "T1616505C510693B158B11FB644735D032FC68F9073AA606EE7E6C3B4BBE798146EBB520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942229, "uuid": "b6f305f5-cad5-4b65-b6aa-4edcc3166878", "value": "6144:QQ2MoBKRIRSS1c23L2Isl6yYWR+A2EbHcc46MQRCs0z7/sSiWRYAnMtJZWVL1Gxn:Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690942229, "uuid": "fb8eb5e6-5a09-4805-b538-3ea5144ddae0", "value": 1493974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690942229, "uuid": "a98d583a-cf4a-402b-ac9f-6e2274a8a3e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942229, "uuid": "d2bf4ca6-5d87-4674-819d-81e38dc6c1df", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e543eeab-314d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690992112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992112, "uuid": "aa85d700-22c7-4482-b95e-ec0835e78a25", "comment": "Malware payload (Formbook)", "value": "00e2917356ad724e3f79e42da2b9b92d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992112, "uuid": "05ac326c-cb48-4c9f-996e-196c27b5eb0b", "comment": "Malware payload (Formbook)", "value": "80c33b55bc86034d5aa09175c45672e6bd847ed97938512772926f0d9285dce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992112, "uuid": "66ff3daf-58c3-45a6-ac56-6d1ceca67b7a", "comment": "Malware payload (Formbook)", "value": "e564ed8660919c10570fbad143ffd1333b81fb47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992112, "uuid": "0602756e-bfaf-439e-b625-56c42250bbe0", "comment": "Malware payload (Formbook)", "value": "cb6775bdf44a53749f89f489b9900c0bc85054dc7a3931f89721776374087c9a2283ce84c0667b29915c384fc80b6c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992112, "uuid": "6d373a39-195a-4fbd-bf88-1163705484d2", "value": "T1D8E4CF047168ABA7F43E9BF45554418007F697BE706EE78A8CE6A0EA1B60F540F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992112, "uuid": "2d604db2-e9b5-404c-adae-251cfb805b82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992112, "uuid": "f3512bc4-00ef-4314-bc9a-64cdb4aec79a", "value": "12288:W5MYNp8wGcM1iwYa3ZOVv5A1zoiGz5BNvS9x8Z9YzzjbN:W6MuWa3ZOnIzoPz5BI9x8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690992112, "uuid": "9dc3c967-5130-4891-8b51-94a557351f69", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690992112, "uuid": "ff4cfe08-4042-4911-8d39-fad7865ab588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992112, "uuid": "64ff227d-ca74-460a-9eae-9848b1a325e8", "value": "rDHL_AWB_907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1473fdb7-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690965992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965992, "uuid": "66cc7fd4-03ea-48ea-af8d-320caa895224", "comment": "Malware payload (AgentTesla)", "value": "dbd272f9c24b7ad08ef51f3bc70de99d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965992, "uuid": "8de4a265-6e3e-4c23-906c-5272f58cd2a5", "comment": "Malware payload (AgentTesla)", "value": "8227055b0090562a073fd35b7ddd31091d00a279ffadf9835b175ac659a89b53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965992, "uuid": "ef94d79b-ccda-4641-bc5d-2a164ca1961b", "comment": "Malware payload (AgentTesla)", "value": "b35119bf5c2562e46b23a62bc1e582b032733287", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965992, "uuid": "5a640bd5-dc92-4ddf-85a8-1e83ce9b8aa9", "comment": "Malware payload (AgentTesla)", "value": "50517f05b289106c3069847daa264a67d8fcb2f1a77f5d079fd25db6562176d8144a8c4ec68d1811a2d1d5dabb4ab5a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965992, "uuid": "c377397f-e2db-44bd-9142-bd1f6ad4d788", "value": "T1F2E41A0432E16EB1FC6D63B568AA344403F0A8BB5872C35EDDC325DBA768B9605CD9D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965992, "uuid": "3994522a-f130-4e14-aad9-3610543ace0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965992, "uuid": "adfdc196-154f-4bae-8046-99b42570c788", "value": "12288:9DeFSpA465cMHmbJpKFPpLZSt3Mr1zKeHaAim6omUg:peFmAxcMIiLUOr5Keri2mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965992, "uuid": "7aabb31e-f7c3-4dac-afb5-91eabf884fd2", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965992, "uuid": "fb46e0dd-bfb3-4afa-be2f-807ad5418dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965992, "uuid": "82427e28-846f-446c-a125-ab0252ff1ff4", "value": "5789987654SKL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec89dbb-310e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690964855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964855, "uuid": "0afad546-c123-4561-b11f-ec4368f99ccb", "comment": "Malware payload (AgentTesla)", "value": "a3342a7de23db1d515960cd4cb8638ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964855, "uuid": "7a98029f-5124-4f7f-90ac-b3ec03d9b731", "comment": "Malware payload (AgentTesla)", "value": "82bf11dd3ec8a163f69c3d679d40bae987f44dd9fbecc567b845d28a9d61e481", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964855, "uuid": "c8365bd8-630d-45bc-b58c-8fbed9d577de", "comment": "Malware payload (AgentTesla)", "value": "b9061a8747c72a590b942f57a3125afc64afad1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964855, "uuid": "a9093d73-c021-4a6c-a6cf-4e5f8be393f9", "comment": "Malware payload (AgentTesla)", "value": "218cf1bc428a66a009947f6cc3906a549454dadea288eb493cb03a899471c8f67db4a8b75a631a86fe5a18ddff18226e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964855, "uuid": "276226e1-33dc-4540-a337-26f175bac358", "value": "T1F4C423D9243373D696F1FDA4000DAEC4821F1164E4F7C135AE349B5D9AA79FB283A319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964855, "uuid": "197cab9e-54bb-4766-a6b1-636796e51cd6", "value": "12288:VNPmLfDWyjx7WVlvgYdi/pDGvKSdVMDNQJpLTfsMK4CjaU:V1qWyjx7WVJgYdOqbMDNQ3LDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964855, "uuid": "1cc04587-c4d6-455b-a30a-49c131fd3238", "value": 559909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964855, "uuid": "5cef9985-1adb-48bd-8cb8-a3650287baa0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964855, "uuid": "b5b4bc37-691e-4565-a21f-3e08a5508cf6", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc56ec2-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957575, "uuid": "fc9172ef-5034-471e-b01a-936a2f8c0b02", "comment": "Malware payload (Formbook)", "value": "d26f55feb7e6512985179ca639909b59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957575, "uuid": "20297820-ac48-4706-9505-b1287e9258e1", "comment": "Malware payload (Formbook)", "value": "83f51eb7ee412687c303f4ff90ffe5107946be3dafb65b205150b50a00f59842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957575, "uuid": "ec2404d5-5be9-4614-8ad3-0193542c6078", "comment": "Malware payload (Formbook)", "value": "25f30c0caaa7d2e22c3a397be71dd90beba5b67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957575, "uuid": "8e087986-1697-4811-a364-7bf1ac99ab54", "comment": "Malware payload (Formbook)", "value": "ee7d045c173443c739c1d79c30bd8fc4d45d73985e8d39ff89e46f78ebca82875c5c22dfe7de8fe3afc915e62e6ba552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957575, "uuid": "b94245d1-ff7d-429f-8dbc-3625f75a8dab", "value": "T19D44124077B0C4A7E0835F75193A82756FFEE82954B0BA0B27616E1D327235BE90EB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957575, "uuid": "83db786d-01cc-4b03-b35e-544c60f57523", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957575, "uuid": "45273dbe-0a89-4c3f-b6d4-b82b483b3f75", "value": "6144:PYa6YLePrpg2NNGUyf1XImRqO9LjiKTGmKuwsvlhLdK:PYGSPVgkM3X3zLj4wvlhLdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957575, "uuid": "eddeffe1-d16a-47ea-ad30-67a793617784", "value": 257859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957575, "uuid": "c95b82af-1e0a-4d6b-b200-a069a5966c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957575, "uuid": "b25e9d14-e741-4b5a-b5fb-e7d30f4699c3", "value": "swift103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c356f9-3161-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691000723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000723, "uuid": "e692c89f-43f1-405b-9ee9-55ae5bd3edcf", "comment": "Malware payload (DCRat)", "value": "0689fd8660ebfea0d9bc34cb13ce60a5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000723, "uuid": "8e5e38d3-6e60-4f5d-a908-d5b2d0ccfa25", "comment": "Malware payload (DCRat)", "value": "8666a3ad40d9249085f1791115d8331e509210ad805df1ea77645c2c83f63733", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000723, "uuid": "aa8aae3e-8e39-4834-b67a-10911901364e", "comment": "Malware payload (DCRat)", "value": "a4220b5dd5094fa105acbb93e9c99b39d0a5ac01", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691000723, "uuid": "700ee90e-fb9a-4822-b4e1-285db114263f", "comment": "Malware payload (DCRat)", "value": "078648a32cd9838e71e6a8ad2565df90252634392023c8606973b6a0359319e553ea8bebc7469b8f02919be3c04a65d2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000723, "uuid": "ed660eb4-641a-4faf-8a8a-9c0e9e19f3e7", "value": "T1ED95BE027E44CA16F0085633C2FF894847B0A95566E6E32B7DBE376E65123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000723, "uuid": "f4a83d30-154e-49dc-8565-f4838a00784a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000723, "uuid": "34ff59f8-6e3b-4557-b012-9550194ecc21", "value": "24576:+heeAC7/Y5Y0jkrWs62DLpJjslu+lilyPZnOhHXA6pyn0d7nZYiS5jim1Qw+6OdA:+hYCw52rTpxy9OXAlnO7nZYigZ1Ond", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691000723, "uuid": "a63a4436-0142-4e70-8d8a-6b25a554e40c", "value": 1936384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691000723, "uuid": "7deea322-61ef-4635-b70a-3b974d54fd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691000723, "uuid": "05076565-8c4f-467a-9dbf-f767fc7dfac0", "value": "0689fd8660ebfea0d9bc34cb13ce60a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8c9c5b-313f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690985980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985980, "uuid": "bac555bd-a3a2-4cbd-b60b-7b1036cce328", "comment": "Malware payload", "value": "e28edf5d0a4b4fe3c9c1afdc35c8e8d3", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985980, "uuid": "cd8e96c0-f086-40fb-95c5-7ad0c5e430bd", "comment": "Malware payload", "value": "88425c2ac2665d77e8ddc8bf06a44681f8f216aef2b6b5919dcb0f7f8c21c81d", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985980, "uuid": "f080e9f3-845b-4700-97b8-226580ae202d", "comment": "Malware payload", "value": "68f299796c32ab4c7f95ea2a22fac6f27247e5da", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690985980, "uuid": "971d4d3f-eb32-4820-b6c5-0901f2b3d757", "comment": "Malware payload", "value": "78bf5dc985f374ba4c58ad9865ae0f113100c2b88262941e20f8b26384ea6151fb2786388baf137008ec6c5081c500b4", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985980, "uuid": "ad04cc6a-a628-441d-85a4-0b0f3ffacb1d", "value": "T1A8153BDEC5481663ECE83505AF39D0BA0F18CDE5346482D7DB2AA6EF8518C973CE744A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985980, "uuid": "831d191d-5053-4341-b201-cd15914fc968", "value": "6144:H3+Lkuz6kuIOgK4mcBbBb+nSreZFGsYgiQHL1lDtLF7wjAO95Ii3fdLGmSkiV8Kt:1oeZFGsYgiQHL6nSkiVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690985980, "uuid": "f88ee763-ea95-4fd7-a2ce-d52bb4a46f38", "value": 948754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690985980, "uuid": "2de40d91-59aa-4e0f-bc24-868d6e71a1db", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690985980, "uuid": "53a37404-13ec-4958-8b91-16b7a8b5bcc6", "value": "message (1).html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb0f6d5-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998191, "uuid": "9baa3b80-532d-408b-a917-4e325ddcf1da", "comment": "Malware payload", "value": "65b91e327202a978ff3622528182b329", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998191, "uuid": "2c3c13ff-56f5-4890-885e-1ac920e93a6a", "comment": "Malware payload", "value": "89e3a3eef60d85f033f12bea8d4c8480cc8884498a69641b33eff23f03418480", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998191, "uuid": "6e31f1b3-5858-461d-a6c8-88c402714e72", "comment": "Malware payload", "value": "824c94edfc879eb719175be69a434f1242af67dc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998191, "uuid": "a7b228cb-0c1f-4cee-a491-d77c01ccfe1f", "comment": "Malware payload", "value": "a5502a74a5806d9b9f1f3955464c9aa0ebca265c9c57f388a63e91a9ab4b2978d3abca759e90e4feccea64efd4767574", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998191, "uuid": "7fdd59a8-25fa-40c0-94c4-7c3cd427261a", "value": "T14D6108F317199C09EA7E5BE30684BE481B657266CBCE54857056FEF20613233CE264BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998191, "uuid": "eba998ae-0fa8-4627-8173-58ccf503a985", "value": "48:nNFLZgxAWwNIeM0oOAzxl1JRgaPuH89QDw+WRT5sKe8MY3uG9KcUfkEGk87qE:nTZg3iIV0gxgHSf+WRFpN1TEGfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998191, "uuid": "bd52fbc1-261c-45b1-9d08-e23a98e62973", "value": 3231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998191, "uuid": "bdd909c1-265a-4ba0-a5ed-602175cb0149", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998191, "uuid": "340d2433-506d-4bcb-ae2a-99cdec030115", "value": "00067-1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665369b8-3105-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690960975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960975, "uuid": "4f55dfb1-d81c-433e-ba1c-f05f3d3f741c", "comment": "Malware payload (AgentTesla)", "value": "bb62ed76c8d03c0382d0eb0dd062270c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960975, "uuid": "898bc9c2-9e23-430f-a48b-30b5b7cc8858", "comment": "Malware payload (AgentTesla)", "value": "8beb92a6f2e2a9c7245de0d996e68c4de4d6f555cdd85bed4fd8ccc4f158045f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960975, "uuid": "be3e8e1c-80a7-4e83-8593-cb0cfb5ac8b6", "comment": "Malware payload (AgentTesla)", "value": "a5c7c2e337233b8aee8cfc4ff018566328432124", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960975, "uuid": "0e4727da-3c30-4ab7-8593-1fcb6e5cb425", "comment": "Malware payload (AgentTesla)", "value": "88fd5615db1f6b952ca4fcecd644b388cdc6b6836e85ff1b1ecc5010e33567ab3a06b8f9176e33866d0addb96f60cd42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960975, "uuid": "c6ec47ad-e61b-48c9-9d03-5da19c669078", "value": "T144D4239CBFFD9B47929A949AEBEF55D89C0B4D08FA187577C39122C8B314A2314CD093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960975, "uuid": "ce352c47-4267-4b55-afab-19e4cb2616ef", "value": "12288:EmPsuFkE19ZgdnU6ANYZZakyVyx5elyBtjwd1GyN07zjzMxs0oVtIGfjkWigXNH6:LRNZgWpYLaqxoUwdQGKz70itDYWDtMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960975, "uuid": "4aac9cc9-1c35-48a6-b53d-5467a668bcc9", "value": 613825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960975, "uuid": "61dd977a-88e5-4839-9005-1eced06dde6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960975, "uuid": "375df8c9-8c14-40a8-975d-380a2a05f2f9", "value": "Shipment document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4d8804-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690964285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964285, "uuid": "162c3438-ac1a-43c1-a9a7-0ddb9a09905a", "comment": "Malware payload", "value": "4abef2820528fcdcffff86e69844ad98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964285, "uuid": "61401217-b926-4daa-a03e-7e89fc85da54", "comment": "Malware payload", "value": "8c40d76914f39b38ed06ecb329710965a889cfbf3643758b2b596e49e211d42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964285, "uuid": "0c6a08cc-4dee-4cab-907d-58805b98eb4d", "comment": "Malware payload", "value": "e8402a48d9a9d97b3724c299275dff697d73fa33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964285, "uuid": "049dad9e-0246-4eb1-893a-8b776f33ddfd", "comment": "Malware payload", "value": "6b7e3e3ab1501fd204077441316d48e21da4cd4327fe21497d4cff05d801afb5e675df5f8faaa7ecef454e35f3b6c13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964285, "uuid": "2e0ebf79-974b-438a-bca3-9d17345f1790", "value": "T176246C0AFA40EC31D988C77555E4816EA8A4B41F1371016EE72CFAFD3B00AAD77A527D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964285, "uuid": "c8b70233-c12d-427d-bb94-d8f8c1068c3f", "value": "d60d682fdf44c3b365a9f13963453850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964285, "uuid": "c8d1c1b1-dc65-4472-9eae-e2dad7aa5d91", "value": "3072:AYVTDsatamLy4qtkNd+7LQVuTa7xgvNGqs7TD7t9f4TpzAxQ:AYVToaS+b+7LQVuIQNG1D7t54TpzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964285, "uuid": "f2fda4b4-70fa-4785-a760-e33567678594", "value": 219312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964285, "uuid": "1b6132a6-ac08-4145-acd5-236111b7735f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964285, "uuid": "4201dee6-0acb-4c72-9a5c-7604d7409de7", "value": "4abef2820528fcdcffff86e69844ad98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44669f0b-3118-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metasploit)", "timestamp": 1690969079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969079, "uuid": "228a3701-3275-4e0c-8138-dce3f7cd6411", "comment": "Malware payload (Metasploit)", "value": "3b16f8252c9793cc0e499186612b9209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969079, "uuid": "8051e3fc-6507-48b7-b93b-de78412ab4dd", "comment": "Malware payload (Metasploit)", "value": "8c4429d6c19795810381897252d1a310f14b3bd1e6fb448619afe0decf2fa688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969079, "uuid": "34f9c7a7-bc9a-4310-b048-5692523b6b12", "comment": "Malware payload (Metasploit)", "value": "1510218eccc95ee93bc924cef5be8c6e982475ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969079, "uuid": "f693c6cb-ad63-4b1c-8430-bc57535b05e4", "comment": "Malware payload (Metasploit)", "value": "47f79e785da7dc446deb694ff698dabd4462d6f3b82c1ade5ce9e6b6b84799726e3c7d69e4e8c134ecab98ea6e4b9d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969079, "uuid": "a8de4fa7-717e-4cb7-a830-2906b2992c9b", "value": "T1F7E3124BDA1585B2CC63DD763AC1ABA3963B659D2F322B6045D10D353E72222CFCEE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969079, "uuid": "ee51de4c-d604-45a2-b9df-c3a995236b17", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969079, "uuid": "5b9d437e-78e6-4f62-ab9f-febe97b448dd", "value": "3072:03OVNXgWYmutXzUO8oD6mvwc/+HC4UNJjEenSDAr48GZhkf:cOojXAnDXixjda8GZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969079, "uuid": "e78a7436-0773-477b-830f-bcfc8a8a481d", "value": 149503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969079, "uuid": "f89e1a89-6c9d-488a-9773-5dae64cf6d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969079, "uuid": "5b711b4f-e170-4f94-a808-7934fccc86c1", "value": "8c4429d6c19795810381897252d1a310f14b3bd1e6fb448619afe0decf2fa688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1531a1ee-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998635, "uuid": "ce478df7-f1b5-4390-991c-864981d92250", "comment": "Malware payload", "value": "d4dc50cec8d2adf7016def3a087d0967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998635, "uuid": "7b889c31-461e-4634-acb2-24fea3fd4f6a", "comment": "Malware payload", "value": "8cab8c469e6d189481f0f2787f7b550bae9a7efd3c79bb7e2d84b58f8731d28f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998635, "uuid": "37830649-dd1e-4d96-af22-e8bef3730c2a", "comment": "Malware payload", "value": "02895535548a6c84d1cf97a1d60df5ab79b3e867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998635, "uuid": "c4d21a79-220d-4a93-8cb1-136722781323", "comment": "Malware payload", "value": "066bd39d7fbf844325ee37b73deb8bb96389814f0dad79054157305d8146fa330dd913159a0b74d462ca136317e587c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998635, "uuid": "fc8052f4-4cd6-4bb7-aab5-f8782c5de40d", "value": "T11BA4C01265A0E432E5274A714D2BC6E43A1EFD639F2557FB22043F2FBDB13E18662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998635, "uuid": "dadfecc4-81f9-42c2-9e07-1f47f8a9c84f", "value": "94188224113cec6f774a38879ab75dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998635, "uuid": "7d811af4-5d71-4eda-982f-73be7bad1b36", "value": "6144:YFa71pQ4+Q3Ni0aOKzEl5ZOzphtkG12UQPUbGkm58PH7:YUm4BdvaOnF0ztrfFb8OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998635, "uuid": "ce68a05b-5e8b-4e29-939b-b5d15283fd5d", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998635, "uuid": "880c7ae1-763b-4e0c-b734-c413e90316ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998635, "uuid": "a55e04e7-d1dc-4429-a263-2920f9bce155", "value": "d4dc50cec8d2adf7016def3a087d0967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5000084b-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690966092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966092, "uuid": "ad1da478-8fd8-4a74-b7da-8d91072bf1f3", "comment": "Malware payload (GuLoader)", "value": "9127b986f6b8b55cc8faa723accd3658", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966092, "uuid": "4adb8207-7bba-4429-95ac-16a98bda293b", "comment": "Malware payload (GuLoader)", "value": "8dd3efc8964659b8c8543d8ccc9b76768cb98eab1080f17a3e7ef31f4df1a2e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966092, "uuid": "680a1fbe-bb5a-49bf-a79b-5e3703bd285b", "comment": "Malware payload (GuLoader)", "value": "2c00263ac7b91fc3a150e3bba231e73d3d2672fb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966092, "uuid": "413c7377-7212-4e09-bff8-7dcb2b9ffc5d", "comment": "Malware payload (GuLoader)", "value": "fed8b0990a86a20ae9394c9d007ca3047c03661f746fd6efd1e51203657107e31bb8eb8a2964063cf2e10075c2a2ca5e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966092, "uuid": "755fb326-f683-49e4-967b-c3770dd05753", "value": "T1BE32C301BD951B3C1C8D7A67ACF39B05F068CDD55EE4C99EA1B8921E3066048B63FB4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966092, "uuid": "1e816171-5c40-451f-9eb0-4b9add8ad6f4", "value": "192:EL2f6ltP1LsfgyTWEgF4nssbpPtNchpSKBZV7Ej9m+OSgGHTz:E6fUNwWMbNtNcnBva4QHTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966092, "uuid": "aec9007e-eb1f-4f5a-b667-254d21b79076", "value": 11075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966092, "uuid": "b1f04e02-5272-4d43-9aa0-141d1fb6a6d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966092, "uuid": "29fb5446-fa2c-40c3-b368-263cd5f5fb33", "value": "RE INV.NO.1423200071 DECOSTER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d514443-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690998622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998622, "uuid": "ad185b10-854e-476d-bb7e-4163db4de829", "comment": "Malware payload (Formbook)", "value": "549506be461e63f925b424b2f6011916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998622, "uuid": "b782ff6d-6fd3-4822-a422-fd389d018f81", "comment": "Malware payload (Formbook)", "value": "8e1579332c108b91cf104ac63a80be9cabcd918086bcd27248e59467776fc863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998622, "uuid": "ed6f7436-424f-4eae-bebd-aeda778f9e61", "comment": "Malware payload (Formbook)", "value": "809e73cea714e24c15f65c27eff6371723149323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998622, "uuid": "aa94973f-18cc-45cf-a876-5db8e260fd13", "comment": "Malware payload (Formbook)", "value": "fc7dcd6b69306fe53d7a3f29a1408ca1b237cef0af2d2e2b66316a6fa41093efc348f3433f70e93f9a5a54917d6c1a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998622, "uuid": "2abfdebd-73e6-4f7f-b93d-739e88d93654", "value": "T15CE4CF0572ACEBA3F83E97F45454518007F553BE70BAE74A8CE6A0EA1A65F540B40F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998622, "uuid": "9bfd1c9f-5f55-4e3b-b768-8531974468f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998622, "uuid": "778c217d-1637-4755-81f1-bdddaf649b9e", "value": "12288:S5MYH1VTW4TmZnXmQtXQ7SHbtvTug/gjtkb9:S6wrbTmJmQtXQ7S7tvTuacCb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998622, "uuid": "50e6dbb1-bd45-4a3d-8bf5-b62535089690", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998622, "uuid": "554342ea-df01-4419-bd6d-bc828cc6a48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998622, "uuid": "f8ac0a59-e8be-404d-8295-11fcd7a12568", "value": "549506be461e63f925b424b2f6011916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53cf79b-312c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690977912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977912, "uuid": "08ee41eb-b956-41d2-8453-3e38daa49099", "comment": "Malware payload (Formbook)", "value": "2acd7b3b8a45582bfef4acd017e2e7dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977912, "uuid": "3a84d43c-905c-46bc-b1d8-59c0d45e3d5d", "comment": "Malware payload (Formbook)", "value": "8f3d2a2b923d503ce8532fa82eebe012ec48f013860e3ccef64918a575bb5e7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977912, "uuid": "e0414519-23c8-4766-8d7b-afc307c9916f", "comment": "Malware payload (Formbook)", "value": "f7c1890cb958f24059dc789972b3d42d0b3c0862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977912, "uuid": "91783a74-b0da-46c0-b3e8-8cda82aeca85", "comment": "Malware payload (Formbook)", "value": "d6cee66844f3aa3dd9930f99ea4ccd81741ed2f508b5845807b967688bd540ede24f1d7874c1bbf905826c2c9a456107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977912, "uuid": "43549ea0-31c4-4561-a2ae-751ed89aac13", "value": "T1AAA3197C65E74E31F87F9A779EE9B0A587B6E1111906FB6F08C252930F52B808D070B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977912, "uuid": "305d9d5e-2417-477f-9722-a1893b5e2767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977912, "uuid": "fb9bc997-b22a-443c-83d3-7a24ab795e96", "value": "1536:dyBAP0EpLHy+SC8Ec/1jN6Du/xHsN568FBUj+l8I1xOb4LjHZngTP:YiPj5S9EuoDjN5zFdZWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690977912, "uuid": "c2a334ca-7b8d-4c9f-8494-4a6d08de4622", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690977912, "uuid": "b2376512-f4a6-418e-938a-9ec2ab0277d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977912, "uuid": "b8b1bcd4-687a-46c2-ba7a-d7a7b3a580a2", "value": "8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deda56b8-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690957741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957741, "uuid": "a879f6b1-7ae6-4519-850e-b27e7af2f88d", "comment": "Malware payload (AsyncRAT)", "value": "1da8d6c16662e383b822b6bade1a22a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957741, "uuid": "21ca3a09-cc03-42ef-be29-766508057a3e", "comment": "Malware payload (AsyncRAT)", "value": "906508b262d2368fd44759a9e491f9e708cb42d3739f0ea437df02398938c687", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957741, "uuid": "82f59bc6-612b-477e-a6cf-6611f61efdbc", "comment": "Malware payload (AsyncRAT)", "value": "f387576535d540d1d524baf725161f7a2a3365e4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957741, "uuid": "73b21a93-a4c3-4e80-ab2f-c9c167c563b8", "comment": "Malware payload (AsyncRAT)", "value": "f6c752d5453575edca9f5e7fc8cfb39aa79e4c54f9cee94a76fe88e6affdbe5b868721b3ab87a022d42e4802da7ecd5e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957741, "uuid": "a1e1ed4a-d2bc-418e-8503-ebcf92ce1956", "value": "T18604CEB8B59789D8F54F9981757CFEA1013231F39EC91E610328A6049BE9FE92F4448F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957741, "uuid": "03e41fde-4171-4758-adf0-fdb5f15ea3f7", "value": "1536:PAccX5et9RYOOAJhRmp/XWMkhfes/bwXEX0oMjK7pY8WB0AdHE315bMCR3AplBbh:tD7YOX0Ha8JE315N3ApcXmTWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957741, "uuid": "28f5f496-381c-4359-a528-4a058131e57c", "value": 182308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957741, "uuid": "60fe8401-82f9-4d74-b187-23549124f8af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957741, "uuid": "23451263-f4c9-4671-8981-6d02be0f028a", "value": "moealalah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207b44ea-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963864, "uuid": "2d90997c-af1f-4ea5-a778-f7638f498004", "comment": "Malware payload (AgentTesla)", "value": "8111115449f3fc5784b73a58cb8028b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963864, "uuid": "b38d0569-f954-47ca-9661-bfd631c96861", "comment": "Malware payload (AgentTesla)", "value": "912c291e74f4ddf5f81b8b8bebaa38cf485efdf91c8cca544b46788f0f5f8318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963864, "uuid": "23aeb930-38ba-4ad9-9f9c-200b052119fe", "comment": "Malware payload (AgentTesla)", "value": "52539ad65ddaf49279420b98ef504c38476af702", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963864, "uuid": "76c03645-f021-4730-b4dd-d977e76e6912", "comment": "Malware payload (AgentTesla)", "value": "7fbc6e3c5de4f1e916f764683b288c5d77e85475072b49ef416586d3c0966e6031eb340ccc6a9a35331c8367a3fe948e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963864, "uuid": "75dff83a-567b-4113-8e16-bef8fb0c85a5", "value": "T1ABB423B8B8DFCB06CB7457EA5345704990A6EDDEECDC0B2B502C9F70A959BDCA84E140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963864, "uuid": "a83c9e03-182c-4e46-b9a6-08efb8aa46b2", "value": "12288:NO6yU74ZxTjN8N+ZmmXfG/8lE5MLgefVprrmAK/H4wS0:psXf4+smvlgMEsc3/YwS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963864, "uuid": "001abf60-800b-4faa-a479-e988464b9603", "value": 542081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963864, "uuid": "2e933009-6ebd-421f-ba07-d1b36103ffc8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963864, "uuid": "aa9c897a-774a-44b8-a0d5-a07ceb0720ad", "value": "NEW ORDER_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71709a7-3122-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690973539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973539, "uuid": "4543f10e-3d8b-477a-b8eb-ccc988242479", "comment": "Malware payload", "value": "74e05774d4b337db735ed514ad7608a4", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973539, "uuid": "dce013a3-72b3-44ea-aff4-e2ec95384ae9", "comment": "Malware payload", "value": "9148c9e57308be4b95e04838b202d98bb670e49c9ab095a4196ca4cd7f144cc8", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973539, "uuid": "9f3bab52-05cb-4fe9-a277-ab6bbbfebebc", "comment": "Malware payload", "value": "6d63b3b06f7e3c262f58d63c326d96683467fd9b", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690973539, "uuid": "22c95ede-6076-454b-afb6-9a4f43e3ed34", "comment": "Malware payload", "value": "c321a3938d043bf7df111b588e2755bd08f861db9c606d099ca89d73597c2d57556b7a2b160a6d468c33b321a1c56809", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973539, "uuid": "705232b4-c00d-41a4-8044-85ad9812229f", "value": "T147D02E050FCA8B5D0422C0C5BE3A595EC168C5086ED82B0A8A240C2E4034C48B68B38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973539, "uuid": "03dbd7b1-7c84-4051-bd0f-f0278a8b473f", "value": "6:CxBR2hn23f0uTHfFlCe8UlLAHbKx4+Im5TMB1hn23f0uQn:cnW2MuTHfFADC0v3m5TMJ2MuQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690973539, "uuid": "50dbf2e7-9e3c-415a-9c4c-0fa2d6bc3281", "value": 248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690973539, "uuid": "2ff04bba-a4a5-42ff-a974-911b5adacfd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690973539, "uuid": "51c095a4-c64a-405c-9fd7-67e4348eea26", "value": "qweq.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb998036-312a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690977117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977117, "uuid": "dd7919e1-3d51-4ae4-84e6-6bfdda81069d", "comment": "Malware payload (LummaStealer)", "value": "82a23ac6ab8feca626e5349bfc78016b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977117, "uuid": "722a6614-d684-4d1c-9030-c60ef70c5d09", "comment": "Malware payload (LummaStealer)", "value": "916501fa512033a03383d68108940333fe9ab091e68a3b4ec7e25a891e4825ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977117, "uuid": "b868d903-6c03-4542-9d3e-19437237ffd4", "comment": "Malware payload (LummaStealer)", "value": "21e88359c1f1d152e32ed71e33eff8bff467eec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977117, "uuid": "4f135f03-60b8-420e-b1bc-bb1daf92da63", "comment": "Malware payload (LummaStealer)", "value": "7333e106236063313f7013dd480578e9cfe8ba752b856f7901ffcb901fca801b0ac4148d08eb18595b340ce46a412cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977117, "uuid": "6c21a44d-a3a7-4b80-b72d-741f1e3414c9", "value": "T120E63312406EFC41FBE05C70F6E29625A67ABC7B18ED98E9F11657783E60C692C35CC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977117, "uuid": "b06ace8c-10dc-42a7-907e-5c53f3e60827", "value": "377a97652fdf5740d8cc11d5ce124fed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977117, "uuid": "027f4e01-4541-4587-a208-26d497c1e6a8", "value": "393216:AAh2aQXgWYpiIXF1jKGEbLnRh2aQXgWYpiIXF1jKGEbm:AAkfepiIXFsRkfepiIXFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690977117, "uuid": "e9eb3805-5804-42ea-8900-847cb7d8e607", "value": 15201696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690977117, "uuid": "171bf490-d44d-4ccd-93d7-91402d00f2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977117, "uuid": "ee8c464c-6684-4404-b69e-80b0e854d1ed", "value": "DaVinci_Resolve_ver_18.5.2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876bea11-3150-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690993243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993243, "uuid": "5c711d76-858f-454c-b801-e2b065764ffd", "comment": "Malware payload (AgentTesla)", "value": "a0b45ec760b319213c9c677ece3c9c5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993243, "uuid": "c4788594-7e6b-4cd5-8dbe-41e686a371a2", "comment": "Malware payload (AgentTesla)", "value": "9266476c2c9172dba146796c4ace1a8cc0ce1a926a45347284f4f41e4312a8e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993243, "uuid": "ebfd647c-7c84-4440-86ce-1e7643e04caf", "comment": "Malware payload (AgentTesla)", "value": "c04cea6a2dc9d4bf3044b5bb24c885ff915e455c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993243, "uuid": "9e32cf78-a21f-472e-b26c-8509f08c4877", "comment": "Malware payload (AgentTesla)", "value": "53125de118fb12f3f4c800e4c71ff3beea29701276f0fe31763118449e02e04912033fe9d832cc97cac0ba9a324450af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993243, "uuid": "e10e8ef5-cc72-4095-9be3-2040dac9d6de", "value": "T19614ABE0317D93CFD1A28DB10FC98AB079F135AC98C4160DA0F69B2E93D6355589C9FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993243, "uuid": "f877ad35-761e-496f-8db3-b8caf1a364a2", "value": "1536:Xnhqp2/cVJQrtA2AY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgn:Xncp2/wJQrtT+9wqY+mhhhmitqOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690993243, "uuid": "9f88931d-7ca9-4813-9358-d39fce33f01a", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690993243, "uuid": "2cf1ef86-3461-4b33-b215-282b2ed9103e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993243, "uuid": "d87085bb-57a9-48b1-ae61-669a31de2060", "value": "ritem0053902503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8905ec40-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966187, "uuid": "990eaf63-fdbd-47cb-80d1-e7e2cf83de30", "comment": "Malware payload", "value": "7405b4a27d514d4e902df7462212f764", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966187, "uuid": "c76e5685-68ad-490a-a16a-f9956348bf17", "comment": "Malware payload", "value": "953e4c59be680bbdb2b577bf5a2f41748a1aaa5ad577a032d2b92d491d0c779f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966187, "uuid": "fea5d21f-a560-4468-97e4-6aecca4042d7", "comment": "Malware payload", "value": "763de09016d44ee3bc961aac138af0b4e4092c83", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966187, "uuid": "92173da6-f587-4d1e-ac97-24659ccac06c", "comment": "Malware payload", "value": "d7c9d538cb09cae0b6143934d7123807cea06ee0537075b896316e99263f7c57848390ad528d29eb716e9d7779e19321", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966187, "uuid": "80f0b1f7-7a7c-4705-ab6a-716a68bd9c92", "value": "T1BCE42309518001D6DB501CA392327B748BFBB66C5618EA3D723F2D99A4DBEC0FF65A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966187, "uuid": "eedb2412-fa34-4f6c-9fe9-bc58320b9a0a", "value": "12288:L2nWYcM80bYqiLmdPptHDKmgS43iQYcflOU71ogQb9nll2+iTnY:yA50bYq6YdfgSMjd69nvfKnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966187, "uuid": "2995bb8c-1ac3-4a2f-93d1-36de33007531", "value": 679453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966187, "uuid": "c46490d9-8a5a-4a09-832b-30860a4b2077", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966187, "uuid": "dd13d63d-bc39-488e-8c9c-00eff841c163", "value": "PO No. PO-1-08-000276 - RISCO (VAT).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f072e89-3106-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690961366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690961366, "uuid": "89e419b4-0b7b-46f9-b56b-95df63f253d3", "comment": "Malware payload", "value": "5706d6116d5621d932c745a0528ab9a7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690961366, "uuid": "f44f59d6-5939-4c5f-bb25-98676cbb5778", "comment": "Malware payload", "value": "96435116036a60721193eae3aaed145ab019d97f2d23be25dca9e4e5dfb9c138", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690961366, "uuid": "c409e643-6030-4d46-b121-12c1f8afd694", "comment": "Malware payload", "value": "ac1e38b8dbef42c367e5f881438db6e04ecddbf6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690961366, "uuid": "5ec193a8-3f3a-4942-a3e5-3e45b8278fbd", "comment": "Malware payload", "value": "d796591c39e6164b7751b8192e0f396906b8dc1a36e99b024139d170090d68489735e05c566e9daef45f64d610f765ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690961366, "uuid": "704e9245-756d-4dae-b8ae-52d3830114d8", "value": "T1F0B2E024F487A426DCC6C17A51EE63F7D20484AA7B53FE5C040B3CE8C9764BA47B946E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690961366, "uuid": "050b2013-3621-46cd-9239-69f0ed5b3394", "value": "768:neeXhslszfIpCI9I3v2ql2S1uhOtKSTgP5joyhM1/B:njXZfIpCsmvX2S1uktKS+doWM1/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690961366, "uuid": "bd6dbbf9-da11-4ec8-bf16-67a8b3f6ddb0", "value": 25344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690961366, "uuid": "0c75519a-2104-4dbc-84ad-4f3525b18de4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690961366, "uuid": "041ed6de-985a-4464-b588-73c13e3fd199", "value": "FedEx Delivery Express Service.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3945bf-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957870, "uuid": "1ec663ba-ecac-4acf-b8aa-82b0f867dae2", "comment": "Malware payload (Formbook)", "value": "e6fc2510446e719bc6668c1d7b3ed3e1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957870, "uuid": "c687fa48-d1c3-4c03-95df-99de0331963c", "comment": "Malware payload (Formbook)", "value": "96d499d5587b5696b6ebd51dfc6693a99a3dca6f548876d31e295d075f61cbf0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957870, "uuid": "3cf86032-ad8c-4c26-84d5-f61fabf21c53", "comment": "Malware payload (Formbook)", "value": "14037671e4eb879bc3bd2d2bf8db9beb40917d49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957870, "uuid": "403b49f1-067b-4c1d-9e2b-86f7da33b15d", "comment": "Malware payload (Formbook)", "value": "f7e779a65ae08b46f0682197e6bcb1a5baca1f2dd0baba648bc719b29e30be9e01a5af4ab48a5427f2d0eb32fb54ccf3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957870, "uuid": "df6616fd-0764-444a-9567-2a0c52a37f82", "value": "T1ECD433B0EC506A74D82AE250665E49A49FA7C7968C40CBC391FD1F077E1A1B6F218DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957870, "uuid": "f5369515-2af0-4d2f-9226-5d8788e26961", "value": "12288:iYrxLXkEsEPc9SLDAwNyTrpZ+pWc/gIDx33Aaw5iih1H4WQp:iAbNcCvyPpMppRaatiEtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957870, "uuid": "d4950850-0b6d-4e31-a4d3-91f80291e9fb", "value": 622617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957870, "uuid": "f13a05f7-5939-4959-a794-cdea3d1f09f5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957870, "uuid": "8af04230-109e-4e8a-a395-b09f8ebe8be6", "value": "INV_19CE2022POO38_xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cbc9e8-30f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690953884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953884, "uuid": "44ddb972-d285-4b9c-b896-1c651388c4bc", "comment": "Malware payload (AveMariaRAT)", "value": "1e121f211154ea35481f600f70ff4896", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953884, "uuid": "408e9a59-51d5-4284-9044-2c622c186ba4", "comment": "Malware payload (AveMariaRAT)", "value": "9733cb0728ddfe72f5ebcaeda6f7898e1902d51173bf8bf370be319f103a616f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953884, "uuid": "5992a808-04ef-485b-9c04-116b6ac30938", "comment": "Malware payload (AveMariaRAT)", "value": "fc5cd57e6105e1b3b65d13ae01833e4df3a8ce69", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953884, "uuid": "73105173-2d91-42bf-86b6-3aefd6728fac", "comment": "Malware payload (AveMariaRAT)", "value": "bc32e0319c94cfdd4e59463847d2bde95f044785e45a33afe281a04a08b5af5a2d6263490f935e27ad7aaf3406a25cb4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953884, "uuid": "bce40c45-b76c-4858-b7dd-01f90123a686", "value": "T10D74CE0F6AC621B9C0A48870B7FAA1EE4AB5576F251567E7249813FAEF0171F71020F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953884, "uuid": "0404ded8-c2fb-44b0-b537-a7a3aeade916", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953884, "uuid": "ad1dbbf5-e04a-4d97-8006-f2f4183f4d46", "value": "3072:h9TNwme7IkrAsypLIDyimbNWo/KwlppAX/JhkF/yASHAMGzl2fcU+FguHDYdX+pU:Wme7WPpL6mbNWo3lYMFzSHxlQYKNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690953884, "uuid": "a3d1f2ea-251a-4634-8a46-5a86a57d8554", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690953884, "uuid": "f9651a96-45aa-45ca-a2f0-c6defe017a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953884, "uuid": "8e6dd28e-ca03-4ef1-a574-c9eff5330ecf", "value": "inquiry.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d800f54f-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1690957730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957730, "uuid": "41e2fd80-b0f8-453e-b597-d7bc1cb57034", "comment": "Malware payload (ConnectWise)", "value": "705ae22db89f22f487ae4aae3d4439a6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957730, "uuid": "f3fa2735-a9d4-4419-b487-6e93895191d4", "comment": "Malware payload (ConnectWise)", "value": "9837541f645ef1bb826a418f7d393531b1457ee8097d438aa3d317534297543c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957730, "uuid": "24bb6b86-b264-4128-94ad-e596f047c59d", "comment": "Malware payload (ConnectWise)", "value": "89d7dc47c75f00e60b334eefe7db7a8b38bbf56b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957730, "uuid": "d2438503-4dac-4c18-95b4-dc30875ddf07", "comment": "Malware payload (ConnectWise)", "value": "0bec27c14c547f8227f223cca432a19344b97f9703a126fef969593357d58b21c4814ca52d18cc51b3b579849b3defe4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957730, "uuid": "d4190a16-7a21-4a3c-86d6-75815f081cba", "value": "T16346F112B3D591B6D07F0638D4795266A774BC098322C76F63D4BE697D33B808E223B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957730, "uuid": "4683df20-15aa-4698-a647-bf8ab323de15", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957730, "uuid": "07de8233-453a-49ae-b8db-42e9b33ed34a", "value": "98304:FfmE6+6efPU3nWn4bGbq6adYdsrGLPygQfpBA:pMefPUoWnsPygIpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957730, "uuid": "1e342835-3697-4ca2-91a2-40a33eacebd5", "value": 5378832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957730, "uuid": "4c8b1876-b87b-473b-be44-707816b8b614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957730, "uuid": "ef1ddd38-a3a5-4b87-a067-c0a697db1144", "value": "Adobe.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bdb81f-314e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690992249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992249, "uuid": "b2a33e74-2785-4df8-890c-c3e43421e8f9", "comment": "Malware payload (Formbook)", "value": "9fe21a8e373806c2db3c33a7f7278e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992249, "uuid": "ff2d9c26-4828-4ae7-9a22-d931e800fcb7", "comment": "Malware payload (Formbook)", "value": "98e4b2b479c6cda9e759825e9b9996e27d8bb5572108eb1eec336b8c1e2e623d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992249, "uuid": "27f5dce1-11c0-4ef2-9994-9a9dfed1dcc6", "comment": "Malware payload (Formbook)", "value": "2bd8b60633d1dea77896dbedcdc484c83cfbce12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992249, "uuid": "218122b9-8837-4f23-b922-d3bf3464405a", "comment": "Malware payload (Formbook)", "value": "66f6ad23d8e597519d11480adbcdc3582f6894365d37266a8b975f58200d54a95c6f43d84701ace9cf89cacb231ebea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992249, "uuid": "55a4a473-d712-451b-b1ee-1a7255ff0fbb", "value": "T1E8048BF0317D83D3E1A18EB11FCA86B079F135ACA8D0560DA0F59B2E93D2395149D9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992249, "uuid": "036012a7-8c05-4f90-8cb7-f998d5ceed78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992249, "uuid": "f064f6d0-a0ef-47c7-a5f6-47ada2ebbf11", "value": "1536:sEKTlHdAAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgn:sJl94+9wqY+mhhhmitqOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690992249, "uuid": "d55a8f3c-f3e0-421b-b650-393297846e07", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690992249, "uuid": "028d3a66-06d9-456f-b184-b038abcf495f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992249, "uuid": "34809953-9148-4407-a574-e12f7df9aa70", "value": "rNBBNkI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606f1f3e-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690969555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969555, "uuid": "2daf8be9-f53c-4aba-98a1-03cd5e792187", "comment": "Malware payload (AgentTesla)", "value": "06e8b35be02f02b6faa8b5c63877fa93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969555, "uuid": "b4878b4d-7436-40bf-a58b-1d0f38b5273c", "comment": "Malware payload (AgentTesla)", "value": "995224009fd7cb63eef774208d209cb3af834ad3cb754b046f9cd14ce1c4354e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969555, "uuid": "7aaec076-97a4-4b67-b99d-2943b8978662", "comment": "Malware payload (AgentTesla)", "value": "09adba78341b06ef30849afabb1821acab785531", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969555, "uuid": "22936693-5b48-4778-92fa-919994c57bec", "comment": "Malware payload (AgentTesla)", "value": "9010dcfefb3fcdaf639118a9ae8ab54a84f4fff628e648e77e5b27ee54f96217ec282e4610377c4bf2767ad656ea01ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969555, "uuid": "81bf0513-4ca6-4d2e-b267-d061b0c94149", "value": "T1FCD423E43EC4DAD0DA65237868E1C791F3E5596B17E0D163272A953EF7DE0C2B89202C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969555, "uuid": "78e471fc-0d6d-4869-ab59-b6d06abec94f", "value": "12288:xjGsJ/guiDS7ng4Dq6+CYWpx9EMCXAy+ZrPB/RFfrqK+mcoTuJ:NPpguiDSTg4+6+CfETsLzqK9pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969555, "uuid": "2564a26a-53cb-43db-9c56-6a95b8c0bad0", "value": 612544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969555, "uuid": "14e7d8a0-9de5-44e7-8be1-c32121d30a87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969555, "uuid": "7e940482-821a-4f8d-ae47-025fb4e331d0", "value": "Purchase order_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b381fb1-3103-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690960205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960205, "uuid": "d8be1888-952d-4638-9bfc-db7a58b82524", "comment": "Malware payload (Loki)", "value": "0ec1d84d5b4341f2cdb130ef101e816e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960205, "uuid": "7916b6e3-fbee-495c-9f2f-c1f6e809e5d9", "comment": "Malware payload (Loki)", "value": "99f5e3a59b1b019cd00d00d5a0209b99b2ae94ae02e8ff395b194a4ccb7873ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960205, "uuid": "2de6348e-4460-408e-9d24-a9c8ccb1e7e5", "comment": "Malware payload (Loki)", "value": "06b7e6c7ab9c3c709e3d8fd106db4a979ac75996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960205, "uuid": "0ce7f18a-1e2c-43e0-9cfa-e381574caf69", "comment": "Malware payload (Loki)", "value": "be5c449c42241839ef390b1ae6d2a1abd7415ca0e777add9de6ab50e480cf9535d7426d3c17d1c275fd34b5b6a153420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960205, "uuid": "3d6fca51-b110-49a2-944e-13b6b1b4b904", "value": "T198D47D7406A6C60BE42B1734CCF2E2B17FA99FA0A2D2C7474FE47DFFB44A0566691094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960205, "uuid": "1695c24b-b48d-42fa-9a64-272a62e6ddc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960205, "uuid": "964447d3-066f-45ba-a063-fe9157eebc84", "value": "12288:MdF0BaoGoCSk/L/jPChvsjTgee1m9EZpNC:C2BaoGoCSyLrPC1ifDiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960205, "uuid": "d83d8f53-39c2-4c4a-bcc7-9a7662ff258c", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960205, "uuid": "4f2e5b43-8100-4d9f-853f-7822661b5205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960205, "uuid": "5e10ce9a-d7de-417a-a3a8-cb5d0ffb8d1a", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb37f7f-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690966084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966084, "uuid": "38389e88-2295-4915-b122-2fa73406bc4a", "comment": "Malware payload (AsyncRAT)", "value": "06d80af354ef7a679604e055283a6a4d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966084, "uuid": "e373ba00-12e8-4902-add5-beb15c58c0cd", "comment": "Malware payload (AsyncRAT)", "value": "9a26938a0e77297b36fdb44bf1b5a7fb9d7a745ac67681c6ae7db9d721ad4c9e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966084, "uuid": "df86cbb1-1def-4955-a2d1-e8fbe9df2766", "comment": "Malware payload (AsyncRAT)", "value": "d5560ba9ed066e39b0f984523780e8f4a5b82437", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966084, "uuid": "62e2b2c3-f558-4ab6-a80a-049084fcd573", "comment": "Malware payload (AsyncRAT)", "value": "5f19009be01353b1e1d1b90684502d45090fa5dabcbdb7d6f4483211e9d76799dfd10513ead4f90f863874104acfa60e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966084, "uuid": "2ff41328-1c64-47e3-84c9-5916825a4c46", "value": "T192236D4037A88136F2BD4BB4A9F2A18187B9D6673903DB5D6DC410EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966084, "uuid": "4a7b54b0-bd2f-4b3f-8789-b260a4797275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966084, "uuid": "c474f083-3f45-49fc-af5c-d798bc667fed", "value": "768:P6T3ILNCKi+DiBtelDSN+iV08YbygeLTcyhPuegiIvEgK/J9e+Vc6KN:P6YmBtKDs4zb16venkJQ+VclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966084, "uuid": "91b725f9-626c-46b2-bb84-dc51db82a616", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966084, "uuid": "5001a994-f966-48d3-b7c6-c89b2ae68c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966084, "uuid": "d10c52d8-014e-4f76-a488-2b4a7c08a834", "value": "06d80af354ef7a679604e055283a6a4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0505ff-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690967320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967320, "uuid": "e0a1ac2a-0cc6-4a15-9b27-3153249c18ec", "comment": "Malware payload (Stealc)", "value": "9c80bb86beb564ef1f02f0de1e45c829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967320, "uuid": "da9653ed-faa6-442d-93b0-73fd9c304f74", "comment": "Malware payload (Stealc)", "value": "9a34f51bda3056e9f9f721277cf9f6b9c890afc4196b590d016edbb45753b505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967320, "uuid": "f795c2f2-0892-43f8-ab8a-44efcb05ae27", "comment": "Malware payload (Stealc)", "value": "7ad51514c97fc4534bb369e58e8f3c7dc8d576df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967320, "uuid": "aa718465-88fa-4ff2-8ddc-4311b16129b1", "comment": "Malware payload (Stealc)", "value": "c42f10854617b8b3558acc40f5893840e903445c25d3901fc6e4385127206b483f5085762bcd12d4dfeb9aa1d71aa086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967320, "uuid": "7a82a9aa-cfda-4025-b64c-98375a600d27", "value": "T13B549D02B691E872E62605718D1AC2F4796EF8748F195AD777483F6F29323E3DA32341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967320, "uuid": "a4a9b086-c838-4e13-9691-8e591a3be785", "value": "b960f8af34a227089edf1078d597a8fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967320, "uuid": "6b4bb87f-bd2e-475f-9e7c-a775e30cdec2", "value": "3072:AdFnGZZybL+ZuqC9LdznddC/mpsTtqKKbp4S3u1AjVZ/oYlBNssQZrgc1VmpXh+v:Q0ZmL+ZuqILdz1V/b+S3t8CYec1Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967320, "uuid": "0ed2ef7e-588b-45cc-a6ff-7221dbcf85dc", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967320, "uuid": "efb74177-8b51-473d-8dc6-51e0c50cff25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967320, "uuid": "1584f238-9768-4a34-884f-225b09961053", "value": "9c80bb86beb564ef1f02f0de1e45c829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7be4f19-312d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690978372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978372, "uuid": "c6061fe4-081e-49e1-b0ec-20f425e6780b", "comment": "Malware payload (AsyncRAT)", "value": "53ddfe229bb020d36166edb9b5d722f8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978372, "uuid": "3b17480f-2862-4d07-9a84-9be722589cce", "comment": "Malware payload (AsyncRAT)", "value": "9c98af46658c1d03d1befdb088719d324f3891f05c1a6b1b2ee436a5a5552ec4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978372, "uuid": "90682f88-7907-4d67-ae2c-bbc6a34f3af0", "comment": "Malware payload (AsyncRAT)", "value": "f0035ce182a1c107ef8e08fa96ea22c558db8c18", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690978372, "uuid": "0ede7431-575b-41af-82c1-33ddc6961050", "comment": "Malware payload (AsyncRAT)", "value": "a85a8ba99b65787c4b673d4dc3b921cb4cb8cc9029b3dbb0ce6e7b06cb6662115d8a7278bf290eb6615dbb24b43d7726", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978372, "uuid": "dfaeab54-f83a-46de-a872-d18ca014724d", "value": "T160348E1437DA662AD3FF97BCF46401158372E403662AC79F2ED498E91CA3315E980BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978372, "uuid": "2992add9-412f-425e-9e0d-c79df3a92a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978372, "uuid": "51046778-553e-411d-9635-79159276c7ac", "value": "3072:2+STW8djpN6izj8mZw9KalFI8OSyz6UbB2a9w7F9d16ug6+WpP:L8XN6W8mm0OUbwrFzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690978372, "uuid": "6db911fe-0581-4f07-bad4-74368e3bebfa", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690978372, "uuid": "4bd71f00-3eb7-44bc-8aeb-68ebf87302d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690978372, "uuid": "391bf9ec-4df3-4622-aa7a-b99e43ed2183", "value": "9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123776a5-3105-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690960834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960834, "uuid": "49789271-e3a8-4ec3-aff7-cb73ab7bd5d5", "comment": "Malware payload (Loki)", "value": "2143b220b86ef2aed0bd0c85e55163bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960834, "uuid": "e88841bc-6729-482c-9347-9b418db015d7", "comment": "Malware payload (Loki)", "value": "9e726ca17b0ed11fdfd4a221c9905c31a701b7afc28088e638195123f60f450c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960834, "uuid": "3aab7347-e69f-4f66-b5f4-9e061edd626f", "comment": "Malware payload (Loki)", "value": "3b828ade6a8466918b4cc5f6938f190cd268cc94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960834, "uuid": "031c8ccf-51fc-43fc-9c55-fa378ddad4f4", "comment": "Malware payload (Loki)", "value": "67fdeb0a652db30426d59f3704f53fe6b724d01272c7fb57ee8c89dc7eeea795301cc3ea4271d0174b0112a4cd53e1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960834, "uuid": "5298e66a-dd38-44e1-b078-346302df8066", "value": "T147D4BF047268ABA7F53F9BF49414519407F563BE706EE7898CE2A0EE1A61F500F40B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960834, "uuid": "17e4ee60-f703-4043-993f-d9b6217e17c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960834, "uuid": "3b217158-fb79-4be3-b5bb-b241e11a3142", "value": "6144:z90msDYOlVL7n2WGprkKyO1r7+5DUo/Vv8CNX49X74T5dZA87YMI7isCOxdzhzpI:h5MYuzDGpzj6hU40CNo90T5nYMGJZJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960834, "uuid": "370a8b75-136d-4bba-93f8-6d67356c8abc", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960834, "uuid": "ffaa39cc-0f19-4245-a3e6-ca04932b2c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960834, "uuid": "f03e7d01-6316-4859-805b-7e7100446ebe", "value": "AWB 1ZY0W5038626871089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69330feb-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690957973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957973, "uuid": "e583f895-291c-41fc-96b1-15b653ef354f", "comment": "Malware payload", "value": "ca1a81367584fdbf3faaef70954199e6", "object_relation": "md5", "Tag": [ { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957973, "uuid": "9e4a9037-805b-4030-b615-374c44199ecb", "comment": "Malware payload", "value": "a0d88653f1ab8ed51bbdf83b53c9a5bab8bceac1393cdedb035f3b881674082e", "object_relation": "sha256", "Tag": [ { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957973, "uuid": "d7d172e0-14fb-421f-97d5-c4a6a87135c4", "comment": "Malware payload", "value": "500f67590763a584fc74c5c64c91244b9f05419e", "object_relation": "sha1", "Tag": [ { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957973, "uuid": "1a0777a7-3540-4033-bc43-670dd764255e", "comment": "Malware payload", "value": "9004d0a75e0adb126555332bf4fdf3035aa621b5221036eb577d0d9473530b88443bfebf4d08d82010dbd2487f2ea535", "object_relation": "sha3-384", "Tag": [ { "name": "lowwhisperedprinters", "colour": "#C9C8BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957973, "uuid": "e31fba48-5936-4ee3-b37d-eaae534455be", "value": "T1225533E976111FF984422F18AC4685226478080ACDC37525743B32BAFF7F7AC993DB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957973, "uuid": "8032b64b-c8ac-4896-89ab-770913a574cb", "value": "24576:A6TRwsmVPkxhFLXuyaLlfySfzqVOVuULXrLJVzBvuBReMVtTODr5F5NiFALWBwX:AX5shEyaJfLfz5VXV1IfVpSr59ibaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957973, "uuid": "c531f412-1ff4-44f8-b501-a3854d0bc7a2", "value": 1396259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957973, "uuid": "6de41d21-f492-45c0-b8e4-a82283962b3f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957973, "uuid": "4e5ac118-fc48-469d-8725-03d13bc34889", "value": "fcd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf4004-3184-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1691015421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015421, "uuid": "4fb767b4-412e-4cf0-85e8-299e1dbcbb04", "comment": "Malware payload (STRRAT)", "value": "5f90626a020c3e1aa91813f49469cded", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015421, "uuid": "b028c769-7534-421d-ae14-f5f15bea8969", "comment": "Malware payload (STRRAT)", "value": "a1cee6f4c2e07b1cde019619a7e6253dae02fbc84ec9513c5d62dc3e6f5edd6c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015421, "uuid": "e1be2d57-e824-4383-a554-6498cc8180c7", "comment": "Malware payload (STRRAT)", "value": "e316a6ccf08b3e96e2addba1a30ccc353feb5fc2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015421, "uuid": "7a71a32c-fe13-44b6-8eaa-6ec3ceeab693", "comment": "Malware payload (STRRAT)", "value": "f339ce67ad789952f4461c5a2074c227cc52a9ed021a1083a7f0c4a8597899b8a1a4349f70891420ff8b35cdfcab8691", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015421, "uuid": "1d88e428-56b7-4e8f-8d59-b1056c30141e", "value": "T103B4220F37CFD428E447947B2684AA6BA65D45D8E28D410F28FC688BADF0E446F17DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015421, "uuid": "e432f680-f989-4272-b40c-0fd40077d4ca", "value": "12288:uCBTkrp/aHmrXnuEopPqqwD74W65DKykNCr952ZymfV5OjefK:u1xGmDjopCTF6tyc3IymzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691015421, "uuid": "ae67a4c2-bfdf-46be-a188-f1cb60545a68", "value": 530424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691015421, "uuid": "84f968c3-9405-4eb3-aeb9-f6345904b0f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015421, "uuid": "5cb9a79e-7a71-4b42-8ffc-5b04d0ff0ea1", "value": "SHIPPING DOCUMENTS OF MV STAR TRADER.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8258a0-30f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690954246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954246, "uuid": "509847cf-0f48-443e-a09f-0d040e385279", "comment": "Malware payload (AgentTesla)", "value": "527455ccafee117e97e3a6524816e2d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954246, "uuid": "25ef7294-002e-4437-8427-2ef18809a7e4", "comment": "Malware payload (AgentTesla)", "value": "a285da59a4bd7b27ff2c1c456dd2570d08ee0583e27f6daecb5ef8a7221420e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954246, "uuid": "a42b1ee5-1b8a-489e-92eb-647dbee09b83", "comment": "Malware payload (AgentTesla)", "value": "7add1bb778e03b2aef86dca9602aeb946f46ea8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954246, "uuid": "eaa0f3d9-8352-404a-8d5b-e515881d4073", "comment": "Malware payload (AgentTesla)", "value": "e169c7316b904e04c51fee62097bb9135618a9774e39e8b1e25dcf401535b08762e190653cfa59c4811b47195ae4fbc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954246, "uuid": "4e2696ee-84fa-4398-bd05-5c515745adb8", "value": "T1BAA4236E9DD548991630A95C742F9DB1BB1F934DE2A020703CB8A4EF83E4CAD713AB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954246, "uuid": "4b8c4ada-5915-484e-9d3c-a47ded64d87c", "value": "12288:jGbC7FLrz5AQRLAJPsUIAEebngtI9wp/4Va:abgLn5LR0IjezgtIKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690954246, "uuid": "d0734d1e-ffaf-4ac3-847c-3f98aa47f010", "value": 462080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690954246, "uuid": "198b140d-9621-4202-a167-461fc04d82cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954246, "uuid": "21fd2585-e443-404f-bd8e-917a72b51915", "value": "STATEMENT IN JUN 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd47845-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690997976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997976, "uuid": "90ff4059-8d7b-4924-a9af-4a23e0ee711e", "comment": "Malware payload (GCleaner)", "value": "a3b6116cfef12679f9e2637967095609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997976, "uuid": "8e2c658b-1030-4094-a854-13764565224e", "comment": "Malware payload (GCleaner)", "value": "a2b422df3574decde40887371056ec3ea271d6889db5873b06c7d770f8a914e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997976, "uuid": "6365a6cf-f0a3-451f-b864-bfa80658647c", "comment": "Malware payload (GCleaner)", "value": "48a5fcdca5a1497f57d472d5b2cb082daf05245c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997976, "uuid": "4dc7489e-f945-49aa-ba61-3b455e4a0089", "comment": "Malware payload (GCleaner)", "value": "fe5c30d9a69e232fbd00b78b8c4920c88983cbd2cdbfc55e45cdc76c0a928e1da5e54122f4df0b0683dd3d7ab1c711a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997976, "uuid": "5d111ca9-d967-4bff-b175-508442847602", "value": "T1D174BF52B680EC31E95456358D2FC2F4652EB8B14F186AC7B7A87F6F2D322E29931341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997976, "uuid": "9999483f-a854-43e3-bca1-431d763f8af4", "value": "7c3b1b4b5a4410f578be5287f7a270cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997976, "uuid": "43752caa-d11e-4402-bc53-305eef4b36ba", "value": "6144:AJtEQ/hLIoBy8BiX2e67AT6FbTTdYV1ziOU3TUuAaXd+ALt:Y/h8qd02e67ATg3Tc1zpUwAtvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997976, "uuid": "f8eb25de-67c8-4286-b3a3-352d51f3e57c", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997976, "uuid": "e884906e-9acd-4ac7-bc82-acab1f94889a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997976, "uuid": "51c93225-b577-4ce6-ae4c-f8d2858334f2", "value": "a3b6116cfef12679f9e2637967095609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe3fde2-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1690965984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965984, "uuid": "28fd6293-a466-4618-9414-6ba96201dda3", "comment": "Malware payload (SystemBC)", "value": "8cf53c2e44bb0ef6483736ded6e4c93b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965984, "uuid": "f6263f32-8b40-485b-b7ca-9db5f49130fe", "comment": "Malware payload (SystemBC)", "value": "a2c10b5d95151fefb06479bdf202bbce96a8f0a2db6398b6d4a34d6d2a1784dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965984, "uuid": "011a80c9-6060-4bfe-9baa-2d59d55346f6", "comment": "Malware payload (SystemBC)", "value": "911902a9efba718fb3261d0fd542b30d8b924999", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965984, "uuid": "9cbe7801-f525-4ffe-afc2-84a08a615c61", "comment": "Malware payload (SystemBC)", "value": "261c360e4d985f262282a83348cdec777a943b420aec279a9d5640d80bdc400f45b93308f3fc54dee532a0eb79b2437e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965984, "uuid": "637f9842-a1f0-4b0f-b6b0-2731ffc61d3d", "value": "T1EA6623BD6244339CC01EC8349533ED44B1FB961E5AF58A6E71EBF6D07BAB814E102B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965984, "uuid": "bf29716a-58c8-4a9a-81dd-b4967eca6651", "value": "3061f6b4aed710e5ab0a75d7025cfa94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965984, "uuid": "7eb737af-620f-4c00-be8e-a9a4b57b9778", "value": "196608:ccGGWlqs135BTOnlEvLphJKYaoMK0FXZ:/GGiqs1JMuLJjMK2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965984, "uuid": "6d8949f9-aa3d-4b21-a0cc-7bcb91aa9046", "value": 6600192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965984, "uuid": "aac214ff-1a0c-4fcb-a0f5-2708b7976d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965984, "uuid": "304085ed-3738-41f5-aad0-98339a698282", "value": "8cf53c2e44bb0ef6483736ded6e4c93b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc8b75c-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690969549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969549, "uuid": "3c7d24d3-ab16-41d7-81df-527f810f2f89", "comment": "Malware payload", "value": "41aa7f620cfc21a315296e2ff806f8fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969549, "uuid": "f8ef79c3-76e5-4027-9f50-c36d5e761254", "comment": "Malware payload", "value": "a42d5f50359b761bf2eaacbe6ac0772ef6711d7dae7b694b18ecad1496fe7649", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969549, "uuid": "77dd6788-2a98-4851-aed4-cd3239a63fb4", "comment": "Malware payload", "value": "89fb4e3233a3da40ece6b77e2f46db22844dcb2e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969549, "uuid": "653ce7a5-8f85-4c2e-bc45-6de5e787cec5", "comment": "Malware payload", "value": "da9fc5a48a72327ae80801ba25c0c4db79138154b166d7827b8d91bd9f0424cb365dff78a501667fc29f882f80a98187", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969549, "uuid": "860851e7-9d83-43aa-8f04-3ea6896d42d0", "value": "T187C423AE02BE9791F2E51AABD5FEDE80BF0DD2668984FD2050791CA4532B52903CD4DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969549, "uuid": "7e9ee3a3-77de-46ed-aa8f-cc6defecead8", "value": "12288:0f6A4fL2SnwuyhtNexOKizE9ZqmTWPLwWIDvPmEshac1rzvO:wL4DZnrc0BizE9Z9OLwWITMz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969549, "uuid": "13f5fbda-62ea-43f6-9377-9d2779805386", "value": 551502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969549, "uuid": "70a39112-8110-4ac0-bb45-d2139efb1726", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969549, "uuid": "d7947f93-9d46-4877-9b25-ab45f95643d8", "value": "Belge_Bilgisi_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d02bb3e-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690967321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967321, "uuid": "20c4fa6c-8d33-4064-853d-15ca1c008fe8", "comment": "Malware payload (Stealc)", "value": "b2c05d6fee47f1c3b44226a8af13f799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967321, "uuid": "10a7173b-4915-4cd5-bf0a-b7d17c0261f0", "comment": "Malware payload (Stealc)", "value": "a52921112e0ccf922d4dbf38d241e5d03fb77bf9940354b37581d4d1c6d86054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967321, "uuid": "2c7059b2-7d8c-48ac-bb42-e203f7d66927", "comment": "Malware payload (Stealc)", "value": "45eab9a0ee2b79760788547b2cc98fb412c40c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967321, "uuid": "ab9b40cc-362e-401c-9a62-9cb6df575685", "comment": "Malware payload (Stealc)", "value": "1c02f3b652c25f77ee218bd712106952cc321f2c35b9b73e8af937107cb5ba5f7cda3c2caed2cd8fd6021a3989c6ed19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967321, "uuid": "3336d258-0de5-472b-b5a6-172e6909d871", "value": "T14F549D12B691D872D46E85358D1AC6F4663EB8748F196AC737643F7F28312E3DA32341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967321, "uuid": "51f4fa5e-e6a5-4a4d-9f2f-66a0c1c1362a", "value": "3a7bb8aec93d4df8411ca71cb120c6d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967321, "uuid": "8e8dacca-ff96-478b-bfa3-9c733cfba384", "value": "6144:DaQxR/d4ZuHkLvKzM+QvsBL70F4X5XMyItG+:OQF4ZuEjKHQvsBL4F4J8yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967321, "uuid": "858cec80-554e-4328-9549-70eb326271a8", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967321, "uuid": "7bb6207c-5411-40be-96c8-85af2ad6da6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967321, "uuid": "7a2e280d-a980-4798-8447-d92925361006", "value": "b2c05d6fee47f1c3b44226a8af13f799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0f8d04-310c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690963969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963969, "uuid": "8e97d281-6fbb-4ced-87c1-33107cb4c5a9", "comment": "Malware payload (GuLoader)", "value": "364d9d7dc423d048962b1b107802e0ab", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963969, "uuid": "6cc9e352-d6c0-4c02-97d1-b5b39f7a1ad5", "comment": "Malware payload (GuLoader)", "value": "a55e1d48ca0f735915aad2fa02564cb0b5cfd4613fff65a2e390be9bb0c2c615", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963969, "uuid": "3b317b5c-5f97-4a1a-8223-2c937c2dfde9", "comment": "Malware payload (GuLoader)", "value": "2308df357f2356857c1b2d1fe80e5bffb64a06e9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963969, "uuid": "5059819c-de7e-40c0-9baa-9aaca03e1d0c", "comment": "Malware payload (GuLoader)", "value": "c328395cafc8001639aaeaacd2ec6740c24e3b04822773d7337a8ccbd42f611217f8e0332327726b50d661b151e45809", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963969, "uuid": "6b7958cb-3c74-4c48-926f-9d8b86d24d5b", "value": "T1AB451263D3E08427D6D44FB40D35162696B69E3C29A1A24B371C7F2D3B3B5820D29B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963969, "uuid": "75fe7755-2688-4e10-9916-ea2af359820b", "value": "6144:UQA4P4MI5QfrwhyAN/2L4FJtRWITG5V6r7hPa10ym+elQbK/0wP+6Yvdz+/3:JVfrzAN/9tRGwx/y8l5+6Wx+/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963969, "uuid": "99545f05-5605-469c-9250-59046247ec1e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963969, "uuid": "0988430d-57b8-4cee-b932-47261c3d2e3c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963969, "uuid": "e0d212cf-01ee-41db-bfae-c1333c3cdc67", "value": "Payment Advice.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf8964a-3146-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690989143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989143, "uuid": "61711a0b-2146-469d-95a1-3a58e78e4e62", "comment": "Malware payload (Formbook)", "value": "ad7c048bf4390a48586c4fdbf45409c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989143, "uuid": "939e8172-fb00-44e8-bfe7-f143c2d19ff9", "comment": "Malware payload (Formbook)", "value": "a5a279ff939e0031e4c3d74d5605cfe84368628d404829bee3943e2e25ff2809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989143, "uuid": "66c2b970-c985-47b2-9c92-6cece51a6bd9", "comment": "Malware payload (Formbook)", "value": "75c89a8ac797d812c7c1f42635d2e6bcad238dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690989143, "uuid": "23301433-0cc7-4eee-864e-69816a2f6b79", "comment": "Malware payload (Formbook)", "value": "caa7fb8cf50d3f29bf38b2569fde6a6ee785f5b1d70552bb5395b0f9974f5bbd554b7d8e7e246aebeffddc2059722859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989143, "uuid": "8eb8ebc8-d351-455c-8f8d-d1799c98878f", "value": "T1A134120079B6D95BD9F61A700D791F577CE6C73624F6872BA3124B68B822383E50DB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989143, "uuid": "7cb6a445-c2be-4ea7-9803-e694213766af", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989143, "uuid": "3a74fc8d-e6fc-42e8-a5ac-c80e8cae8f5b", "value": "6144:/Ya6fN4PECnrm0nVhMuteDhLKTUALIfmL+u6i7YO:/Y1SP1nV2SeDhLKTfsfmCHi7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690989143, "uuid": "43a337bc-bd26-4d7e-a0a3-a08aa9c1acbf", "value": 251642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690989143, "uuid": "8cd7e7cc-439a-427d-8204-a8ab751bc23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690989143, "uuid": "1dd6fdc3-9c1f-47d2-92a6-fa7d3b826681", "value": "FAT - 0035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becd6a64-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998919, "uuid": "fa86298b-7c04-41f8-9df5-34b9f89e74b5", "comment": "Malware payload", "value": "9fd8036cd39bb31e2c8a9102c4333046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998919, "uuid": "68acbe1a-daf8-4c59-a2dc-9c571cd0573c", "comment": "Malware payload", "value": "a707c173b3fae8313b58d2978a7fc7c99ffc421cf9ff13a145bb07704f779274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998919, "uuid": "4aae77df-e41b-404c-8f35-b854a3f950b3", "comment": "Malware payload", "value": "c9b6fe2b2b65e7d6c35330153656428838a9ef54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998919, "uuid": "f3ffeb36-092d-42c0-bf83-42b9fbb36956", "comment": "Malware payload", "value": "58f09795551ebac93cf764bcc7d4787d36be0881014d8c1fc9e83bb7fe9d9d586a0f9d411a3868845aea5ccab763d958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998919, "uuid": "45e6a535-6bc6-4de6-8386-3223ffea74f3", "value": "T187633A212945A032C324A4F8265B7767D13CA9610B3DAFCFCFDA8C741A35AD5B233B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998919, "uuid": "0989fc98-a3de-47f5-b581-d0db7074f413", "value": "768:ReCtDcGNVqcTn/co0AXnlWu65I81humbzwpwpPjOkyz8zEk5OrlZvD4ia67zwssl:RemcU/gcnlL6b1lbCmjOkKzsu0VSKJzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998919, "uuid": "70457787-6f12-49fc-8d4a-ff6312f58f1e", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998919, "uuid": "ba840d8b-7189-4081-b8d9-2b11736bc08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998919, "uuid": "a09cf5a6-7868-4a3d-bb43-2c6d334680db", "value": "9fd8036cd39bb31e2c8a9102c4333046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98702ac5-3135-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690981675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981675, "uuid": "2f556e5b-9690-46da-8812-c536e7190a04", "comment": "Malware payload (AveMariaRAT)", "value": "7456977c738208470a01d84ed531f081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981675, "uuid": "1eed29e6-a090-46fe-880e-93392ff0f91c", "comment": "Malware payload (AveMariaRAT)", "value": "a8365f11592d8734cd2ca079a900cefa76831f672034a234aeab699f0c6cf0e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981675, "uuid": "22731a0c-7779-40c4-856a-817efa9661b3", "comment": "Malware payload (AveMariaRAT)", "value": "bd9083a032ecd51b10b97c95136d46c678508a6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981675, "uuid": "fd94d847-0133-4e60-b15a-9dc5bffff361", "comment": "Malware payload (AveMariaRAT)", "value": "010b420042fd43a266b19785f59e97f956df2a7f6b431abc382c2acbfc19e6346143ba0b786ccd1ab4d968a10086f5fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981675, "uuid": "8e3b2878-fe99-4d4f-af61-cbb97b0a5963", "value": "T1C745EF16B67451B2CD80C735E4E69D2082E3EE5967E2C11979C8776E1B323BE8F078C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981675, "uuid": "20dc25ed-a1bd-4d1a-ae54-9b628701f9d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981675, "uuid": "1f461d4c-a4f5-4999-b004-ad4cc459e44e", "value": "24576:eFjEtEIaUGEKFHyjWhejQ9fzed3qRv0R69H2yedYl3/5L6:CsEzNbHyj4eEQ3qRo69NUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690981675, "uuid": "8fe700e0-36fb-4b1d-8400-53b8865f1b8b", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690981675, "uuid": "9d07d8a5-8297-45a3-aaa5-2e6427963b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981675, "uuid": "7f1f8f68-c97b-47ec-87fc-9071ac8e3daa", "value": "7456977c738208470a01d84ed531f081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac31085-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966781, "uuid": "4bbdec7e-c2ca-4cc9-8b8b-c2d8d3a282ca", "comment": "Malware payload (AgentTesla)", "value": "e827ca6e323cc4ebfd130390d0492b04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966781, "uuid": "39dedb18-1865-402f-bc00-96fc2b0006a9", "comment": "Malware payload (AgentTesla)", "value": "a8643f2b28f130b6889827fd6fb6458dbc5924ea63b7d472590e30893499ce0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966781, "uuid": "c441dc0b-1fd3-4da5-ac6f-48a31775efca", "comment": "Malware payload (AgentTesla)", "value": "a59c23e094cb29dd9680326d1893b0f6f31df256", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966781, "uuid": "2df57def-9e8f-45f4-aa2e-4cb103b04e7a", "comment": "Malware payload (AgentTesla)", "value": "4d584d874033dbcb8f907bbd534dee2af3d3d914dbe7d2cda0badcd01d56f9dc716ec40983f8daed99f39e2a342d8fc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966781, "uuid": "f4277be9-8a9a-432e-b30f-85371dcbc3da", "value": "T15535121975745433ED04CB3014E29E45C2EBAE6D2BE0AA1E25C8FAAD2B321FD8F135C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966781, "uuid": "d1354069-ef52-430c-b6b8-a34884e1224e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966781, "uuid": "1a1d4fcf-0712-4739-a5a7-6d87819376da", "value": "24576:HOpCX4NStY1z/EJ74T7PI+jGYgu3KFsC:HOpJNPi78PI+Gu6F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966781, "uuid": "0abb509e-a5ea-4100-8d61-3f5462a33394", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966781, "uuid": "811e55e2-3ddb-4ff0-abbf-94435b1da1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966781, "uuid": "eb9d40e8-da07-436d-9222-b2b4ac170086", "value": "QUOTATION_JUL7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04567f0-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013149, "uuid": "21a89d0d-3193-4864-8d95-f92f3256b482", "comment": "Malware payload (Mirai)", "value": "bfb09e0f64ef75807a19c098c62da157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013149, "uuid": "f99433b6-ae0e-4bcd-a89c-f191acfdd116", "comment": "Malware payload (Mirai)", "value": "a8b71b79472530e77c1260ddb69569254c24c8f67119ce0bc235bfb4f863eba4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013149, "uuid": "62a1e2f3-51c3-44b3-b466-a98933f7643a", "comment": "Malware payload (Mirai)", "value": "39402286eba3cea6196a11ec059bfbfce5cb02f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013149, "uuid": "8c81eaeb-3cd4-42e3-a6ec-7d4c8344296a", "comment": "Malware payload (Mirai)", "value": "ddd811435d6d416c32e934226fb323cc3dfc58837f7f6dd022477f476e83455e30e09ad92514492bb5e87655fe5283ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013149, "uuid": "e5208f39-5e1b-435d-bd6b-61e4870b4ab4", "value": "T1EE3301036255DE63DD206DFAE7DF48CF345411BEC6AC8CA3698A4C568A82547AFE04CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013149, "uuid": "17a5d290-074d-4add-9164-2cdb1e8620b5", "value": "768:/fZYvZxNZL3eMR/JHxr5BomiASYyVpdj9q3UEL2qEK5J6OAsNTGjf2tl8XOYnZ:kPlJ/txNBomiA+diL15J6RN2tAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013149, "uuid": "0d269b4e-3825-4e71-924b-1070f007ca13", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013149, "uuid": "60cd6e48-4ae3-4bb6-b844-fc4b0f4d6b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013149, "uuid": "7c756754-8787-47c5-9e14-78a1431cb0f5", "value": "bfb09e0f64ef75807a19c098c62da157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0324d570-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690998604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998604, "uuid": "72589b44-0516-45ba-a6e2-414c19ee921d", "comment": "Malware payload (GuLoader)", "value": "08defe80ace1f032875c8127ae5e4481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998604, "uuid": "0ae53e92-5151-4a7f-bc6a-966266228b24", "comment": "Malware payload (GuLoader)", "value": "ac131e3fbcd040f4a5f0dc8e90d3c77bb98d934d5c6696de510ca89f18599062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998604, "uuid": "e96a710d-3a56-4105-85a1-dd128b23e4cb", "comment": "Malware payload (GuLoader)", "value": "2d7ba957be6c89cd3633a63dfd8e925a90d40bd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998604, "uuid": "91119536-5825-4303-b13e-3ff443563b0b", "comment": "Malware payload (GuLoader)", "value": "38711b0494064f26e2cbde5cf373478c952a3870c06fa4efb7bf07fe96ab5c1a8b502c9ca6f04d829067926208e4d8bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998604, "uuid": "66185a10-3095-4b49-9cf6-90b5f0c0afc4", "value": "T13584CE16199F587FCC81AB70797FC20582EF7E91FE05B5F5410A6A0BE83D1EE0A4A4C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998604, "uuid": "5720eb24-d280-40eb-b7d6-29e305ef838a", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998604, "uuid": "28e6c2aa-e466-4446-beea-8a07c21708ae", "value": "6144:3BebKFxUGBNC3Iu5gro6xBcbKiydMdh5BwprYXUdOTDuCUkJf1dqDQrFGCf:4KFxc3Iu5g86xKbUdOmrUUdmuROOkrF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998604, "uuid": "5d4d66e4-ed7d-402e-bca7-c1f7b1d023f6", "value": 385144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998604, "uuid": "c7547116-2200-48c6-9472-29718b3c89d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998604, "uuid": "74176cda-44dc-44d9-8113-2fe78a956e47", "value": "08defe80ace1f032875c8127ae5e4481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c13839-312a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690977052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977052, "uuid": "a3c00b63-37b5-4ea2-8741-09a0f4231f2c", "comment": "Malware payload", "value": "ba035cd43f33110baa0d760b78ef6a06", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977052, "uuid": "cf56c6e4-a2fb-4600-a504-c26c4c1b67cc", "comment": "Malware payload", "value": "ac426e21493afa3ee82c58787a6376cbbffe8facee5a80461466e0cb4c6d516b", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977052, "uuid": "781505f0-70c5-4a91-97f0-91c1bb335927", "comment": "Malware payload", "value": "a421d603be3f34ac2ef53515974dd73f0969c685", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690977052, "uuid": "3e0d5155-81c5-4fb0-830e-79f72c815dd1", "comment": "Malware payload", "value": "c47fa3efc806dd71dffd3ad6db22bc78e42ada5abcc2330e4ecbba4f4c958a40b85f2734dd3ffa19a4c599c5d81a78a0", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977052, "uuid": "e4a6a32f-b002-4ca6-b895-96958ffe9931", "value": "T1051633B1B604686CF3FAD0F71265A81297A7CD094DD5918A1A20FE0324FFA37F89F465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977052, "uuid": "447d6841-419d-400d-a8c2-6c8daf21a68b", "value": "49152:EDgGn00H5Vh3yARIE7svjDpufwUVCjJpzLZGWFjC13UYL3uMnFueCKCeG0iBkxt3:Cd0cJCAOj0fw7P0WxC13hLekueBJGs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690977052, "uuid": "c7127ce5-0a31-41a5-8c64-d9ef0405ab99", "value": 4052538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690977052, "uuid": "07f60c06-c9d9-4e4c-ba1d-a53431cd7c4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690977052, "uuid": "3d6d99ff-5dba-4941-861b-4e98527e0129", "value": "hyper_installed .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113865b4-3130-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690979301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979301, "uuid": "bb127c44-937b-470e-9ff9-1155188a88d7", "comment": "Malware payload", "value": "556c972a4792908bd1056880fbcf6fb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979301, "uuid": "c88dc8a0-8d58-46b4-8501-d4e122ba3dd5", "comment": "Malware payload", "value": "ac7a4330088e7a46a977714c404aad19d381262a3496be2f956ed868eba3b5f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979301, "uuid": "268d72e5-714c-452e-a417-489d4a0fc695", "comment": "Malware payload", "value": "2db1abd5f0a4037a9935d571c4ca7f8e8b4efc15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979301, "uuid": "c8416025-085f-47bf-9ebc-24bc65a6ae86", "comment": "Malware payload", "value": "93cd6fba96a74563a3dee3f94de2fee255cb281518b2aa691747862358e6d86168286b1144e51a8e0b1a9a86b096c45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979301, "uuid": "688fe0c5-351a-4772-93a9-b042fbae5807", "value": "T16D754C12B7625125FCF711FB89FE216DA63CBAB0071894C782C429EE8725AE17D31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979301, "uuid": "e5b84b1d-e0de-4d45-95e0-e8a986d82013", "value": "a420731096450aeb16297aeac4d95b89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979301, "uuid": "7bc6f872-75b6-4782-b6b0-8c6f206d39ca", "value": "24576:4+l2sfHM0lcBAPwaUfJLdW43C5/f4UG4:/ERA03C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690979301, "uuid": "3762163a-e9af-4262-82f2-8fa78fe1f990", "value": 1658368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690979301, "uuid": "65ff3f75-c785-40a2-99d9-d15ca97013ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979301, "uuid": "2e0c36ce-8cd0-45e7-9950-d279e284ac7d", "value": "NWwww#5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fa206a-3183-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691015271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015271, "uuid": "7b0b7a44-fc6e-41f1-833a-c2fcae12a4c4", "comment": "Malware payload (AgentTesla)", "value": "86a5e1ce056d4f26c7adeb72c820a344", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015271, "uuid": "e8ac05bb-0e94-4eb8-857c-2566f6686130", "comment": "Malware payload (AgentTesla)", "value": "acedd97c8350bacc485e87ae56c851d08b497c202deb46df28c3e7218cb4469a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015271, "uuid": "341d00d2-aa71-4797-80e4-a4940697e8c4", "comment": "Malware payload (AgentTesla)", "value": "cb1c978bf940bce4c31cdd83f9d2b1f3fbe3eb7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691015271, "uuid": "7b344b25-8a1a-433a-9a40-20c1ee799672", "comment": "Malware payload (AgentTesla)", "value": "1f711b5be922ce3c01f153c5aaec1be53bdb06f8c03f3505468fc8b0ceb9bf4c291e66eb11bf2d6008b36528c9a14d3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015271, "uuid": "c0b70589-aca7-4b42-b173-1e585bffa9ea", "value": "T1D6F4D004726DABA7F43E9BF45524408407F657BE706EE7898CE5A0FA2B61F500F40E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015271, "uuid": "1ebe95dc-7137-441f-90f8-5cd646d8a590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015271, "uuid": "2fbcfb10-c374-4adc-8783-c91da4fae596", "value": "12288:35MYObmPLnLc78xXs/sYZFxZw2WB6Opb8yPlY68BON7G1Y/CW4a:36XKLj1sUYfxTm8yPlY68BOZh/3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691015271, "uuid": "94afda9f-cda8-4629-bc78-ca4744729687", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691015271, "uuid": "417e23f1-7eeb-4685-ba96-004db09283c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691015271, "uuid": "9f71eb7b-8887-4b46-862a-0fe34c08514c", "value": "SecuriteInfo.com.Trojan.Agent.GFXQ.27864.21788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dde1cc-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690969566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969566, "uuid": "65b33393-79d7-49a2-ac1e-6ad702c5f4d6", "comment": "Malware payload (AgentTesla)", "value": "0bfdb8efcdfccecf6109209114d41699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969566, "uuid": "12e28f35-32d6-430b-b1da-35f47d6765a2", "comment": "Malware payload (AgentTesla)", "value": "ad182357d0814e92424ffee2a432fd8091c8916c7f0996d4c61041d1dab0fca5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969566, "uuid": "046f0f00-49f5-41ce-8337-42f1a323ba14", "comment": "Malware payload (AgentTesla)", "value": "8b9b916c36422059aa4122d682a9971e30b2a5b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969566, "uuid": "c856e685-03d6-4d40-b267-c50e9aeac6a7", "comment": "Malware payload (AgentTesla)", "value": "792b02c6c5ddceca2b00734feb4a48b8c3bee27b04ead8af4d51b1e614dcd05fcbe42d9a2deeed55ad22db5db2b924a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969566, "uuid": "c434570e-8b51-4495-802c-bed3172244f0", "value": "T158A2E1C0E89313E9B5C73F3A688D466AF72BC42951642485EB349D279E50125EBFDC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969566, "uuid": "9f9207d5-9251-47fd-a828-c9f9971b29dc", "value": "384:NqFbbwkCoQVMAlzTQM8hwevN+T8A82BE4zv6FjQ9I39RDVPBuVRbfEFrPwM7x+JB:NWCobsTQJhlvN+5dv6tCw9RDVPEPEhRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969566, "uuid": "b3df2d7f-f433-4c84-867f-22c24012b42a", "value": 23241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969566, "uuid": "2b630019-caa8-4310-929d-5612bfef57a4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969566, "uuid": "1661d24f-c6cd-43be-b136-e3b84ed25455", "value": "\u00dcr\u00fcn Fiyat 10243975 forBicakcilaroto A.S scan%001% .doc.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1a95c6-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1690967298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967298, "uuid": "3bd0e5c5-0b23-45d3-863c-97e9e220e61b", "comment": "Malware payload (RustyStealer)", "value": "20a308e65c20ff7de1f2a1cd047464b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967298, "uuid": "f342dca9-3048-42b5-9b13-547e29540ebd", "comment": "Malware payload (RustyStealer)", "value": "ad91669c04a71d1adedd3800fcfb505734e442a891a532e1ad18c54b05acc98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967298, "uuid": "0cc451e9-b655-479e-af5a-88079cda9f97", "comment": "Malware payload (RustyStealer)", "value": "107b781759d3d51cb1f634d53bc478db5c5a828c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967298, "uuid": "7b05a430-bc90-4659-900d-d865a28db6bc", "comment": "Malware payload (RustyStealer)", "value": "3b564b0ffed469baaa631a20951ec895c50b8f3b451d73619edb7e5bf9cc16bb786757f0ec9410ce5641bde4ab5a6631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967298, "uuid": "02df2a38-d888-4c04-9302-c8741c42f047", "value": "T117B5BF82BB05D0F7C44741B2A82DE77CCA339A499F2186C7F7595A8C6DB47E01D272AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967298, "uuid": "f0f3832d-07d5-4675-80ac-1493a7bf7cb9", "value": "178ccf246b8347cf38428a657085a6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967298, "uuid": "73309cb7-d2a8-4432-8a2c-26c198deb76a", "value": "49152:zJWNjg2jZws6aBeNio8njOpQ7EsIU6iHWm2lOZjS:zajgKZwieH8aqW+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967298, "uuid": "1ddb9552-be13-4f1a-b39b-68aa170cd8ef", "value": 2426368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967298, "uuid": "8b6349f2-a94f-40d0-963d-8af8ecdd62c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967298, "uuid": "efd1b7eb-005c-4b8c-a719-d1d56fcc88a8", "value": "20a308e65c20ff7de1f2a1cd047464b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c374753f-30d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690939227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939227, "uuid": "c4984d51-9d9b-4655-8db5-5594c372817f", "comment": "Malware payload (RedLineStealer)", "value": "3cf8a915753484e08f496e742373790c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939227, "uuid": "fa46930d-a913-4c31-bd4b-ed188a106082", "comment": "Malware payload (RedLineStealer)", "value": "adff96159d1951e2fe540a1449d4c195571b69ba9760570acda4a4d47a6a169a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939227, "uuid": "7cf03ca2-c50e-4a5e-9351-b4392e17753f", "comment": "Malware payload (RedLineStealer)", "value": "ae5a3fb637d88876f39aebfc3ac380dc4316e0d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690939227, "uuid": "d8f33cea-285b-4f37-8a49-6c48216f11a3", "comment": "Malware payload (RedLineStealer)", "value": "ac354e17acc58230accf646cec7a89c001b05c25c49c3e1edad8cd761cc363a020b564a83fb4979402c424ad263b7a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939227, "uuid": "7187dce7-305f-484d-a74f-cd34d38d5b52", "value": "T1B7E611346221BCAB83C59D30756C80EB31DF5978F875E2ADF4D4A4EAC1997F005AD82E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939227, "uuid": "531ac9b0-e60b-46aa-8854-6326c24a82cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939227, "uuid": "b33485cd-75a7-42ab-9fe5-0b972d3418f8", "value": "393216:dN2PnpOPyOsHBPPKIrGxXEgF+gTQCllOMWgyBLI0FW:6CSB3KIOjF+oQ0BGi0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690939227, "uuid": "4fe8548b-6b54-4d40-a599-8a1abb5b7317", "value": 14757888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690939227, "uuid": "51f18956-66cf-4f85-84fd-dd2e4e360830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690939227, "uuid": "7e225dbf-1257-4d83-af0b-a3c606a310c5", "value": "3cf8a915753484e08f496e742373790c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683099c3-3139-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690983312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983312, "uuid": "692c6c2c-2a34-44e1-86bf-ea8c4b5a2a2e", "comment": "Malware payload (GuLoader)", "value": "57189cc4edb7608cdbff2c1dadd154b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983312, "uuid": "c2554b9a-c2da-444e-be09-bca6a5c3fb0b", "comment": "Malware payload (GuLoader)", "value": "ae7ac8999fa98dc985a665e63ee4c87e5c0f7b61b43d9b30bb380f6aeeab5d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983312, "uuid": "560e2b99-9741-4d74-8a9d-0ef65184a53e", "comment": "Malware payload (GuLoader)", "value": "42de13abf4f1550350a2ee383d022c00a6b96db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983312, "uuid": "97e844ef-e737-4f45-98a1-bcdba0b26099", "comment": "Malware payload (GuLoader)", "value": "0e6c2aee40de2d317c3bdf1f25949b9cb4264b9716e8855eac76fe13022e1cd213ee25b5d03ae181701f816ff38cf1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983312, "uuid": "0dc8564b-d14f-4d6f-b44f-dcbb270a810e", "value": "T15B65021428628197F5D6DB30F36AEAB547245932A4B312793876597D8CF3F00BF3A1E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983312, "uuid": "c6e3a7af-5c2c-41cb-9e6b-991c78d8cc9e", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983312, "uuid": "b7877de4-a10b-49f0-b87d-7e9bb4a59377", "value": "24576:wy8I5+eb8yxWHy9+9tLFO4N8SJOw2fkz68PTYKyoV7mSD8vrUiPzzFfazuToeyJf:K9ikzlzyovBirZ/7zLDwWKMkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690983312, "uuid": "96a37b69-b964-4ecb-b215-65ca264635c6", "value": 1514568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690983312, "uuid": "7dc79236-31e4-47fe-badf-29123ce4ec3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983312, "uuid": "5ef06c2b-3ef9-46f0-9952-9fe54c2df3c5", "value": "2308_20230802_REGIA_BUILDING_KFT__443512415141300_NYUGTA\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c090e2bc-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013096, "uuid": "6e8f4ec7-f8d2-4f0c-8409-adb82edef910", "comment": "Malware payload (Mirai)", "value": "fc1295151b08f21f9d777af51bc1b6ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013096, "uuid": "8c5703f9-fe86-4c5a-9aec-7924b3c03e3b", "comment": "Malware payload (Mirai)", "value": "ae8b9b514d115ca5b3d195f466546a7369232b229920c379ce7a1a6f5db38750", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013096, "uuid": "1ad1c11f-ebed-444e-a0af-a74e50604b70", "comment": "Malware payload (Mirai)", "value": "f4607f9da022ec06b194231ad19513adc4b0ecbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013096, "uuid": "5f2c9354-7287-4f6c-baa9-29deeec9c860", "comment": "Malware payload (Mirai)", "value": "ac5e648d5372ec647de47441ed292ac0e16c5c0f4e8ce83bc8f87a8d7145ceb0e71b723688253135c282b08a4c525613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013096, "uuid": "2d8902fb-b470-4b5c-9114-7f9e31f6894b", "value": "T147C2E0323ADF6AF1C2B89CF59D3DC797138B8A977460263031548396E9D1007867D4E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013096, "uuid": "dd5681d9-7f53-45cb-9127-375591b389bd", "value": "384:kXNSIfjdxuZ1DUofVOyPqMQrjH+0a6hX1EZYPPy9KoInn7ohXCaahymdGUop5hkt:AjKX9QrjeK51ESycoInnkX0s3UozSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013096, "uuid": "66639f0b-40af-4af9-88d2-dbd3d769f231", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013096, "uuid": "55fc6ff9-00f9-4a3e-abf6-9451a21f35d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013096, "uuid": "8a582ba2-3fd5-4773-a355-c1c27f50cc79", "value": "fc1295151b08f21f9d777af51bc1b6ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323e1c65-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690966042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966042, "uuid": "bd7df010-baeb-4bca-9bf2-76e8b305434d", "comment": "Malware payload (SnakeKeylogger)", "value": "6347fb31f9109c673ad871a53592aa05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966042, "uuid": "2b298073-bc4f-45ad-b29a-e5c245f76bf9", "comment": "Malware payload (SnakeKeylogger)", "value": "afcf2d75de98e641cb9555de188660470893d84e4c22577cd56f947e5a54223a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966042, "uuid": "553feef0-6343-4676-b000-7663cbd5c9e3", "comment": "Malware payload (SnakeKeylogger)", "value": "e27fcd68f9a792b338243354c758beea0e5699b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966042, "uuid": "24335d3a-b63f-4f0a-af83-d3a8219d24e5", "comment": "Malware payload (SnakeKeylogger)", "value": "a590b43cc90bb44280ae75adaf973a909d64fd5c6ffef402650ef3627d72703c334296c205feb28b7c2d830ed7b8cba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966042, "uuid": "fe130902-2103-4e5b-9455-325825da170d", "value": "T147E4CE017168BB67F4BEDBF49014418007B657BE746EE74A9CE6A0EA1A71F800F41F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966042, "uuid": "fa5d3ae5-8865-4653-a89c-8926a5821711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966042, "uuid": "4070f893-a739-4172-8c9e-dd998a9ffdbe", "value": "12288:15MYIRXDdvSRkM15dSe01rrG7F7Be7oyOH/ElayoBDef3TMMMDMMM:16FRXxvSRkMJArylB4oyc/ElaZefTMM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966042, "uuid": "74c3693e-078e-4e89-8271-341dc043b540", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966042, "uuid": "84d96147-2d53-445d-88d7-053191bb8791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966042, "uuid": "19fff1f0-6d0a-48e8-86a9-5e20575c92ac", "value": "xveXYcYoRA9ESLn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f448978-315a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690997417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997417, "uuid": "b8924915-5626-43ad-b5cf-cb29233fc8f5", "comment": "Malware payload (RemcosRAT)", "value": "001526944d55318789d7b2aac8d8c858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997417, "uuid": "b85658d7-9b20-4ac3-8f35-db874401939b", "comment": "Malware payload (RemcosRAT)", "value": "b06a8e80d889756ef8911732c42081cbeb224a37eb1cf75fa9b0607e2739698b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997417, "uuid": "1f90876d-2247-436b-9f10-727b3eb05c19", "comment": "Malware payload (RemcosRAT)", "value": "e6d7c381f0f6ba83b2ca530a36b43ae73c105db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997417, "uuid": "32c5fa8d-69fe-4fc7-9a9e-2df516c23e94", "comment": "Malware payload (RemcosRAT)", "value": "dbd95e27ae6ea71897a3f4a37c89fb638ba24d91ee295c9527fa7e79edb5284ea641f9c71a8f208148e118870dc203b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997417, "uuid": "ea433fe4-7dde-468c-9b83-7dc48270afff", "value": "T101B4234C32F2C577CE739E335EB6074AD6BA993358A402CB2B5209677C63642E25D3B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997417, "uuid": "a7fba60f-87fa-41e2-a413-408ede289564", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997417, "uuid": "874bd3f0-d415-458a-9cb3-9a9f401b6360", "value": "12288:PY3LhETotiifydbtF8ZLZzsWqctajBZdztH+hsnYxVP:PY3LhE2ydbAzsWqnBBez7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997417, "uuid": "823d42de-e37a-4214-9d9b-71378dd43f36", "value": 497700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997417, "uuid": "c67aa8fd-9883-4f50-9cef-426ee4685b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997417, "uuid": "dcdccf8f-42cc-4834-87f5-dbdbc52761dd", "value": "Order_no 1008875535619 PDF20230802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd3aace-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690957926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957926, "uuid": "3f015b4c-a34d-4dab-9fd0-94592239e866", "comment": "Malware payload", "value": "5eb9c9a21c4a8d51185ef2e84642671f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957926, "uuid": "0e25549f-71d7-4ce0-aa58-29199eb4254c", "comment": "Malware payload", "value": "b202cf94d5826501e30f97b68b9137c34ffd7b058687ccde7a6f5fa8c50df6be", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957926, "uuid": "540338df-0c9b-443b-955d-2e86a180ccbc", "comment": "Malware payload", "value": "ef7a99446a09b81980e5c453b7ccfb380f2e4857", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957926, "uuid": "68cf32ef-ada6-4a47-bb59-a987061a1030", "comment": "Malware payload", "value": "ea440856c7af62b9adc51de0204a107d0711d83d3543ef001aa420449a78cbe48c6ecb9bd9cc5e0f0949cbc2017da3e3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957926, "uuid": "fef13f38-4596-4d31-815d-06332cfa3880", "value": "T19D51087191DCD102D74943E3ADB53C5A4BA1F46609CA1ADC3198FEEA0A6B1389F33894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957926, "uuid": "e196bdee-174d-4860-ba29-1b30deabc003", "value": "48:B8VpOm92MkEh+zfd2ca4UIr/tU6GQVWEiENYraAa+blnTZTVzakDFqvLhMunxTi3:yqaK8VQVWPENYrU+bxZ1/DFqvLCuxe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957926, "uuid": "e9acaa2c-e9cf-478d-9e8a-2c6da964977c", "value": 3081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957926, "uuid": "f3787fd4-84db-4a81-9b8d-62cea4333e2c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957926, "uuid": "9a8aee14-7db8-46f8-9595-1ada6023aea4", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.32179.11441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2f2933-30cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690936530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690936530, "uuid": "c7030f12-1537-46b0-a7b7-a9609d0449a1", "comment": "Malware payload (AveMariaRAT)", "value": "a0e25c8899bc772c3693447477e74152", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690936530, "uuid": "3fbeffd4-70c3-4044-8bb5-5d7bfee4841f", "comment": "Malware payload (AveMariaRAT)", "value": "b7732af06fd165685cca5eececa409585cc0ab21f28bf5bd40ecdc6f2b899286", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690936530, "uuid": "ef711584-073a-42c7-89b7-313986249555", "comment": "Malware payload (AveMariaRAT)", "value": "9a0c6b209d5bb7b62e198326031d8a85c10b8e97", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690936530, "uuid": "d444e18a-5985-4aeb-96c4-2493ae391585", "comment": "Malware payload (AveMariaRAT)", "value": "2b87e57d8bf615b688ed10db527f8f05f377196d2e43334d7032f5905f8378cc2da60cdb51abca0f62e82552ef73e3a6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690936530, "uuid": "99c4f4c2-3093-4413-9fcf-a87f64e5083e", "value": "T16CD4CF01726CABA7F43F9BF45514458007B593BE706EE78A8CE5A0EA2B65F500E40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690936530, "uuid": "f0e803f8-9108-4df6-b5f1-ee740b5911fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690936530, "uuid": "330a713e-14c5-4ae9-990c-46457e69aef7", "value": "12288:R5MYXKAM/B+16d/eMlzi7nitx7jyc5L1J4YVBSClVj:R6UKAq+16d/eMlzi7nitxyc5BJ4srl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690936530, "uuid": "d36a11cc-095c-47fb-b1bc-a023b0f6075f", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690936530, "uuid": "4acefce1-4761-401e-afae-f59ccc60af5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690936530, "uuid": "4120c056-9e27-4294-8746-0324088d6864", "value": "ShipmentReceipt5992241953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827877b0-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1690957157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957157, "uuid": "16630baa-eaa5-40a2-8cd4-32bbcfbbd40a", "comment": "Malware payload (DBatLoader)", "value": "d48d1e3db15e83cc40de753fbe864352", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957157, "uuid": "680efc9f-f7fb-40ae-8478-0a26a8f15918", "comment": "Malware payload (DBatLoader)", "value": "b7c30942928b37d659e6cc65e0bb039ec3a47cde253eb234b0c4424da3ded520", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957157, "uuid": "d687efda-4f1d-4867-9fc0-89b44a5a41a3", "comment": "Malware payload (DBatLoader)", "value": "97fe2d0694bd16da638602d7197555431c8fed01", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957157, "uuid": "d7020d1b-ceb3-409e-b61a-50d7a6b2a593", "comment": "Malware payload (DBatLoader)", "value": "e637d9c8dadb4005ff9d6494d6eb699210c0f00342d051feb683687eeacd41c0f459999f43145144be9b06b01f89644a", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957157, "uuid": "9f501060-e85a-48df-b09b-04cb27c77d30", "value": "T171341DE4644F0876E208AC5D65E47241AE76FEE330C598B123AFE031DF55AF26EC458B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957157, "uuid": "15331769-aa3a-4bb8-b262-cef23120d344", "value": "1536:iOHr45RIi5qfFHfoDg6flVYConFzNYeXDQ7lTX2iCISUPQVzFz76mAg5eeVhMDwC:i95/loeBEVzFtr5RDAw5wf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957157, "uuid": "dda22aa6-a428-464c-b4a0-741da1f90b21", "value": 242102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957157, "uuid": "32a92c04-430e-4897-91f0-b793ec3919b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957157, "uuid": "3db3e621-f385-48e0-baa3-2d326d2bbaa7", "value": "Company Profile - CHUKYO SL CO., LTD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9f3e71-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690966625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966625, "uuid": "4b93c9e2-0899-413e-94e4-78d9b015a8bc", "comment": "Malware payload (ModiLoader)", "value": "b63e2b107bd5d310cb5aed2ce726f373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966625, "uuid": "82c9683c-54a5-4641-8e56-e47f765bd5a0", "comment": "Malware payload (ModiLoader)", "value": "b7ed473d6ef160da52ebd09c3c5f57bb13d12b614140efc6983fd041bf987cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966625, "uuid": "738b0a53-ff40-4d20-8ddd-403bd4aa4952", "comment": "Malware payload (ModiLoader)", "value": "c313d547fe1833a0b702e4cd2d40fc49f525bded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966625, "uuid": "8238430a-c3d6-4cac-8b84-8f824a386eec", "comment": "Malware payload (ModiLoader)", "value": "b58c31802d75e72695d9eed11530fddbe5b7fb4f9ca9e11b26ba7a93851a955e326210a3647f26843d635dd3baee8e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966625, "uuid": "21da0ee3-343d-4ebb-a40c-5750e7e5c211", "value": "T16EE4AE16B2E09433D1732A39DF56F2F4882D7DB12E25E86A3AD55D8CEB7C38128191D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966625, "uuid": "cf8b4be8-40b2-4522-91b5-585e91e7bb0e", "value": "abe2c59837656ecd9cb19dcdd0fe232c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966625, "uuid": "9323613b-dadd-43a3-b28a-30ea0bb045c4", "value": "12288:kMhDOaSuV1vdvOw0s/23EuovrvaI2H4cAAE1J94ZP2:kSl1lGGu4zyc0ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966625, "uuid": "7edea9e0-b310-4e9e-9a3a-e9fdc5729fcd", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966625, "uuid": "73685093-664e-4e65-980c-ce1458051713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966625, "uuid": "afb21bcf-377a-46dc-ade4-0bf26111ed08", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4097dd72-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966066, "uuid": "653d7af0-20aa-4a0f-b5ec-6f19b7e49c89", "comment": "Malware payload", "value": "f9b887f5f2256f976585336e4b1058f9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966066, "uuid": "4d2150bc-675b-4d26-bede-8fe42f993434", "comment": "Malware payload", "value": "b907b464d94598ebc0f0572272ece2a5846d216d0aaa3805242f0ca4f195197c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966066, "uuid": "33f09263-54e2-422c-bf74-bd8abf2a2711", "comment": "Malware payload", "value": "6451c86cc3268299665695b445405e656cacd252", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966066, "uuid": "91e9dec4-0b21-409b-b3ef-92ac80c5c3e5", "comment": "Malware payload", "value": "864008a14f37fa2a15c957d5ff12fe6a1eccfcdf5568c7dadd510bf28c18f3094dccd9998061ef0069bdae4e6299e3c2", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966066, "uuid": "736857ff-efee-49a0-9bac-63ecb4d37e7e", "value": "T1AB448FD373504937E398CB3956E34FE2932EFC2BBE2B46162305331ABA77AD455011A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966066, "uuid": "95eee52f-ae20-44ca-b6d6-1de6e792b57d", "value": "6144:a8rmjPOtyoVjDGL61EfDlavx+W/IEZ14EwSygNgpLnJPHCl7qgqmFdPEKb9jpppW:15q1PHi7bq6V9H00Ykg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966066, "uuid": "46b89577-8b7b-43a0-abde-d33fce246577", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966066, "uuid": "e688ad38-caad-4168-a73f-953d6a640f1a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966066, "uuid": "d3078f52-bc15-43d0-9ddb-10a5e3b889d2", "value": "Mashadi Mokone Rosettas Invoice 19-08-2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831e94dc-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966177, "uuid": "53ee9622-3e62-4ba9-9ec1-3a120e591e38", "comment": "Malware payload", "value": "5895bbc168f0d598425878922b54c017", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966177, "uuid": "58445cb4-671c-4718-932c-7b3d9eb2e63d", "comment": "Malware payload", "value": "b9b0f6ef13ce230a831c4b96cb761616d45ec16b95dbf3a08fcc5f4b10f7e56b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966177, "uuid": "6650c7f3-e8b4-4d96-9d08-cfa4d2debd21", "comment": "Malware payload", "value": "613f1b969b3a75f53b31370e4ed5ddc7e48f46a1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966177, "uuid": "b6dcebbb-cb9c-444d-8e06-5d241398658f", "comment": "Malware payload", "value": "77c0803c393862457f9c30528a268a85050b85b934867c860f8e92220a10ddad3f2f5b00b947513e1c4aef7620642a25", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966177, "uuid": "389a707c-b6ed-4caa-bf55-7875601aa111", "value": "T1C3E423E90241513DFD8A81F2B1F77AAAC7713B28A3C739E2B58847AC54DB950E334E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966177, "uuid": "fdcb7534-1435-4487-862e-7046d922916b", "value": "12288:ZVnWLG74aCy8jqSAnzmSrfSQ9VvAa3U44IdZ3QVMcaWvLdt2vpFEWrFyman:7WawjqSAzmSjSEhk3KZ3lcFjYpnrFyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966177, "uuid": "7e6d9118-2e4b-4c10-a1cd-93060efccba4", "value": 696174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966177, "uuid": "949df251-720c-4e0e-ab1d-e62a186f7b53", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966177, "uuid": "d62f43d4-0cf7-4e2a-8315-386312de8885", "value": "Invoice_202308140026.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec960389-30f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690954328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954328, "uuid": "f4f9b143-119a-49fb-a569-43ea2a242587", "comment": "Malware payload (Loki)", "value": "3bb5b5a4af42d31077274d97f5e828e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954328, "uuid": "6454fb16-80ae-457f-bec5-b3847c3d3efe", "comment": "Malware payload (Loki)", "value": "b9f2a6e3ff5946321af9a9c611553dd49bbe967194afc0b1cb457c288b211d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954328, "uuid": "5f676661-3d5a-4fb3-8ff7-da36808db4df", "comment": "Malware payload (Loki)", "value": "68dfba8644f59a117db3382fc6d4593b549843cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954328, "uuid": "aa9e82f8-5327-4604-9d1d-06640896ddbf", "comment": "Malware payload (Loki)", "value": "93163ad34970dc7ea0aba8dce199995749d660a783d7917bb87bad035f77c0df5e9b9529e412dec11aa4048008c4413e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954328, "uuid": "9bbc272f-7f89-49ef-a717-9ae779e0efa9", "value": "T192F49326413AA0B79F097ABC5E13D87A25C96B40B1F6E198B72F38C3D5C61161D3A7F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954328, "uuid": "7753b245-1756-48df-ba8b-9fa7878e1fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954328, "uuid": "8b9f371f-5f77-49fe-85f0-2d15f4c95f22", "value": "12288:nRju+nOlxRt/5Siw1nOXsDKxZFik2dv67zMpppNpppppoOQpppNpppppoO:nAl/w1O++ZFi167zMpppNpppppoOQpp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690954328, "uuid": "e38d7bc9-a0d7-480a-aae3-ad9060cb825c", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690954328, "uuid": "e0c653cd-82a5-449e-a416-29123be44d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954328, "uuid": "13b777e5-ecdd-47ba-b0fc-ba05cd8b4170", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e71ef2b-30f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690954439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954439, "uuid": "4521111f-5b17-4ab3-a7d9-b3e3a02b1337", "comment": "Malware payload (ModiLoader)", "value": "6fa19067c2ced397f594d9f60442533c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954439, "uuid": "49b8343b-2267-4b51-a51d-b07ba79a53af", "comment": "Malware payload (ModiLoader)", "value": "b9f3f20c8de3b6702aa0c756ea2eb8fa2acb839343a724896e83acb959773f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954439, "uuid": "caecf5e8-160e-4cde-82a8-74791fc0f9d1", "comment": "Malware payload (ModiLoader)", "value": "e4710fa3aed0d22967181e4de053d2cab30d9af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954439, "uuid": "bec37473-1aa8-4b63-ab43-83dc70251181", "comment": "Malware payload (ModiLoader)", "value": "eaeee527734852528e2b48c6d7c2f5bc4dc3d88f13799a8d7552dfeda749876083b04e837c5fbd56abfe379ae945e79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954439, "uuid": "a3b73aed-0973-4fd2-aba9-fdb32d41d75a", "value": "T1F365E062F63D8332D0F25AFEDC4EB365491DFD706E28E4022ADC7E8D9A36291781514E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954439, "uuid": "74fdcf2c-7a22-40cd-b286-73ddac4be71e", "value": "2f4cc4c26fb236cfcb3f37f1dde590f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954439, "uuid": "c2c3f52a-b0a3-4293-b2e0-e05b9e9e5d3e", "value": "24576:a30AU6QvVe3VQihYCjEHKPj13Dhazz9b9ZTZKjsWwySYO/I2jfW7xfSb8OUsfx:aE6bhfj4GBT2z95ZWnwyZO/I2jfW7BPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690954439, "uuid": "7a9b413f-ed85-4355-bfd8-1a3eabbe8401", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690954439, "uuid": "402ef4aa-c298-406b-b051-e4c2f94d80fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954439, "uuid": "46a1c81b-41f9-40ea-b06d-a6b0005f0661", "value": "RFQ PRICE QUOTE.PDF.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af043f-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690997985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997985, "uuid": "5c9f46ba-8b17-4525-a7ef-a3a0c6228de5", "comment": "Malware payload (GuLoader)", "value": "92189d2d76db2a5549f25e35a52a2451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997985, "uuid": "807ebbc0-fcf5-4262-b6fd-b9d88066e196", "comment": "Malware payload (GuLoader)", "value": "b9fdbe8b2868d78c2fbe632a82d102bf5b334b256d21565e3173ba8ebe169ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997985, "uuid": "a2a304f1-8d92-4716-8413-0e718ba5e50a", "comment": "Malware payload (GuLoader)", "value": "59708813a1744a959c35a0412f4bd2cae862ffa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997985, "uuid": "41282f46-95c0-4ef6-af1a-846b76cef574", "comment": "Malware payload (GuLoader)", "value": "d3fa783cda6ce623ba4a97068e479fdf63de65cc31cd3a4dcca93fca08dc3e6e0d9bf956bfbb227152843a43de930db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997985, "uuid": "b5ade07e-1cf8-4eb5-bbde-8c7ecdf08e5e", "value": "T14FF53302DA45D5FBE6B206B06621BEA8DFC9F401E3200717637C9DA6BB94AF4530D673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997985, "uuid": "d0e2a2d9-ff25-488b-a042-98bb51880c73", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997985, "uuid": "918ba61e-f554-414e-9bed-ce68d1e6b7ef", "value": "98304:rZxnMDp/mW16XnaVn/tW5xZIx1OlX3Uzh7v6ExZTuEP7:rZZMD3wXajW76xIXkzhdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997985, "uuid": "69c7c2a3-2ff7-46ee-af4a-a4ca878d7122", "value": 3596632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997985, "uuid": "321952ec-30fa-4b8a-80bf-60e977da8179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997985, "uuid": "54d6fb9a-5549-49c2-b867-03a0ecca5207", "value": "92189d2d76db2a5549f25e35a52a2451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b43cc0-3128-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690975958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975958, "uuid": "c8974ef8-f2d0-4f7c-9613-7ab00115d653", "comment": "Malware payload", "value": "b66f351c35212c7a265272d27aa09656", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975958, "uuid": "5f3e367e-cc6e-4008-9301-bac2f7c38c55", "comment": "Malware payload", "value": "ba4c8e065f601de46ae7844e81921c68726d09345f3db13fb6e3f5ea2d413dde", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975958, "uuid": "9a649d01-178f-41b5-b89e-83b719292e11", "comment": "Malware payload", "value": "c2994b2969f315b189a151d545b35a2c8ed6a2f9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975958, "uuid": "12c289d0-0d72-460f-b95a-2bdb7bf1c9cb", "comment": "Malware payload", "value": "8a27742805086ba94a3df11377087a095dc7f1ebdbf61ef665aeaccf44257e18148f4e99e123031bfc8b5a61b528e89a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975958, "uuid": "adba380a-636e-44b3-913d-19b8aac8f222", "value": "T15B2623B642F36265C2C57E357B34E520AD9E235F791E80318B3B8D62D772A8EE3B1045", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975958, "uuid": "dfea7d65-a5e3-4092-a530-87dde679c902", "value": "56abca643f0825fa28a560c3b98ef712", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975958, "uuid": "69347166-8668-4a16-bc64-93de95a82490", "value": "98304:sParA5bJxdz0l3YIMFQxMKsVCyGPPUpGieNjBVTRB7OQ8TZMQ7caYS3u:6a6rwlLSQxMKeiVRpSnYvIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690975958, "uuid": "92c5a344-6386-499e-a613-7244ed8a7b37", "value": 4614352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690975958, "uuid": "da360b81-588d-4ee6-b131-6ab9275a4879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975958, "uuid": "d0cc8d91-8231-49cf-9440-875ccb1b8177", "value": "b66f351c35212c7a265272d27aa09656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b93215-314a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690990633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990633, "uuid": "e16210df-90ba-4f50-84d7-d38c4fff13ff", "comment": "Malware payload (GuLoader)", "value": "243e3c34475bdf70ca47222010cc0221", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990633, "uuid": "9fe2a162-686c-4aa4-a33d-e44765bbef15", "comment": "Malware payload (GuLoader)", "value": "bb0097d6085fb4c55679d016263b70cfa2727a9d505eb7fa4184ddca7f9188b9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990633, "uuid": "f2bd57df-7ee7-4ade-bba8-5e33a366fd68", "comment": "Malware payload (GuLoader)", "value": "9ba4b3e4b9a9e6b5e17e3f1608c2158cda84ebbd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990633, "uuid": "fbf5ccbd-f7e1-4cb2-95bd-98bd9af83ad4", "comment": "Malware payload (GuLoader)", "value": "18a8430eb07a985c8d8b11ac6a74f62d2beff98d6b7f4fcd0b9160448fb618a86836c478c6197d9ff61fbd509c8d9358", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990633, "uuid": "1035246f-e403-449c-a997-cf32db3ad7cf", "value": "T14A740100320CEA69F1865BF869E2B18E512CFD767DC522C36AC9B70F8877E6F5523580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990633, "uuid": "8c2de610-5ae2-4892-a83c-5eedd1c2033b", "value": "6144:ZCunKoQ4YlLSmmeHZMhD6wM3XALQuEP8LWmUnS5D8RHKuu1xyyrtEdUQvAUD:ZDKoWQmmme6v3QLQuEPA2S5D+Xyxyyui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690990633, "uuid": "46671979-ca97-455c-81c2-b815dfa9ff0d", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690990633, "uuid": "c3c83ac4-5cf6-42ab-bbf3-6070c696d1aa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990633, "uuid": "e7e88178-f90b-4ed9-9020-0af2a4a5239e", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b35fc13-315b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690997920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997920, "uuid": "eb58ab83-dbad-416b-bcb2-a088dd98063f", "comment": "Malware payload (njrat)", "value": "dd9f56e675bb8536e194f825011517a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997920, "uuid": "7041d5e3-3930-405d-b13c-cadc9d9bfb83", "comment": "Malware payload (njrat)", "value": "bc78c8c935a65b8ff564461bd80bb8394ab02e9637b00a0fd16ed107b267c156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997920, "uuid": "85cf0e96-9882-4cd3-88c2-fb6dabfb4e0d", "comment": "Malware payload (njrat)", "value": "03f3dbdfc31d8793c371859da0f01f750c38f329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690997920, "uuid": "03bc1551-baf0-417d-8200-f833ddb2724d", "comment": "Malware payload (njrat)", "value": "8661e797e57439d8ca3f3607b1072e605e1d5c1ede11c554dd6e76396237ee776c503e0d916ac76e7ef5aec7411fac99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997920, "uuid": "ec62ce01-aee3-4733-bacf-7ea1878db291", "value": "T1E144F6BE72448F10DB943671C1DF902847E2E9976632BB4B3F9832794912377AD097CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997920, "uuid": "dcbb45ba-9740-4192-b4b8-00f6f33b336b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997920, "uuid": "f421ad3d-4731-4db4-8d02-08a990ec7cfe", "value": "3072:ozHgt54+nasYHc0hZ/+OJHoMKMr/RJu2LlWjJVjq12309vKK63DGA67zSq7O+Jdk:o7clMKMr/7rLUXqf9vKdZ6vSq7O+dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690997920, "uuid": "16d36641-7b92-4c16-962f-06aa33261fff", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690997920, "uuid": "90ba530c-3a38-4983-b965-d71899d6e08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690997920, "uuid": "c966f265-8d4e-4c54-90f7-c1e35457922e", "value": "dd9f56e675bb8536e194f825011517a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b16fc51-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690966567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966567, "uuid": "c24d5e43-e4f5-4dab-836c-73ec6cb943ce", "comment": "Malware payload (Formbook)", "value": "50bd9732dd027a7a5939f915b2c1f3e8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966567, "uuid": "da297f5c-765b-4fac-a8f0-a497e4b2c0fa", "comment": "Malware payload (Formbook)", "value": "bdf513cd2e97cb60bc6497c6a6155aa36ab7a32636b3f7d87715f988cd68feab", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966567, "uuid": "9962feb5-b7c8-4334-8945-6b4c57327e65", "comment": "Malware payload (Formbook)", "value": "fa93c27150f657a82af452eb57590f00532a9303", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966567, "uuid": "4d294b9f-4ecf-4c62-bd51-58f9ffc07028", "comment": "Malware payload (Formbook)", "value": "b5dac30f77aa3e704376ec649a611175e6ccd209312c41d685dd72369dcbb4ef611c26002814bdebf848a6f425bc5b5d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966567, "uuid": "87472897-39ab-45ae-9aeb-56f2bbc45816", "value": "T11CE4122026B49BB9C92F1BBE1C700050137067BA32B4F7BE8F8675E55A75B821715EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966567, "uuid": "63b2f39c-fba1-4612-b0b9-a9d0bb539293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966567, "uuid": "1b7c2d85-b02b-4bd6-9d1f-821ce8ed2ba4", "value": "12288:E+uZVKYmJ+375RLaTMrhLrAEQLCaWT4deDAkcMyZ228kYA/SXmPwcknaD5:E+uzKYmQ3759aTGhAEkVWT4Acn4/qwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966567, "uuid": "fc08d57b-7f57-428a-a5b7-7fde67ec2e2c", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966567, "uuid": "bd13c5ad-8718-4068-8b52-468061280b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966567, "uuid": "893a1cbb-d23d-485c-9359-2f7a374c394d", "value": "DHL Express shipping DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54e1989-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958209, "uuid": "2630809f-5afb-4dd2-928b-dc9b8058d39b", "comment": "Malware payload (AgentTesla)", "value": "8745697127cd8e331dda8d362416722b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958209, "uuid": "4c3eac77-8cd1-45c9-ae4a-6533cc6e4ef5", "comment": "Malware payload (AgentTesla)", "value": "c0c4cb7dc7102e98077d9c245bd62d41efdcdf527aba7fd2f2447c5dd8224746", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958209, "uuid": "a6fa22fa-fa30-486e-83f5-67667f7b6d59", "comment": "Malware payload (AgentTesla)", "value": "3efbf70310bc4204f0643f89cd8cfd91fc71e1c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958209, "uuid": "3ae53990-b451-4861-bab2-407b43ca0377", "comment": "Malware payload (AgentTesla)", "value": "91be395aac934222aa747af6a8d1c38e5993d8ad6a31a983dc6b0c454cbd9cb10b08dc368d89cd643506758ff572cd2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958209, "uuid": "0c07541b-f621-4de9-b7df-d6fe9245d32f", "value": "T1B7A423D5E580307435612E84EDE55AFA3C6791711F9F90A472F1CB0BEE702B403AAB6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958209, "uuid": "3a9da72e-bd82-4005-96a4-9e12a219f950", "value": "12288:tW32ZtjEAHroFfxwPOB391oKrcWBz+v4Ff1f4bD1:tLZpxHcFfH3EKrjd68f16D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958209, "uuid": "62d6b93a-1dda-46aa-90b4-3b7c639e9da6", "value": 481267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958209, "uuid": "30f3a09c-a9e3-446d-b615-b7bd2052b87d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958209, "uuid": "27cef3e2-89e4-47ca-823a-4191a8c3a6b5", "value": "CONTAINER LOADING PLAN ETD 31 JUL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346cc25a-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1690967334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967334, "uuid": "96014ffc-64a5-4c63-bf74-f22ed5a9b4cc", "comment": "Malware payload (QuasarRAT)", "value": "768c2123139a457a8b6b8cdfb3831041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967334, "uuid": "953a3428-9cc7-4ad1-8a0b-1bcc95f0fece", "comment": "Malware payload (QuasarRAT)", "value": "c0e63dffeadeefd38d63f38be833bf89dcc0b7806035dfc8791c8ab21dc2570f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967334, "uuid": "021071a6-d058-46df-9239-9fd6cbdf264f", "comment": "Malware payload (QuasarRAT)", "value": "9612f352f2e8cb0baa050353385d194287f563a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967334, "uuid": "972b93f8-37fd-495a-9d92-dee0f0dd3fbf", "comment": "Malware payload (QuasarRAT)", "value": "939390a47d03e68e7623bbb9365264c8f3b0a0e7a86beaa6828415af1343edf89fffb2aea88729dc1d71e48fe7805a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967334, "uuid": "165f4907-4018-4f4f-9e6e-9a4733763339", "value": "T1AC65E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967334, "uuid": "04f73a6e-c101-47e8-b945-14cb9adaf3a8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967334, "uuid": "ffdc3721-65c1-46a8-a749-7167069b5343", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967334, "uuid": "b0d6dbdd-59bf-4410-a757-38235733e488", "value": 1437304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967334, "uuid": "f724b346-c425-466f-a759-aa5a6989cb88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967334, "uuid": "36a333a1-9f19-4888-a074-4aa87c2bb5eb", "value": "768c2123139a457a8b6b8cdfb3831041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b885bf5-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690966621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966621, "uuid": "8e44ad67-7fe5-4fc2-b6aa-2c38ad2c1e4d", "comment": "Malware payload (Formbook)", "value": "5a484072d47b77f95bfe0fd0b5d68e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966621, "uuid": "5c33ee70-bcf1-40a2-9eaf-206bdb9690a8", "comment": "Malware payload (Formbook)", "value": "c13dd48c4ba510c1881480290cde290528ad1ab362cc1de4fb36d20be05e1f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966621, "uuid": "e91b9675-6715-47d8-8e4c-9da8e0868b6e", "comment": "Malware payload (Formbook)", "value": "372a2b3a6058003cd34ff8dcb070ca715f400804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966621, "uuid": "69721877-2ddf-419f-be64-b0b85d6c90f1", "comment": "Malware payload (Formbook)", "value": "902501be3d3218991a1ad0b999918a7e74658e8eb2bf8dfc97ad27541100e135bea20b9602d8f2d1e3e9f90e7d796317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966621, "uuid": "a6f6765e-6078-4f87-84b1-4090224b6a85", "value": "T1F9E4021BBA7897DBE51E1F7FC4A1D0144370AE263178DBAECEB171C427B97521203AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966621, "uuid": "081596b2-2e62-4d86-8ada-879da66835af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966621, "uuid": "47f2d0a0-0744-40eb-8e0f-056ca280df19", "value": "12288:6+uZCRYmJ+37h2wm8Q7DODoIBNfLid7zhRDaT9jhUAT7liNRaDHB:6+uoRYmQ37h2wm8QnqoP1roNUioRaDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966621, "uuid": "fa3f48dd-6974-4a11-b2a7-97e4f48b6917", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966621, "uuid": "20f5d120-0819-4571-9954-c8f65316e631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966621, "uuid": "b57161a2-59be-4e51-a9b0-c9dc905cc918", "value": "hesaphareketi-01.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4155de-3125-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690974893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974893, "uuid": "633253fe-6e40-4343-b317-3fea821655ec", "comment": "Malware payload (AgentTesla)", "value": "42664c79da75d155e24d41e3e9114c3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974893, "uuid": "bc197e4f-0ac6-47f4-89c3-d56bc33de356", "comment": "Malware payload (AgentTesla)", "value": "c1ce2a7dd9c09f97ceebf2672ac6a3b340ec472321ec9555a115b4e6055e5277", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974893, "uuid": "e9fc6a48-6cd1-4dbd-b717-dff454171156", "comment": "Malware payload (AgentTesla)", "value": "85f66c76c067b0adbe900844fc07b4fb3f3b949b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974893, "uuid": "65f48006-02a9-4da1-81a2-c8cde0f778f9", "comment": "Malware payload (AgentTesla)", "value": "f0085677b55b32529eaf989e770a958c2aabd15111637484310e6d827fc8f498aef6225ce2d797a00a65baf8b03d696e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974893, "uuid": "009b6e9f-7f12-4c95-b797-5603c69d7ade", "value": "T161F1C7113BBCD233CA6B07B79C6263411276F3566CE6DBAF6C88604F5DA13414EA3762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974893, "uuid": "3e176db7-9dc1-4c78-9556-8c7c88793128", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974893, "uuid": "764e12c7-d521-420a-8da8-b00725de04e2", "value": "192:etAPP6YnafDjlZMdU944A473yntvFqtWzv3Qwh:etzflZMdafvrytvUivAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690974893, "uuid": "b635af56-015b-4805-862a-11bae85a1949", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690974893, "uuid": "f50eec17-204f-4b49-89c9-07dd852f7010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974893, "uuid": "914651d0-cf47-49cb-a1d6-3a6f825d20e1", "value": "Facturas Pagadas al Vencimiento_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eee3fc8-3151-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690993712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993712, "uuid": "6d2ceafc-46ff-48c4-8fa0-5366212ba0a8", "comment": "Malware payload (AgentTesla)", "value": "ad22aef19a686d3572edcee5dff279fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993712, "uuid": "e0c040f7-5a88-4673-af07-81bd750a371e", "comment": "Malware payload (AgentTesla)", "value": "c1d328cfa0da3b56084d5b4abb024215569a432f8dfeb1eced3cb597543c9fb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993712, "uuid": "bf57e6fe-e76f-4d62-9b96-801b0092c984", "comment": "Malware payload (AgentTesla)", "value": "7e94746b1b998655aff428e0d7df73940ddbbf71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993712, "uuid": "2c18a613-ddf4-4dec-8ffc-346090173c51", "comment": "Malware payload (AgentTesla)", "value": "699581c08cae3a88bc2a383ef48217eb1d811d08134bb20fa6255a09f848512f6c82a88a314f966d91d5fb396f045b60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993712, "uuid": "4ce75c6d-d71f-486a-b480-76bd320b4db7", "value": "T12EF21A1D77DC6322C76CB6BA85E6511003FAA1BE3612D64BEDC152A81F43FF69A01F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993712, "uuid": "924ab385-5eb2-44ce-bd56-c762bf197e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993712, "uuid": "0b9ee2bf-9639-4021-8c55-fd1f56409b1e", "value": "768:Ozsi6pDnzgNeZVXsiR9Ft7RNlhe0tugobq/tImBT:Ozs3nznZVXX/nI0tugoKtTBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690993712, "uuid": "4c55ad14-f735-4fd9-951e-b895e9f73da8", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690993712, "uuid": "827e68f6-29c9-45d0-a0ef-eea1794ed0a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993712, "uuid": "713b820b-b66d-43f2-b687-eac89260385d", "value": "SecuriteInfo.com.Variant.Lazy.368636.26283.31734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dcea69-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966055, "uuid": "d003d019-272d-4425-ab7a-88b1adbac59e", "comment": "Malware payload", "value": "9c6658a5db491a534047e9ed73bc08d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966055, "uuid": "f4f3dfe6-ce5e-4945-907f-533a0e878aed", "comment": "Malware payload", "value": "c2ea70a2dbf1f399b016426018a00f95104867f60a88dd9cae76be3862f7ea49", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966055, "uuid": "392020d8-cb31-482b-9c55-c5cac257bc71", "comment": "Malware payload", "value": "bbf7b1be349aed32f658f5d41eb7905b8e91070e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966055, "uuid": "5c638942-f687-42ef-80d0-01af260bf7ca", "comment": "Malware payload", "value": "df01ea718f11c177328300f9b456f9fe94a82929086d91ea2f72e7a19876afbf85bdd1dff64f0b1a55c90f6736122584", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966055, "uuid": "1f8de9bf-f9ce-467b-b025-b0f03c3ecd49", "value": "T12FD4D562FDA0BF02E122083663E1DBA5054A7C5B0BE4024635DDEF6FBA738D524AFD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966055, "uuid": "361c1c65-eec4-410d-8de5-40828d976e98", "value": "12288:LWuOB0uuuuTuuuueuCzPFDyfob0LAXa+c:e+uuuuTuuuueZhlb0LAXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966055, "uuid": "c8394ebd-094a-4f88-adbe-a3476d4aba09", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966055, "uuid": "a996560c-dda3-4efd-a1b9-b41a5bd63636", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966055, "uuid": "66f33bce-c142-454b-a65a-7ed9b7210c29", "value": "MANACO APPLICATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e73d25-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1690963421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963421, "uuid": "30d2c767-198e-4183-b0fe-03aefa58ff3c", "comment": "Malware payload (Gh0stRAT)", "value": "6e5ca3cddbfdd665aa1789800d0963b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963421, "uuid": "e2622840-c169-40e8-9232-cf8046b72d1d", "comment": "Malware payload (Gh0stRAT)", "value": "c329a69681817bbb4d99573eb9eb47efaa0c5c20437d0b21afc2b41348de3fb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963421, "uuid": "7c66274c-aeee-4025-a5d9-92bc9c805adc", "comment": "Malware payload (Gh0stRAT)", "value": "277ccbb837150c424052d84337cdb81f9af35074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963421, "uuid": "05ba8fca-a14d-47c7-bb16-6b9234435506", "comment": "Malware payload (Gh0stRAT)", "value": "121f595803a94eaea02273c2d58865c81299faf25aa69e1ba04c7b16acde978b48c304bd4caba828d59ffbadc5b3c822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963421, "uuid": "6f218465-402b-4565-829b-2b6c02b2f31e", "value": "T16EC6E010A6419126E8BB20F9CEAEA2FD605CFDD14F2451CB95C876FE8B356F03D3815A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963421, "uuid": "7af6d819-8752-47e4-aeb6-62c25d18520c", "value": "944aa7aabbaf12b2712a21de39e89d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963421, "uuid": "6c513913-e1d2-4f03-b725-89d6da830123", "value": "196608:jdk7WnPzCeEnBjxQn4ir1XVZdLERR+wxpB1sTDBFmW:3GeERKnThVgR+M1sPXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963421, "uuid": "5e356062-b522-4b4c-af52-f77173ddba68", "value": 12585984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963421, "uuid": "ce0df632-f87d-4254-ab2e-2e2a3beab825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963421, "uuid": "8ea0507d-632b-4185-bc03-7a8b4cf27d17", "value": "6e5ca3cddbfdd665aa1789800d0963b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee82cd83-3123-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690974089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974089, "uuid": "c0fca6be-10dd-49af-aa20-d85d8f694756", "comment": "Malware payload (AgentTesla)", "value": "7e21b0cd42867f293695176faaf075b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974089, "uuid": "d1028107-28be-4729-9b65-616e5d1459f7", "comment": "Malware payload (AgentTesla)", "value": "c34e81fe62af4f81b2bf0d42095b27a0e70db3dc28d0399e1c3477ad9bdf6764", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974089, "uuid": "0eab1eef-4d5c-496e-95e9-2f343d1cd155", "comment": "Malware payload (AgentTesla)", "value": "43e0734ef7da12a166cca3ffbd35e92cace23f58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690974089, "uuid": "f6c164d8-2e7f-4022-bceb-2625c09c580c", "comment": "Malware payload (AgentTesla)", "value": "6780c28d555f7179b0e9a66847b88937440b803e95d6eb40b6926164016871ccb61765263cc5b3f00e2811bbe56f9bf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974089, "uuid": "458e2191-bb48-44b8-a6d1-b6a852e108d1", "value": "T135E4DF457268AFA7F83E8BF45514428403B553BE707EE7899CE5A0EA2BA1F500F40B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974089, "uuid": "ce0834d6-af9c-4e73-94dd-aaba09fc4da9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974089, "uuid": "d168821c-6e9c-4133-91c5-f8c11b64eb35", "value": "12288:v5MYCSNWTqTrUnLEcA7P9R/7UQF0MmRcZ3:v6Zzq/ULEn7P9/LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690974089, "uuid": "4d76ccb2-f6f0-48ac-bc22-aeec2ddaabde", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690974089, "uuid": "39311e94-e9ba-47ae-a85c-bc4b25487bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690974089, "uuid": "98c039cb-bc57-4589-aa10-f79e178fd7a4", "value": "STATEMENT OF ACCOUNTS - August 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445afb0f-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966072, "uuid": "ad43291c-6f94-4e9f-aa1f-18bd00528d21", "comment": "Malware payload", "value": "f23fbe0833a6cdfe2321b303a5d505f1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966072, "uuid": "9ef1d1e6-5620-42f8-a725-de3f7ac47285", "comment": "Malware payload", "value": "c3a1201651db16ccc3a8f5de3171782b4862cd01b282323ae334a1f135777753", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966072, "uuid": "58b17a4f-bcd6-4236-a609-e60fc79cc0f2", "comment": "Malware payload", "value": "c4765a974f8e8edcbbc9975334a3ad5ff829a4f5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966072, "uuid": "1f0a0a16-18b4-4fed-b2c1-c2b6c2a6b376", "comment": "Malware payload", "value": "2411c946132c4e1705148e184e1f3d69223c5ea352c9badc38afa12fdb039574b90e4865b17f26c1674852425904b0af", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966072, "uuid": "5c2a211a-324c-4a41-b496-f7b9390339b3", "value": "T12641AE1166F60315F27A4B7468F6E332D632B812FB4287AE218402594965F10FA64F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966072, "uuid": "3f88afb6-33ec-4891-912b-748152ca3f3e", "value": "48:89ImFWMZzXWIsPcJXFhFz6XLFE7/G4dL/:86yr0ImWVTmJEC4t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966072, "uuid": "49b52dbb-7cfb-4925-a690-f9bcc7a3f01e", "value": 1907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966072, "uuid": "afd2fb5e-ef01-479f-9de5-9a986479be55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966072, "uuid": "2d02feb8-48c2-4612-8f3a-6480da367a22", "value": "ORD_SPECS_DOC.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b8edb7-314a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690990663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990663, "uuid": "06159aa6-4a52-47ca-addc-8bb71465f809", "comment": "Malware payload (GuLoader)", "value": "7140a12d1f9b47774b3b302f1024df92", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990663, "uuid": "229e8661-93d3-42f0-ab70-c3191b5cb6e6", "comment": "Malware payload (GuLoader)", "value": "c6be4051099ef1b9f2e3b0b1c2b446c34332a0457874c532376475b4a645febf", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990663, "uuid": "37fb33ba-c04e-4e9e-92c0-10bb79dd333e", "comment": "Malware payload (GuLoader)", "value": "f39386fa67795c06277499bff48c7a31cb824a6d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990663, "uuid": "4ed02fdf-339e-4a3f-9147-ed691526e94d", "comment": "Malware payload (GuLoader)", "value": "466f28f1cd099aa8f7a709c1e7d40b583521a3f78a377a9a72a37fb41ccea5c8b34700ecfa02cbd0ed7fbbe1a9b10d52", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990663, "uuid": "79c8e05d-670a-4dc5-abb7-45e85085625d", "value": "T140C4121031889EAEE18247FCADF6759E400DBC7336D4A1C77A85B70FA532F6BA427161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990663, "uuid": "cb4e258c-d4b9-42c6-981a-41368c7c902a", "value": "12288:qo7h5WQmmme6v3QLQuEHqUu9VnehcxQGCZcIpixWQuoxtJsTqGXJuD:FWQmmav30xGu9VScqndp+WpwtuVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690990663, "uuid": "ac0f8905-7495-4697-84d4-b984edda1841", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690990663, "uuid": "5be089ab-9b61-41ab-9551-9cbb25a1193a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990663, "uuid": "f4ddec57-e6ca-4a67-8389-8531a6d72506", "value": "REQUEST FOR QUOTATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e07bed-30f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690954321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954321, "uuid": "377642a7-2240-4cf1-8d9d-234458245bc6", "comment": "Malware payload (Loki)", "value": "2d12d7277d650d3833a71db7e0a74fd5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954321, "uuid": "9063c49f-5167-4f12-a121-c43c2fd26972", "comment": "Malware payload (Loki)", "value": "c715309921b359dfff74d1fb730b2d7d9a558bf241356d6188a1b36e1f22c2fe", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954321, "uuid": "5e6d1d85-47ee-4254-a0d6-5190dac23c92", "comment": "Malware payload (Loki)", "value": "9cb43e7f6006afba9eac3de0fdea52613c3887db", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954321, "uuid": "e2c45b11-eed6-437f-a3c6-275fe8af6981", "comment": "Malware payload (Loki)", "value": "114e7614724931d83020a965ab29ee76385f3005d5e4f09f4458e78ba39eee2edf6373957b10bbde9fd48b69f750623b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954321, "uuid": "bd2bdaf2-9543-41dc-9859-3d011c77eb0a", "value": "T19384235126EFECFBE6886D64BB4CDE0E941C893D01D9A3DAB61E3D14342B774C46089D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954321, "uuid": "fd5f8c37-b39c-4ee8-a720-31a2c0841579", "value": "6144:yAhLQyUvrruckgWjVIh9zgaz9FCbvAYBfZZ/nNd17UQjGIL5DbnnFEQu+YqY:LkyUvXuckfVIXEazmzzpDnNd1/nbFXup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690954321, "uuid": "7a91cba6-6cef-466b-a4f3-2fefd18004fe", "value": 389812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690954321, "uuid": "dda78206-7795-48d8-9a96-e9649985fa3a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954321, "uuid": "457ae51e-ab33-445e-8e3f-3ec67e1f2cea", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c928a4a5-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013110, "uuid": "e38df3ee-c7e0-40f6-b5a2-3553fc1b34c7", "comment": "Malware payload (Mirai)", "value": "071f9802acf8ba0be3ccaebb1d3b139a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013110, "uuid": "b9fdb7cc-760e-4a0f-964f-bf7bf3531027", "comment": "Malware payload (Mirai)", "value": "c758dbbf0b35fd60b12a9bc41115cd844a5ac25277362fbece733704d84ca2f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013110, "uuid": "bd28da63-0a70-4e2d-8ad3-d6d974679291", "comment": "Malware payload (Mirai)", "value": "5f920bb0cfe13ed034b3ce0f33ae48912294b62e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013110, "uuid": "64f29a97-88fc-4085-96e8-6f3afc28748f", "comment": "Malware payload (Mirai)", "value": "242c05784d7add012fec1f4b4a7747a528c37049085426a818da827817530d5fd81a7a57168277dc0469694c722df8db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013110, "uuid": "6719169e-18e3-4f7d-9840-e7b6eba04f46", "value": "T131E2E0C86A01DCB6CF714C74B9BE0F52629D29F980FD32F22B9E461124E48895DF6497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013110, "uuid": "d9c8557d-8bad-42fb-a962-71f2dcfc7e8c", "value": "768:x8Lm6COq1few+Bwk1nPTH56NBuN5t2xu9q3UELdl:iLJC0wkdFIBFLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013110, "uuid": "e6dad1a8-625f-42de-a831-f939e29f599b", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013110, "uuid": "7fa84faa-bda1-45d7-8474-e6dca6e37117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013110, "uuid": "98123d34-013b-4a5d-8990-f0ad03849fb1", "value": "071f9802acf8ba0be3ccaebb1d3b139a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bc8569-3126-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690975384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975384, "uuid": "8d3a9ddd-db21-4566-84e3-43c3549ce887", "comment": "Malware payload (Formbook)", "value": "e2e0dfecc72212c191fe56e972838b93", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975384, "uuid": "2e6dd051-aec8-4b6a-bcdb-534851457cc2", "comment": "Malware payload (Formbook)", "value": "c8c41a6bbeb6af842b02e24619b9e0a67c29eed37918a661a522f9b509e22ed4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975384, "uuid": "214b29a5-814c-49af-b02b-c1cf0384c1a8", "comment": "Malware payload (Formbook)", "value": "1ca5b799b588a96bcbd8028c2a091f695861e147", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975384, "uuid": "82dbdd55-0478-4958-9f35-7dc78cf06c2f", "comment": "Malware payload (Formbook)", "value": "86f940d7cbbc0f86121b4cc20b235a63037323a588307404021a05ff47119d51858ab3a1ec46795a6bd7930b96d00a77", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975384, "uuid": "8576cbef-8c06-4b84-8097-85966d5d5645", "value": "T18D442362B57C42198F7BB9FDD6E321C6903FD8BD194DD8E52980228DEB8081BE1D3175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975384, "uuid": "445ef9a4-0d32-47e9-8b34-a93d5138047e", "value": "6144:iKL+o5U0wM9ESLXtazZxDeKJ5xoUkdQI7n8iH/iQO:5adMJYzHD7J5+FmCb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690975384, "uuid": "7a8aba13-ebcf-4bad-ac0d-5bba3b9fb797", "value": 278369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690975384, "uuid": "bb345ad4-217a-4e55-90e0-cdb3fe294bf6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975384, "uuid": "fcc8a970-75b5-42cc-a408-0ceb5d96261c", "value": "APS-9840270 Rev2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157c2355-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690965993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965993, "uuid": "442dda10-20c7-4a3e-83be-f8e1ca8e8d8d", "comment": "Malware payload (SnakeKeylogger)", "value": "f7707dc68ef0113a7089fcbfb241f6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965993, "uuid": "217d7e90-1bb7-4139-83c8-63caec041675", "comment": "Malware payload (SnakeKeylogger)", "value": "c9ab09547338e5fabc9a5389c098597734e14e00da6f455d106c813177fce35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965993, "uuid": "b50d0c78-41fe-4d09-9b19-bfed77363efc", "comment": "Malware payload (SnakeKeylogger)", "value": "bb82cb1fe49e8e699f2bc7a9eaa56d959f1e9c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690965993, "uuid": "4b71fbcc-3c99-45c4-bf36-4e62f5a12e13", "comment": "Malware payload (SnakeKeylogger)", "value": "563c099b338b972f3f72198388eb386f7e799bae486099cf8ae29e02498fa5446015e3d858004ae454e9a1dcbfdb94cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965993, "uuid": "087e393e-8c14-46ba-a02b-f396ece0189a", "value": "T16E222B65377C9333C66B07BB88575782077EAB115CD6DB5FA880240F7EA17018E92B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965993, "uuid": "c07ae53f-0a4f-4ca2-bc0e-88dfffc88f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965993, "uuid": "4e159aa4-6899-4b43-8d5f-f487c05036d2", "value": "192:n4TPB64dwfHjA7MdRhrN47cZnSD4cli/dq:42fM7MdR8AVSLlil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690965993, "uuid": "1ae435f5-afd0-4681-87d0-22b687414e7b", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690965993, "uuid": "168f4d60-b884-4e24-a522-e96ce33c36e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690965993, "uuid": "cedb0699-8b7e-4bfc-b592-c3bb23f052c8", "value": "Gjvdnpikd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41ecd02-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013155, "uuid": "c10dc8fd-4b7d-4fbc-97da-2e84037af82d", "comment": "Malware payload (Mirai)", "value": "c6a3a0d5a05828797fc3dbc604caee55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013155, "uuid": "1e740745-76ff-4850-aaf6-940a13d1bf9f", "comment": "Malware payload (Mirai)", "value": "c9ceb1f1158a9d9671e339902e15615a2b5db46ea016a4dd5accdc3ab60f8f5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013155, "uuid": "b5e7571d-b418-4001-a986-56bb82db28e9", "comment": "Malware payload (Mirai)", "value": "01e2f3739a5d392b3f5853cac410bd74c348b272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013155, "uuid": "e1deadb0-7134-49d0-b777-9d64aa9daa35", "comment": "Malware payload (Mirai)", "value": "5c7cb5c9be0c353fd030b85d454b9bef1065d10079483f08738db6584ea7d71ec09a6d6f30358a279218ce318f226fa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013155, "uuid": "f3003715-876f-4dae-b815-37f6f5b768ee", "value": "T119C2D0B0D140B9F9FF7A1DB11FB5C7C49BF90F8927A7C961218EAF040411A2F5694289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013155, "uuid": "b2aeb813-2621-44b2-a2a9-7ff48558ea6b", "value": "768:uKnqLiChP7gI5z7sbuTftlCanLuFoueI4uVcqgw091:uKqL1h/7AuDtlTLsT4u+qgw091", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013155, "uuid": "a2810cbc-58da-425b-b743-ffb81e7c0d49", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013155, "uuid": "de51a7d2-278f-41e6-9f14-19e5619b2c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013155, "uuid": "338a6876-0232-4da8-ad76-baec9885a7e5", "value": "c6a3a0d5a05828797fc3dbc604caee55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddd828a-310a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963269, "uuid": "f34eff79-1126-4fcb-b46c-c046cb60b035", "comment": "Malware payload (AgentTesla)", "value": "d433647fb9f9e33e6d6b6e505cb04e95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963269, "uuid": "f4da492a-43dc-43ff-a9f1-81f740d21bda", "comment": "Malware payload (AgentTesla)", "value": "cabf5777651e17c1d64384cefbf5f7ce2fc7abedff68901c96174dd16612caf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963269, "uuid": "758acf6a-b9fe-4102-93bd-ebc456165494", "comment": "Malware payload (AgentTesla)", "value": "44f55d93fff918662193a7263fcad43da0e3ba26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963269, "uuid": "e241038b-5787-40fb-9d80-76755b944e44", "comment": "Malware payload (AgentTesla)", "value": "9caca74cd713ecb2372aa101c0bc94d815b646868395cd204aa0b93618d69c780985d585444aa051cd196a2e62fdb05f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963269, "uuid": "8cf9629a-cf83-4fda-9950-86dc05d374c5", "value": "T19DD4025B4C3173A8D8148B337096920E0B3A8D0EBDE9D2578E5EB5EEE773B910121D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963269, "uuid": "1efd90ff-b2dd-4efe-82ba-74d7aa693a6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963269, "uuid": "f31d2e4e-8c2a-4cc6-9cdd-da6b0f5e6cab", "value": "12288:742iN8JJfJTocrwv9uXARh8MQX604hWyAG4Wx7YI7e5UCB2NkfeM:741uJPT5w6w9W604EyAa25nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963269, "uuid": "7a52db3c-418f-40a5-86ac-67ee9913af4e", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963269, "uuid": "8ec8de00-4e42-452d-82d4-4faeaad9bbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963269, "uuid": "5b8bc641-89dc-4b25-9c79-5b33534eb938", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f99181d-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690964400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964400, "uuid": "7fcd7d64-c217-4127-a5ae-00c3a46899e4", "comment": "Malware payload (NetSupport)", "value": "70297132948e717a54754524646870cd", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964400, "uuid": "129b4827-3233-4e21-a61d-06ff0602533d", "comment": "Malware payload (NetSupport)", "value": "cac95aabddf39df075aaf4deed7b3d4a13640617c63d09611771d648c1fb26a6", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964400, "uuid": "d4406620-f16c-4aea-9902-efbe7a5dfd55", "comment": "Malware payload (NetSupport)", "value": "9d6a75ffda344380d9491def6b01c3d3c0520e6f", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964400, "uuid": "f7d5e475-0551-41a0-9d78-a3203c82f1f2", "comment": "Malware payload (NetSupport)", "value": "39ff91bb68d35b378d9e01356ab985da0ec96d9fb46423328581ff4d734bc48af6cb12160c19cad0366bdbe966f88210", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964400, "uuid": "b866551f-7375-4042-94f0-03986f5cc7b1", "value": "T1B0D4026A4C354E7EEABC37F844BB0F5A07DD04602C84DBD6F2256950C8D7A78A8DE478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964400, "uuid": "1a80a96e-ffc6-4d62-9a5d-7a00050620ec", "value": "12288:IC4D4H4H4H42DOFOPn4ujz7i8PMMMMMMMG9Uv8rd75Ve7:PoWWWFD8+f7im9Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964400, "uuid": "78ca5010-c5c4-4249-9d33-024ef4ab735c", "value": 647118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964400, "uuid": "f1db796f-c948-4407-a9a3-52164bc48674", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964400, "uuid": "3fb9a9a2-599c-49c8-a988-cf9d8f06bf64", "value": "Chrome_update(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7c8147-3158-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690996582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996582, "uuid": "477c1c30-d56e-4e38-89e2-2051cfe83366", "comment": "Malware payload", "value": "b7f994d5d1b9d72f0f435280379e193d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996582, "uuid": "3778c654-baa2-4c3d-9151-55dcd9bce20b", "comment": "Malware payload", "value": "cb08024c0c1f7cfdb415a84497b19df8f676e14eab59aeb92bff06b69330356e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996582, "uuid": "8b1142f9-ea94-4987-89b9-9a763401faab", "comment": "Malware payload", "value": "9e5567d942076d517e7a6819361bfd29863a5e67", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690996582, "uuid": "d1cfd944-79c1-46e4-8336-3f6756f466ab", "comment": "Malware payload", "value": "aacf222ff2c769aaba643fedb9a398eab7e4687caff601730bce6832d95f56ddfe65d71e58ca8459ac6487f4f44cc2a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996582, "uuid": "a59839f8-84fa-418a-81d9-b42534a99ea3", "value": "T1C8A5AE13F34A9E45C9F141390620A7635B278D2DC2974AEB1D98B37CEC73AD60EB54E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996582, "uuid": "cf8ba3a8-64b3-4e32-aab4-4f5f93b9eda2", "value": "12288:fYVhdKRLTDRHJlppxSftnPAsrHewv23uz+KWl1AiSsBSpRktw1dWYYrjAm:fYJKRLXRpPDSJHr+B3Tl1AxRkQHojAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690996582, "uuid": "1ba06abb-7c6e-4a7c-9a1e-566b1a632010", "value": 2066333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690996582, "uuid": "d311d666-f706-4ed5-a830-a50b37d24e49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690996582, "uuid": "e0a90bd0-5ebb-4e6a-8dc1-4b6e52264142", "value": "modulesegcliente.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241cdcb7-3100-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690958717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958717, "uuid": "b2d00eff-b3d2-42db-be69-15ebdad69640", "comment": "Malware payload (GuLoader)", "value": "330530cc361323b6c10037c62f4b8fd7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958717, "uuid": "f07635b2-ee55-4aba-88a2-3d37a4f8f479", "comment": "Malware payload (GuLoader)", "value": "cb15bbeb4edb6022db0be758b12bff33b4acd5c3f7a8c7cc99b5a0b97810751a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958717, "uuid": "ec4c9f3d-dcbd-4e28-a01d-d9ef34183be2", "comment": "Malware payload (GuLoader)", "value": "a6339f6cc4ffb192923699f3d9c74692d9431ad6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958717, "uuid": "5eb568d9-3855-4ffb-865c-2344f9d12fe8", "comment": "Malware payload (GuLoader)", "value": "11eefc0ce181ef6d99dd390aef71c41debc535eb7c913c34ce0ce792a2ddfe1d8dc6fa1b14db1a7bc6403a21a6939139", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958717, "uuid": "41e1aa72-3111-4cc1-acfe-9695555daf66", "value": "T1FA45121712A6C0A6CDB306B13E76AA239BE49D3164B0835713317BBC79727D09E2E395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958717, "uuid": "c39eb17a-c191-40f4-ab9e-1b7b3271eeb5", "value": "12288:TcawZcN+IoXREOqwO3CNs+v6+utoscawZcN+IoXREOqwO3CNs+v6+uto:TL4U+tRvn6L4U+tRvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958717, "uuid": "5da4c2bf-bb14-44e7-97dd-59e704b031e3", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958717, "uuid": "44fcce20-9220-4222-887f-27dc9d8b6e1c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958717, "uuid": "749ea1d2-acbd-4c60-bbf8-33d0f58001f0", "value": "HSBC Payment Information.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691f1304-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966134, "uuid": "f5836010-2f66-41c7-9136-13e58798a44c", "comment": "Malware payload", "value": "7cc6b701596efd1d0a217a207d5f7f43", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966134, "uuid": "51749399-a996-492a-881d-443476e9985a", "comment": "Malware payload", "value": "ce83f65ece1383a8d652d9baef2abd6132d6cf92811c26de38618ef87ea26966", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966134, "uuid": "53368780-3817-4ae9-8ab4-b1fb89866dc1", "comment": "Malware payload", "value": "66e2387f2a2e327f3736ead9c3590e8cab5c2cc0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966134, "uuid": "4ab27692-1b5c-4e3a-8574-31202404759b", "comment": "Malware payload", "value": "089d6017ef0385abf1d9979a6ab7619fdeef5c52ca0e6dc74bd33e8b745e4fed51bcce0055601ba89f1b469c1f10609d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966134, "uuid": "7597a755-7c47-4589-be4f-877c198324bc", "value": "T18FB3089021D1CE906F96F2EEB11A4488B084D3D66E9A2478F4B276FF1234583BF5D772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966134, "uuid": "8e9438ba-03ae-475c-8985-9616dbb934e3", "value": "1536:l7jA8yJ7PTM51fIPnPl1JPGfI8y1bTM51fIyhlDblipVbliDGGWh1d8TM51fIVTl:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966134, "uuid": "b2f8b0d2-9742-4773-9be1-c2f69e50481f", "value": 111563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966134, "uuid": "ea63fb00-7d45-4320-a6c6-d14ce4fe74c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966134, "uuid": "6610b054-869b-46e5-b52b-29d2589f04f4", "value": "INVOICE_20230108_001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b5f202-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690964462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964462, "uuid": "9766fda1-3b39-4b56-8915-f6d0f411697b", "comment": "Malware payload (NetSupport)", "value": "8970fccd38432d3a6eefed2f274709df", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964462, "uuid": "0980df7a-f158-44cd-99a7-1d9ef4cf729f", "comment": "Malware payload (NetSupport)", "value": "cea3f6928121bf4382e7144b9a900cdcbecb7b7f95a14531ec0c04286a08489e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964462, "uuid": "cdea2e42-a3e9-4200-8919-fe0d4eb86268", "comment": "Malware payload (NetSupport)", "value": "5eefa6d5af3adc5a84a5e7ba66de87779221cc02", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964462, "uuid": "1d55bdba-5159-4c4a-8ff6-e2a2b7e0ab0a", "comment": "Malware payload (NetSupport)", "value": "a6dfd9266f3231989fbc3829224bc882ae070176b35820e56f0d5cc4e3f4b10176b9d2732293e9d8bf59720019a6a49c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964462, "uuid": "d3fa130a-b455-41b3-a2f7-2830f8aa6c5a", "value": "T136B5332D13EACB4C98624DACA560B157A115137898760DF7C9D7D8B9372BFE2FC83908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964462, "uuid": "5a3ebe74-870e-4b1a-9c79-adc503a7647a", "value": "49152:rDHf7GK0RIZLYUIFWsFYL7084J3Sr7Y1t/iAJkxNkvTMTTi0oIFJePBM5Pl:rDHfcyZ8/FW8Y9m9i5IvEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964462, "uuid": "4145d5d7-17ea-42de-923f-c3621edc5483", "value": 2306944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964462, "uuid": "c5c3b370-0ec0-477a-a8dd-f8d4f09522c4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964462, "uuid": "2248ad5a-bcf8-401e-841d-8d786527a1f4", "value": "lolo.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32707f65-30f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690955734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690955734, "uuid": "9197357b-e8bc-4247-a4dc-acb77de8deec", "comment": "Malware payload (njrat)", "value": "ab8405c2bec574901f93a2f0bd062a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690955734, "uuid": "7b07a68e-252e-42de-872f-130d9616e6f1", "comment": "Malware payload (njrat)", "value": "cf2dad577ca320380e2c4cd1cd93f318e7720fd1f090d97dff5aa416bda55912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690955734, "uuid": "191443d1-9777-4113-b110-c95e72891f9e", "comment": "Malware payload (njrat)", "value": "fe69f5e501231c99d2b705da9d958c2ba1deab16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690955734, "uuid": "44afb367-0233-47c5-8716-6bcad862f5d8", "comment": "Malware payload (njrat)", "value": "ffb4541929daf839b7f8b023c5168e4b1b0afa4c60a255aa637a46a2a13d66c8a8bcfb7182f9aa304b5a7c76500108dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690955734, "uuid": "d2c1c1ee-4699-435c-9302-2274df0506e9", "value": "T19713E78DB694E174D5FF8BF1B4A1B2890B71A017A806930F99F114D98BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690955734, "uuid": "ecbfe970-9add-426a-a2d2-8ef555dc42a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690955734, "uuid": "3d3c2a1e-2524-4f83-8f5e-0c6cff0d486f", "value": "384:Q8ZySa33VarE8yTNJFqfQYMEnwpai0+dzEIij+ZsNO3PlpJKkkjh/TzF7pWn7mgm:Q6xq3MY5TnFqfpMpLuXQ/oWC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690955734, "uuid": "6088e531-e12a-4f93-bac0-a2d1e51b782b", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690955734, "uuid": "51a4bacb-5d50-40db-a5a3-afd877669b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690955734, "uuid": "c73037b9-13e9-423f-8107-807f930c3ffe", "value": "ab8405c2bec574901f93a2f0bd062a7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba128cf3-310a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690963263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963263, "uuid": "781950b1-65dc-4706-960b-def4759ff9b9", "comment": "Malware payload (AgentTesla)", "value": "100eface29989a3d021e0058f2522d87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963263, "uuid": "396d952b-ee6d-4378-85d0-b13ea700e5a4", "comment": "Malware payload (AgentTesla)", "value": "d073c81884502f4847b79d7b491b0255d99a8fc89b9a745b065c33b8b9ea7c68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963263, "uuid": "3c97e8c4-c9f1-44e9-bb87-73bca31061a0", "comment": "Malware payload (AgentTesla)", "value": "6e7a0f98b9bfd401e2350fb1c67a74c195ecab34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963263, "uuid": "745c55e9-d660-42a4-8373-2e09f4c5e963", "comment": "Malware payload (AgentTesla)", "value": "bafca2240f72fe5f0994957cfe3a18a5dc138fadb5ba548f000d50a5e3d6f3ced9463a76ea1c5780b6da23ed561d33e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963263, "uuid": "188460f4-84f9-43e2-9047-f8fe0f834323", "value": "T111C423BBD12B7189F8155E189167304F2D2AC1785C9DC262420EBA83845ADFFA7F0E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963263, "uuid": "6a734700-d0aa-4a4e-8949-42c0bd1da898", "value": "12288:kH74aJ7eEFrq4FHGKdZ0d8MQCFWM9uYIpcxgLjNeYuPF:kjrDaGuuaxgVUPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963263, "uuid": "b4801a33-c308-4cd2-a594-3f82386ac375", "value": 547122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963263, "uuid": "5b8cb1b4-c111-4bfc-9632-8ee5a8c3ca6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963263, "uuid": "96f70c15-9f58-459f-b1ce-2179548e87c3", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b3f4f9-315d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690998768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998768, "uuid": "a399a34e-44ae-41bf-8910-9029d65d8e6e", "comment": "Malware payload", "value": "40899d038ee717f6e407ed53668c8d16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998768, "uuid": "15b495f9-f2c8-44e8-b624-7b4738011eff", "comment": "Malware payload", "value": "d0d417ece8e94dbb4834e29c345d2e05de5de8ba3b3e05d922614c6f508d4cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998768, "uuid": "75f8d3b1-b3e3-4fea-8268-962988ae5c91", "comment": "Malware payload", "value": "6f49f6ce4068524aab980fce4c85473f63415d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998768, "uuid": "a3b7e95e-2353-4b1a-b9bf-be6132338ba5", "comment": "Malware payload", "value": "892fca85926f8ee1f1962cc772b41e954b439d65798864b80a465d4276bc31d80eb6e3d51780a82714da26641e2bf964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998768, "uuid": "b729c53f-c61d-47b5-8284-354c1ea137f6", "value": "T137C4DEC04168E294DF5156F9FD4A693988B0624BAC5B2EAFF74BBDD03C735C48A9E403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998768, "uuid": "357fb219-f1f3-42ea-b619-f0e3d6905029", "value": "12288:FVcSX+wMmdF1/jILYCWilocbzK27bwgTysayxbLz7ms4u6m7PH1:FVcSX+wrd/r3IO2g06Pg/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998768, "uuid": "a48c3fde-0c4d-45cc-b7b8-836c263110ff", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998768, "uuid": "ed219679-c503-46dd-aedd-4609e363c078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998768, "uuid": "21c969e0-4dc7-4c6e-9131-7bfcfb4ac984", "value": "40899d038ee717f6e407ed53668c8d16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b579ff-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690958187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958187, "uuid": "fa1056bc-73ed-4268-b164-0e2905bb7048", "comment": "Malware payload (AgentTesla)", "value": "c09f8c374508290a9bc26f876e157e26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958187, "uuid": "e87d0450-be88-4c2f-b32e-126539397f02", "comment": "Malware payload (AgentTesla)", "value": "d0f088ccb3700e2816db311fcc17cd06a9170d9d1d5f81479121f758e222f02f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958187, "uuid": "73423717-bf1d-48c8-af8b-f2a4ffec6c1f", "comment": "Malware payload (AgentTesla)", "value": "8ca7af0ebe2925e4c0b991913900497cd77cb3be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958187, "uuid": "c5d955ae-285f-4c21-90f3-58eea11b6cba", "comment": "Malware payload (AgentTesla)", "value": "0d43b7cf8287d7308a0c97db518102645fd4f00469ca106ea7deac2c9caf4e3e6306a1d940df239dc67ec09fc169c4cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958187, "uuid": "a9242436-487e-428c-b583-da0a0f969da8", "value": "T1F7A423D5E580307435612E84EDE55AFA3C6791711F9F90A472F1CB0BEE702B403AAB6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958187, "uuid": "a0b8bf85-9234-4d59-b14f-9059e331b57c", "value": "12288:RW32ZtjEAHroFfxwPOB391oKrcWBz+v4Ff1f4bDx:RLZpxHcFfH3EKrjd68f16Dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958187, "uuid": "8512c370-86bb-4d37-b23b-c18122c099ef", "value": 481215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958187, "uuid": "ac19ce8d-6d6c-4275-ad77-a9882ace8fbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958187, "uuid": "7ea4cd1d-582a-4d2b-9128-586a20738ac4", "value": "Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86acbf43-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1690957164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957164, "uuid": "672895bc-56ab-4625-b90b-d11d8b51cf30", "comment": "Malware payload (DBatLoader)", "value": "6f02b04d28876040ebf2534fad615c94", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957164, "uuid": "7c05e411-2a0f-40c8-844c-eaa915190d17", "comment": "Malware payload (DBatLoader)", "value": "d1256405fe547acad3aa7e3870f0f623fa30710957d1072c747700193b417c95", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957164, "uuid": "37e5dec8-5dd8-4860-af97-559c86c732db", "comment": "Malware payload (DBatLoader)", "value": "474372fc1a386659048a52c9f815c5eaa8d1ec28", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957164, "uuid": "59d9c142-a40a-4564-80be-e345c5c115da", "comment": "Malware payload (DBatLoader)", "value": "bc422eeb30a62ec2b5a8371dbf2b1822b9de02577c35bf5a0a57aea1a766722b5090a9ec6713f566240f798adb3e6776", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957164, "uuid": "d6ee311a-5e5c-4542-9315-a6f22353193b", "value": "T15F64F8E4200F44B6E305AD8D6994B105ADB6FEE734C188B1639FE478CF6AAF19EC0457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957164, "uuid": "5716b0ae-ade9-40f2-80dd-e4039eeb746a", "value": "3072:iNAOWGnF8iYCtw5/loeBEVzFtr5RDAw5wf/:xQFZfw5/GemVzFt1RDAUw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957164, "uuid": "2471632c-b295-468a-ad7d-d88501328d83", "value": 329295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957164, "uuid": "a5a88a63-fe17-4bfd-aef9-05cd2011afbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957164, "uuid": "db16adcf-d5a4-4bd9-859b-8f925c08fae1", "value": "PURCHASE_ORDER_PRINT_REP_4100067077.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5d3376-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690957603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957603, "uuid": "7cd20133-c683-4214-ba58-3573e1a11d25", "comment": "Malware payload (Formbook)", "value": "4307b82f33472fa67d6920999a42e25f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957603, "uuid": "15b99faa-24a2-4c58-b4f2-e4362be3c2bc", "comment": "Malware payload (Formbook)", "value": "d1dbf41f435493ec38a34b4acf88ba436343b4af13ff3780cf1152c8c7f61011", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957603, "uuid": "0382e5fe-be76-44fd-a94b-f22525936c85", "comment": "Malware payload (Formbook)", "value": "3f2cc2ea3929a3f3e8e5453936a4be32381d0e95", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957603, "uuid": "afc02cf4-4eae-4fc8-9f41-462c4cd96a69", "comment": "Malware payload (Formbook)", "value": "44fc8e335a97324c25028b8bf65bb61577e79a63d425b4ba7026a71a61614e44e0a9c04017e8f416a19e2e91db1d853b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957603, "uuid": "1517bbb7-bbcd-403e-b75a-166c58c5791d", "value": "T1A33423C05DC9DF75E78C572CAC5421B3964B96A5BDE2C422EB079AA0CF83C0367F1869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957603, "uuid": "3e67fbac-5ae4-4fe9-b66f-e6db881b0560", "value": "6144:Bq/jmGhzFr2QjYN8CknYUpbbdv7Y2s9r+S:QnhzFrdnnnY8nNEJJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957603, "uuid": "2281edf0-e86c-4f2d-bd42-46fa322f4285", "value": 242014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957603, "uuid": "a61da164-df86-4d83-987a-dd4729bf307d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957603, "uuid": "ffc932f0-3134-425b-a85b-6f5db43bb702", "value": "Quotation #3200025006.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ec7c30-30fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690956844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956844, "uuid": "be29a4a1-96e9-433c-ab43-82199d459c97", "comment": "Malware payload (GuLoader)", "value": "0d973008a70e8705793cd6008e1d16eb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956844, "uuid": "7c44c1ca-2711-499b-bc8c-ab40b65a752a", "comment": "Malware payload (GuLoader)", "value": "d230769827d6bc980b87bf9258d88bcaa0b4de984f412e1296b2471f3f4808fa", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956844, "uuid": "5bcef697-318c-4c44-af69-02149212574a", "comment": "Malware payload (GuLoader)", "value": "ea6273906422fa6a893efd5d09c2a36607e9a554", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690956844, "uuid": "acd822ae-b3a7-447d-ae78-a58205318003", "comment": "Malware payload (GuLoader)", "value": "d5ad2b905464955220c374dcfc15015106ff474cabfb9cb4a2a48dedd69f4471778aac4218efe6d6423013f2b9b30ace", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956844, "uuid": "e6cdd56b-d6f4-4434-bf18-d3d788d0f8ab", "value": "T19E6423C4BC7A615DDB8DB3AC9254E60CF05A5C9E68B614A78C07CB73A5A6D3C04B0A39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956844, "uuid": "893cff39-6f45-4dd8-8625-8919c4bc1c65", "value": "6144:99M0zJjH5b1aJR9MgpppbITJwu2CooaNIVu2IJbijQ47b6JITy8j:9K0zBHlmhCtVu2Idij7b6my8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690956844, "uuid": "73a21a38-8336-4c76-8de4-d1b468022225", "value": 309050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690956844, "uuid": "5e6dddfa-a154-4b2a-af3b-9a0b446a887e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690956844, "uuid": "0b13e28a-4f17-424f-aaf7-7ad8de577ba0", "value": "NEW_ORDER#794789_SAMPLE_SPECIFICATION_TIANJIN_INTERNATIONALSAUG2023.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb6547e-318e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691019751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019751, "uuid": "a089c406-fa6d-426a-b2b4-10eb4c43853d", "comment": "Malware payload", "value": "e9da2dbc0577f419fcafa37a6b5a3faa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019751, "uuid": "b7a942b7-9a58-4475-a775-53cff3755b88", "comment": "Malware payload", "value": "d25a23d4b46dc8fcbdb233c6c96b9d438033cba0fc10452fdffe69ebafdfea8f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019751, "uuid": "485a02f3-dfbe-4e04-b439-16080fee362c", "comment": "Malware payload", "value": "6bd967409c612466686e60dd409183a014171bf4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019751, "uuid": "14e5bf5f-bdba-4924-9bd7-af99a0423881", "comment": "Malware payload", "value": "ed412a9f0260916ac8189a1d3a3c088d1aa981f882b4085cd9ff5121df7c607ccd6cd0f99bf23cdfd04829e6938504f3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019751, "uuid": "fbca9976-38b6-4ff8-9fba-ce0cb56c5adb", "value": "T17DE633115F697DBD0EAC833A70AF5E1E0EE06F814448A2D753E7A4CB264EF82454B87D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019751, "uuid": "741bcd79-f1bc-4653-bb5d-dde08ed80398", "value": "49152:NU1C+qSrvDLzzJmTXjAHJOazfuaAjc5lq+C1uFwMGAb/juArG6kFtAR0aUYLm7YF:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691019751, "uuid": "8d902ff7-4668-4737-a569-d763eb3fd2ca", "value": 14913495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691019751, "uuid": "e3f7d5fd-ab2e-42eb-b393-b27f51c0e8df", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019751, "uuid": "572063b4-6cb7-486e-9a75-dbb52e604f46", "value": "update_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ea7250-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966182, "uuid": "9b2a1529-9a7e-40cd-8369-eb45c355a012", "comment": "Malware payload", "value": "3e1103b1ac5c7efb9b87ba7015b8f81f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966182, "uuid": "ffd24bf8-0aba-4ad2-afc8-6a9be5678fdd", "comment": "Malware payload", "value": "d2828a8bf81d67589cd0b612ebeea63a682a334e2cdfbd27abe382813ae30e4d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966182, "uuid": "94ecd55f-0b52-4ddc-8134-5027e829a67f", "comment": "Malware payload", "value": "491eea78c0ad9671da42fcb9f1e666e60a7895fa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966182, "uuid": "ecb8f52e-e1e1-4cd5-96f5-667ecf4b9be0", "comment": "Malware payload", "value": "d3085ae1e50858f63c8f6247020f51210ed3ee327a2ce01281ba5fa975348568e6a1ea2cfee7f1466e78a9f3ff94bd2e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966182, "uuid": "4b350c5c-abb0-403f-a581-c862c65e1319", "value": "T152E433B7B15916CEDBAF0DF1077010644362E1AA86C32B48ACF9E9B9835DDE14B6F704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966182, "uuid": "6439e784-634f-4757-9366-56905ac781b6", "value": "12288:f9nWauJ6GWAm4TsUxHU6xL5rY4ZIrWKucW1UYSHtMMMrm+T/uU8siN4T46yIciXK:Ve6Gg4jBUyx8ul1bSH+MMXT/D8sG43cF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966182, "uuid": "7883581c-e767-4a79-8380-b82bb03b92fc", "value": 675524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966182, "uuid": "43d3632e-297e-4608-9a3e-2d71f0287420", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966182, "uuid": "52a1b0a0-e9a6-4cc0-8b00-02e584286e4f", "value": "SHIPPING DETAILS.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f25d668-3103-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690960104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960104, "uuid": "ccaa1162-16b0-48ca-8d11-4585e589c901", "comment": "Malware payload (AgentTesla)", "value": "37746eef29452b9224a5a87d7f564e57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960104, "uuid": "53a15c33-2750-4898-9920-552c091f084a", "comment": "Malware payload (AgentTesla)", "value": "d46246e0628eee0a92c3344b5a036bf6144df42db9a350c2bfab5021d88cceb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960104, "uuid": "0ac25599-552e-48e5-a25e-941f22c0edd8", "comment": "Malware payload (AgentTesla)", "value": "66341b16939f074d3a324c80375e323ebb986a7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960104, "uuid": "185c291d-4948-4f3a-b167-bd1d5a1d18b5", "comment": "Malware payload (AgentTesla)", "value": "df97785e80795ebac7767be4ab0d72f2d4b340fedbc798258a90c28ab6924842794377bacd5088d0b00bfc76307a5c57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960104, "uuid": "19eb8057-4b3f-4979-b49e-c5089caaf83f", "value": "T146B423587286C97CAC7AEF5704443060E0F6F05E93BE5DBAE9CCC9B5C4AD4638CAC961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960104, "uuid": "c6e2a48b-86cd-4add-bf8a-bbe7998d88fa", "value": "12288:OelWvHAvu5K58aFjBkTNA3M/pff8ZIEvR8:xlKgqK+avkTNLfUvR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960104, "uuid": "58c862e8-0635-41b0-bd24-9b3b8e36634a", "value": 528316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960104, "uuid": "1c003046-35f8-4337-8e16-5fad2d53e71d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960104, "uuid": "06afba22-a488-41a8-adf8-8d5fa7ea5d59", "value": "STATEMENT IN JUN 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c933bc1-3129-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690976421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976421, "uuid": "83f93079-ec2a-4b96-a19f-1569045d2892", "comment": "Malware payload", "value": "c7d6e1e866d81b1888db9df27e73c313", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976421, "uuid": "b7103e7e-c110-46f7-bd91-60b94bb48e9e", "comment": "Malware payload", "value": "d49958fb0872d6ee15d0178934f99237187492653463b461cd264277d9f41537", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976421, "uuid": "988e6be3-230c-4b14-824c-69fcc4053dbf", "comment": "Malware payload", "value": "b283644777189a6a81ec10d0dd587e4ca917be1a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690976421, "uuid": "b55267f7-4ff5-4bdd-af02-2f5b05d609f3", "comment": "Malware payload", "value": "84368545c1c996bb7ae7a17f546352d86485c4b9cd36d413c86383b8771700ef16c8af1b9f87c2d15f90d5d3c622692d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976421, "uuid": "158fcccb-bf4f-4e08-b2a6-1dbab6afe40e", "value": "T19261D7F8A7580DFAD5835835CA5CBD2111F7F5126ADF6DC1318ED8E2197E2501E3BA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976421, "uuid": "1d0e8042-a04e-4cb4-bcb7-a056c8722f54", "value": "48:iS32BbsF68rn54kThwa+Z4qxxXfaMqwUnkU+7aC3Gs4A24oLrV+JNEWfw3KyPzHz:ifK74n4Q9ancaaGs4A2rvV5L5Thk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690976421, "uuid": "672c9e63-e9bc-4574-a1e0-b8c6d46326f0", "value": 3325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690976421, "uuid": "d7463736-60d2-4f0e-be7c-f25bfc24cc03", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690976421, "uuid": "697938df-ab08-44f9-ab24-62907c8a9b27", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.23736.17786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073dabd6-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690970265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970265, "uuid": "a7ffdbdc-252b-47ab-b536-0a6405d7381b", "comment": "Malware payload", "value": "c4d96ab03d91705880db6a96eb5ec4a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970265, "uuid": "500491ab-2a47-4769-a990-720751122d47", "comment": "Malware payload", "value": "d4da20d315736db545114c1323bef972b46cc8e1f98aca455e3c5f64ee7f71bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970265, "uuid": "eaae48b6-58c2-4754-a802-858b16a65092", "comment": "Malware payload", "value": "8034fc1f00d7af99f3050257694c6eab4c4fe3f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970265, "uuid": "3abf3628-6c46-4bb3-aec6-54cd4bdfdec5", "comment": "Malware payload", "value": "c88bc93e79965ad71ce139b6802f187ac721b4fa37cb6a71b252232876c3dde5aba2ad177c58ab2469a4286564e44660", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970265, "uuid": "22d24408-ef99-419d-a156-c8e54f1c2da0", "value": "T110F3C80AAF610FBBDCAFDD3706E9060139CCA51722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970265, "uuid": "396c912c-372b-4966-a654-a1b0661dc457", "value": "1536:2tcHIkZEWWqFQPmsp0zndTHy6UCXbWdYMLP2GfHXqZgBBTDYSLIE2SkEb8nN9s3A:2tconWn0uhTEb24H6SrLIF/E+NkdBRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970265, "uuid": "46d091c1-3056-4d5b-be00-5bed8d6aa8da", "value": 161480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970265, "uuid": "09b22cd7-9969-4dd0-b628-06e4f5cda2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970265, "uuid": "135fedf8-769b-4a5e-bd5c-5d92b7317c45", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8085dd06-313a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690983782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983782, "uuid": "4b5b1b47-dfe9-4fe2-8c28-cf13a6e3c56b", "comment": "Malware payload", "value": "c5b030c501b8337951b65cf31a8fe9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983782, "uuid": "9097d423-6850-46bb-8b4b-d8c672c6e54f", "comment": "Malware payload", "value": "d5fdc921d32a8b13b7c61e1d48b45b9ed4fda4df5f477a9c1cb17cbdc6cc03e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983782, "uuid": "91bb6490-b9fd-4bba-b6fc-2b4be9aec5d2", "comment": "Malware payload", "value": "52ca50ade628d6a287cbfe17a4a2598f893b7356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983782, "uuid": "2528723b-6d0d-4f92-97f9-46a3ca21e5cc", "comment": "Malware payload", "value": "325df522ab6752dc7ef9f2afac3716c2641af2fb0334c449e093de9bfef3fff4068f7fd7a4cc19ee1a2437eebb006d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983782, "uuid": "a3466ed2-67f6-4979-a922-c84648668623", "value": "T177B4D0192EFE165AD59B9379EAD450A2C6B4F211B24FABFB380416B41F027F4CD031A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983782, "uuid": "3f547cc8-d4f5-42e8-9072-8fb4e494ea37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983782, "uuid": "7c36c8ba-088d-443b-8dbe-5dd2605c3651", "value": "12288:fgFswIDFcVrX8p1W96RtpKMksWSeOhoWfGC:IFaFcBX41R3DjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690983782, "uuid": "3fbb1e83-c845-4abe-8518-ea8a17ba727d", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690983782, "uuid": "3d8f96de-cfeb-4b67-9ae7-0386e30e10f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983782, "uuid": "d3f44240-83aa-4a6d-a6de-cc8af21269a4", "value": "INST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f377c734-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966795, "uuid": "7a3ccdad-0c83-4452-8f4e-fddeab007d34", "comment": "Malware payload (AgentTesla)", "value": "7c10e3355416a58b5a67ad7280fa6878", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966795, "uuid": "0e367e2d-83df-4323-bea8-868b0b14a806", "comment": "Malware payload (AgentTesla)", "value": "d997738192f067dfc261c68889e5d82cb0a25a7527c63ca5cedc9e1843018bbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966795, "uuid": "68a60a56-5e4f-4e25-8301-83653a03d700", "comment": "Malware payload (AgentTesla)", "value": "bc18a5c82a11a416888be2342e537e43b18ea624", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966795, "uuid": "13ce74e2-3126-443b-aa69-467e9954216b", "comment": "Malware payload (AgentTesla)", "value": "c4b5634f78433c49f3789d263f4eb07eb70b2e120c3ef5fa5cf2eb76399618d96def49b726ca824cae5b4b99e9eef897", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966795, "uuid": "111ef5af-ad04-478a-9db0-1a7bebf96d86", "value": "T15A45E0163388CF21C61F51B9C8E2C2F81727BE45DC449BC7B6C9FF2939B22A66951583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966795, "uuid": "bcae8d0d-afbf-40a6-8d0b-3ac9533ac2db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966795, "uuid": "148d0de6-73c0-4bcf-bb82-35cffd431912", "value": "24576:30xzMnLUxNBVmeGMzM9eR6925dqshgmcc5j:Q8AxNWneM925jgmcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966795, "uuid": "ae7d6f7d-154f-4ccb-a458-8379e9049bb4", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966795, "uuid": "08ad9968-ae1c-46c7-8c9b-3aac26887a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966795, "uuid": "2dbe9ffc-0bfc-4cf1-b43c-ab974eddc7b0", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663ba942-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690998341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998341, "uuid": "9ebf3424-436f-47eb-a343-d19ed368ad0d", "comment": "Malware payload (AgentTesla)", "value": "9ed0ee5f668c973857810aa5207b775a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998341, "uuid": "429f7b5d-c705-4f99-a292-3fbf962a399e", "comment": "Malware payload (AgentTesla)", "value": "db5b68a53ad68b6a6ca23377a582cbb85df401be1a01901debc65f58b64fff6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998341, "uuid": "e9016112-ca43-4ecd-85d1-1c83761ab75c", "comment": "Malware payload (AgentTesla)", "value": "1e9e85ce0eca2c9908946be9b22d8cd0ce035cf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998341, "uuid": "a9974f3d-783d-430d-ac97-c3038ca9c1b1", "comment": "Malware payload (AgentTesla)", "value": "1b1eea759a513b9272861d62ed668d05a4bb1a3735e7a5753976f2cb5b9d88a0543743cab1791d7848a4b3eaca2a48c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998341, "uuid": "743c9059-5e49-48da-ad02-bcdabc9debe4", "value": "T1DE05F16976026AAEDD2CA174BA6F158C33EAEFB915D3B00A14133EDF5C3234D27611B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998341, "uuid": "0b2625e6-6636-4b61-b441-e9a628a3fafa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998341, "uuid": "e8e03605-5768-4709-8a53-b42f6155f820", "value": "12288:KRSuPVB8Bqs401IensxZbZYwkAa97jz7Rhu7PRia5tCwkOXbo7du7BOoZH:+SutBCOdOwkT7jz7RhugOta0owMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998341, "uuid": "0173c890-4f0d-4a0b-b185-5e695eb579c5", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998341, "uuid": "a232efaa-d974-4192-91ba-bc84691df8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998341, "uuid": "8723b19b-b48d-4b7d-9537-148f764e7ef7", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930e265b-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690964486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964486, "uuid": "fe458bed-d8c3-4ca0-8315-31cdd165016b", "comment": "Malware payload (NetSupport)", "value": "a61475b49fea7e08719a7e8ad1c5d278", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964486, "uuid": "20c8fd39-869d-4fc1-9673-e79e002d7e91", "comment": "Malware payload (NetSupport)", "value": "dc020c98ed1d39721ad1f127dc0c04a0735bd47c6b6ecd222683210a601d90db", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964486, "uuid": "bce4a023-30fe-41bd-baae-b210335db787", "comment": "Malware payload (NetSupport)", "value": "60591111a837c93acf7e32096f43ea704831da35", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964486, "uuid": "da3e8abf-6fcb-45eb-9646-128d799150b5", "comment": "Malware payload (NetSupport)", "value": "4b99c81c7a83ac1a538f990aa9ee2db21f2439d0e2028c9d31184f919c191b23321ba502647ad4fc306eb5c2db34c234", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964486, "uuid": "fdaa64d1-7406-445f-9afa-ce27aff665d6", "value": "T17B019712154BFC6D126BB29577B840A02FE24880D4593D20AB445D4F9FB2C6A49EFCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964486, "uuid": "0a2fab28-c7ba-47bc-a9c4-e6f088c9e80a", "value": "12:EbxS2h3q+jhGSGpBlsVTXuZ7+DP98XTKIDWss1CYublufN3Bu6a39GJ/:EbI2hFhapBlLoGXuIDvsPuGYT34t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964486, "uuid": "62352b26-fc71-4480-9e90-76e0d506c1f0", "value": 714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964486, "uuid": "e6c377cf-9d89-49c9-aebf-3f47320e562f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964486, "uuid": "dd30ebd3-59f5-4625-ba02-cf2dd28371d3", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94102953-3115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690967924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967924, "uuid": "9b320466-20c1-4d7f-99a3-35e8cc4c2fe3", "comment": "Malware payload (Formbook)", "value": "72bbadaf3aae49829447214a1ab819fc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967924, "uuid": "28440346-77fe-4575-b719-48d46ed27363", "comment": "Malware payload (Formbook)", "value": "dc934dec8fef973cbadcead0007e6847f6771c3e2852e8e866902ec77e1630b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967924, "uuid": "6d451b58-bdd4-4db9-9b98-84f0f6bb1758", "comment": "Malware payload (Formbook)", "value": "8b62bd57c3895d8a796ec0d4f0bb76c8f524c9a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967924, "uuid": "0b105ab1-00b0-4d74-bf79-f24f6bac7779", "comment": "Malware payload (Formbook)", "value": "0e3c82655f2120c73cda1f24851d7cebe9c58274448c1d2d8714bc065c1b23499cdeba92a3f997570c5890bcf18e4737", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967924, "uuid": "6a869280-54a1-4b96-9781-5231a013d4a4", "value": "T1373423E048C56E794C248693063E29E767A3B986B3A3DFD153F4237E768BC2509C3E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967924, "uuid": "e6510c79-0b4d-4708-99dd-a5347eb19703", "value": "6144:qGAClGISy/bv80lW+DqJMqWaMEKX2Fia9e4TX:rc5JEeJKzF2Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967924, "uuid": "643d91a1-e02e-4b93-b02c-9a230b77500a", "value": 236446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967924, "uuid": "704c2596-d900-4d7b-bba2-e39b85a675b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967924, "uuid": "01653f5d-ec2a-4e90-9da9-e6bb4eb1d7e9", "value": "Ultratech Alfa PO NO.333.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3141e230-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690966040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966040, "uuid": "5c260863-3049-46a7-a9a2-ee8a615ed20d", "comment": "Malware payload (SnakeKeylogger)", "value": "3f1101fc46386a1a429d486be5d8bae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966040, "uuid": "5ac3d7ab-0894-4461-bbf5-6e316b320cd2", "comment": "Malware payload (SnakeKeylogger)", "value": "dc9a1f9a6534e1fb2a7cdd410b0d94b8a55eebef7f26302f358c2f715fe3d30e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966040, "uuid": "d659692e-12e8-47e2-b63d-bbeb54716639", "comment": "Malware payload (SnakeKeylogger)", "value": "b7654e3c896f147d1849749e9fce418be7b28859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966040, "uuid": "0cfdf3c1-cd80-4be0-ad3f-b1f1d5985b87", "comment": "Malware payload (SnakeKeylogger)", "value": "7c8df01d8bd3652a5d517d2a3ca868acad56a52396ca0c1b2b6aa135bfab2ae78ade1c1f20dabed1af4553a979b88571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966040, "uuid": "755a7b11-a817-4c67-a589-b2cae13c792e", "value": "T19D84D0487358F0DFC06B8F3A99A12C20A631B8B36307C317A557219C9A6E7D9DE156F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966040, "uuid": "876e38cc-7471-4ed7-8488-bbe25b7d4695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966040, "uuid": "e3fee057-f424-48d2-9784-3515b41580ad", "value": "6144:mDW5mfXMetOQbuRZCewRjdcxxyZkUHtl73LpsgrpeXbDIIPPCUMFulS+42:t5m/XOQyRZgdcxxyZb3LpfbEnlS+42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966040, "uuid": "4042aced-f645-4588-a315-6288e524fc41", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966040, "uuid": "98a9a205-f235-4a1a-8334-35497dbad842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966040, "uuid": "cdc58db6-b9eb-4fff-8f43-56fc8f25d3aa", "value": "3f1101fc46386a1a429d486be5d8bae3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac1c1af-30f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690953627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953627, "uuid": "008d4b8f-6030-4773-a7fd-9a0f7bf53c1c", "comment": "Malware payload (Loki)", "value": "aa504fa4dc0c6c5fb21aeda36579a853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953627, "uuid": "19682f62-8391-41cb-800c-f50005256c8c", "comment": "Malware payload (Loki)", "value": "dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953627, "uuid": "0b7583c8-b85d-4b72-8219-1d91271f9fb2", "comment": "Malware payload (Loki)", "value": "3e9b482c60e579d0edc2ea6e518cc82a509eacb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953627, "uuid": "f5b13b06-d4a0-4904-ab03-6b1682ba31d2", "comment": "Malware payload (Loki)", "value": "2fc397262a7436a0f9f01c30970fcdfdf046f8f2ba97a805ec75ebe18f86aff14011bbd5e3c3c291cd9acc06d981c97c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953627, "uuid": "c1570d03-bf5c-4121-b3d1-a3f36e240ceb", "value": "T18AD4CF043269ABA7F43E8BF49514558007F653BE706EE74A8CE6A0EA1B61F500F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953627, "uuid": "09131761-d4b9-4877-9d12-4d18b6ff4a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953627, "uuid": "f22dc9c9-4667-4ddf-8d29-83dc09b0c31c", "value": "12288:b5MYGFGbdEE5wr17nlcAo7Y3hNXYEQXDu+EUuowWLCPV:b6dFKdw1DGY3wXK4wWLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690953627, "uuid": "bdd9b352-22b9-4218-97a5-feae1bc841c1", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690953627, "uuid": "3895ba81-be31-4d07-946d-9ec9bbc52be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953627, "uuid": "d7ad9822-85f5-4dbe-86df-85acab681adc", "value": "AWB# 772803166933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc7c4b-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690970257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970257, "uuid": "23f03b3f-45a4-4f78-ba93-90a3c1491ba6", "comment": "Malware payload (Mirai)", "value": "9255c902d8d4f7ecd1f594d6bc01620d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970257, "uuid": "a6da0e3b-d222-4b3a-9d19-9911d5d807d3", "comment": "Malware payload (Mirai)", "value": "dd9e1e778c75aee7f05bab89bff4c81cc3c97ffd508659ce1935280af40e0d49", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970257, "uuid": "ae5f72b8-a96e-4d8e-9cdf-5c41929edb3e", "comment": "Malware payload (Mirai)", "value": "d36d36e37afc20fa719811c5e9d77c011e084236", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970257, "uuid": "ce6b147d-4d6d-47a3-9fc1-59b77328ed60", "comment": "Malware payload (Mirai)", "value": "66e0e4c5f660f8826747570fbc142107bdab131679093b4281361c0e115c50c5131b825031e0ac14e68fb021f0e05aa9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970257, "uuid": "92ee5944-0d56-43d7-a34a-380095bc5512", "value": "T1D5B30845FC509B17C6C212BBFB4E428D7B2A1768D3EE72039D256F65378B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970257, "uuid": "9e5c204c-5479-49d4-97a2-4927372bd6a0", "value": "1536:ZhNOK2dTTan1/AxPG4VamYT8rxxJMJM6qNfRZxl8+wywLFOKHHrWHlpWGOpY8:ZhqPw1/345Y4rxxJGqNZr/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970257, "uuid": "83c07600-2c38-4b09-9b0c-79db724cf6aa", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970257, "uuid": "7b7ba05f-f477-4d34-9d60-4ea2758284d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970257, "uuid": "e7884d6c-16ab-49d3-b29a-ffc08b140330", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112d27f7-3138-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690982737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982737, "uuid": "0b7c2acc-d70f-4e50-9d13-1aaaec7aa924", "comment": "Malware payload", "value": "dace36a6c0a93ab07cc33e5cf58a0226", "object_relation": "md5", "Tag": [ { "name": "CactusTorch", "colour": "#AA4B2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982737, "uuid": "609ba1bd-44fb-48c8-a21c-62cb20fb93b6", "comment": "Malware payload", "value": "dec62f5ad1014018b68b7c02150fbdad9103eb092f40bff96dc13ca255b5e4c0", "object_relation": "sha256", "Tag": [ { "name": "CactusTorch", "colour": "#AA4B2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982737, "uuid": "c8858499-cb80-4c86-a5d9-31becf66b197", "comment": "Malware payload", "value": "ab353d962ed2e705c8abfd78dfb339080fb884a2", "object_relation": "sha1", "Tag": [ { "name": "CactusTorch", "colour": "#AA4B2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982737, "uuid": "55be2cc7-dbe9-4799-9e9c-50f0b8d0958d", "comment": "Malware payload", "value": "771ec2412295424c70d2d3d30be08610ec833b3c12b42c769d81d6ee6a7694203a832a3b13c52c2cd49248efe57ae76b", "object_relation": "sha3-384", "Tag": [ { "name": "CactusTorch", "colour": "#AA4B2B", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690982737, "uuid": "0548bc8b-d1df-433d-b0a7-d037439120b0", "value": "T14F52813176D1B8E46BFE69B0CC4129450EEB2A470360745BA6FF406525E9D23FEDAC0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690982737, "uuid": "9287fda3-b495-470a-b64e-a0838e789c42", "value": "384:/rf5xH6hOBVwpQadmJJdmbIklEqlSsosp:Tf5twUwpQWmJJIbIaV6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690982737, "uuid": "7d421f62-1d45-4709-abfd-77ae549e2b56", "value": 14129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690982737, "uuid": "6c372188-457a-4c44-90a1-473837cc00e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690982737, "uuid": "d458737c-2f28-4df5-9919-1d7c1d87beda", "value": "m.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02108c6-30ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690958495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958495, "uuid": "43f1bdc7-d31e-4022-94f2-a10bbfe0ae3b", "comment": "Malware payload (Formbook)", "value": "e3171f69ed130665ca8ef7a092c8c634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958495, "uuid": "1ffd7eab-1984-4659-bb4c-c18e026e9c44", "comment": "Malware payload (Formbook)", "value": "deece3e759d053d77f3e54592ded17d89591b5ff4f535c0183a53914af85e464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958495, "uuid": "fbf94285-ead6-4ebb-8d7c-55a3f13846c4", "comment": "Malware payload (Formbook)", "value": "3f730a8bba104ca4221a91df2b92fa3b3be042dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690958495, "uuid": "6e651be8-06b0-4258-9cfb-544f1ef24efc", "comment": "Malware payload (Formbook)", "value": "19c307920584971db82956fbd2b829db6d2ca65a1d789a2c6b50190e24804500e8167587d49c80c31e05face44ce7274", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958495, "uuid": "6be60b30-c8c4-4256-8da7-36922c9f5660", "value": "T159441241B751C533DCF21B72193A2A2F7EB9E03250216A5F17608BAD396A747FB4C326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958495, "uuid": "82840400-ac86-47fa-80f6-d93091bb2711", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958495, "uuid": "4e577c00-927f-49a2-879b-55fd6e79ba6a", "value": "6144:vYa6tbArPnrxysxtAhA9Yi+2N5In4rMYepWDe5Bu4FnBXrV:vYfcrvzCAai+i5RwvWcTDXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690958495, "uuid": "c83ea5d9-c556-4a2e-8883-92908ef44b3d", "value": 255215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690958495, "uuid": "427c1c82-2b5c-4e2e-952b-05210deb8789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690958495, "uuid": "bb187faf-f197-492a-964b-6fad0640279d", "value": "SOA MAR-AUG 2023 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2065a0dd-316d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691005525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691005525, "uuid": "e2330d68-9154-4a01-83b7-aef205563f8f", "comment": "Malware payload (DCRat)", "value": "2f57465fef67c878dfdcfbf41b9ea5bd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691005525, "uuid": "7560f822-d021-4999-90c6-03de4935f260", "comment": "Malware payload (DCRat)", "value": "e13377f108635576ff21722e6f72fc207050ecba5e63684ecd64f1cfb0d5959b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691005525, "uuid": "840a6437-16ed-4a06-af9e-5d3aeebb3b38", "comment": "Malware payload (DCRat)", "value": "a88165b50666ce3ecd7dfb0bad870d7e152b1802", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691005525, "uuid": "8601b8dc-63d7-4e5b-b4fa-4c9ce0a50803", "comment": "Malware payload (DCRat)", "value": "8cb9196236e180d300a75b2433d5423bd7640259774f46bb45e410ec363aa9243d9fbc52692a54dc0e110570efd9a57d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691005525, "uuid": "f3feef9d-4aed-4159-931b-c3af6a988bbd", "value": "T1D2E50105AA63CE53D3C43A72A5A7582C4B68E9A272A7F70B1F3D11763CD32B61D043D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691005525, "uuid": "3aa46a35-0b1f-4bc6-a198-4039e8288cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691005525, "uuid": "d422b3f9-da3c-4a47-9f52-dafb7e45c24f", "value": "49152:mqxmuRx33EBTUhqcOsnV0adKBqaDS/bihL2FKPb/DosuH/7STZVtVjBTcrY:BmwF3sTGvOsV0jNhLKKPbKTSTZhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691005525, "uuid": "7459afd6-2b84-4955-9489-84057483a103", "value": 3283456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691005525, "uuid": "2989db22-a38f-4fa3-b3e3-1e57dd2d87bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691005525, "uuid": "8adcfbca-8a80-4827-a09a-8601f3bd7cc3", "value": "2f57465fef67c878dfdcfbf41b9ea5bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a64ff-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690967302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967302, "uuid": "9899163e-9880-4bd4-ad24-a4ebb770e5fb", "comment": "Malware payload (Smoke Loader)", "value": "1665ef03c15113763716644a5e89f5c0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967302, "uuid": "4bc98dab-08a2-4a2e-a2d8-b9f022340b3c", "comment": "Malware payload (Smoke Loader)", "value": "e1cd0fe76134275aaccb166d23a7eb8f18079ddc551fad4ee6c1b9b9abe2aa62", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967302, "uuid": "a1d823e2-8309-4053-b379-4c930f8d2548", "comment": "Malware payload (Smoke Loader)", "value": "18a165e5e6a3706adb85c34775cb2d7c1b66b7b7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967302, "uuid": "bfdd174a-e318-4c40-a23e-67c91af5e8a1", "comment": "Malware payload (Smoke Loader)", "value": "59057c4a8194466178054c55cc663a5e4bbebec43f76e448c900c9acc80e910223b2c006b7f9556d7277278d79fa5700", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967302, "uuid": "3f3f3b2c-6ae8-49dd-85bf-5a9efd510af0", "value": "T189548D122290B471E3235A324D29CED43B3EFD92AF2867CB22587E2F5DB11E1C532752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967302, "uuid": "870499d6-3cc1-41bb-8a2c-55d75428d664", "value": "4a60f94d678887610d46dafb1219713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967302, "uuid": "2afcea0c-1029-4f98-9d9d-4d2170be7b1a", "value": "3072:ORFR7Whx1PWdBUjf8CnsHgW/fprqHdn0KP0D4EICtuGRL8slAIBA:EFhy1PWdqJWLUecwtdRLTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967302, "uuid": "c0e80358-d418-43f2-aa96-6238bb2f2ed7", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967302, "uuid": "de9ac7d3-4db7-47e4-bf50-09321fecbbda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967302, "uuid": "9f178635-8520-4ec8-bb92-5418b8264ef5", "value": "1665ef03c15113763716644a5e89f5c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437d7ee4-3149-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690990122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990122, "uuid": "1b5a22e9-c679-4364-8fa8-5dd2095695fb", "comment": "Malware payload (Mirai)", "value": "06eaddc876ab8d22db70759eff82e4a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990122, "uuid": "fec7fd35-6e99-4fcd-b63e-059f387cff7b", "comment": "Malware payload (Mirai)", "value": "e3284cf633a0e33f2b477dd0dfd3343b95debb217a2065e89c01a3a7f71dc68d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990122, "uuid": "0a249a9d-8a0b-4d08-b300-0f6b6145daf4", "comment": "Malware payload (Mirai)", "value": "7d770e0992e4ce5bfbf8d321f5646cdcc46dfa0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690990122, "uuid": "5cf8f8ca-0a60-4dae-9aa4-ebe06649bbf0", "comment": "Malware payload (Mirai)", "value": "4c1b65ed6020f55dd814b24ebea062c564ec5310bdd5e7eba51e27deff4eb49b99ffe1e76b947bace910a12bae26b26b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990122, "uuid": "349e4cf2-27d8-4cc7-957e-58c373503285", "value": "T17D333B9AB8019D3CF95BF6BEC0170A0DF630275051930B2BA7B7FD836D722649D26D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990122, "uuid": "88bc9bcb-40b4-446a-9eed-cbb34295d1f6", "value": "1536:6H5HBbraaTF9ZSieAvxOrP3yBLWSK85E+:6ZHBfaO0eAr8LDi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690990122, "uuid": "213ae586-c877-4791-b217-704fa58f79ac", "value": 55128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690990122, "uuid": "36921f54-9f06-4567-a877-28164f8f5bfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690990122, "uuid": "28e7f27a-a0b2-46c5-bb86-87332b6dd382", "value": "06eaddc876ab8d22db70759eff82e4a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f88b28-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966132, "uuid": "3060c97f-4554-4885-9917-a2625fbe951a", "comment": "Malware payload", "value": "3efbd11575f1a13a790f3b27d2b79ae4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966132, "uuid": "9e4b767e-b5a8-4533-b085-66beb2362dd4", "comment": "Malware payload", "value": "e338c19eaac5d65371aa7e4470d1c6139eb762782177a84bc170cfe7703c452c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966132, "uuid": "c78e7eb2-7f42-4acd-bf79-83f80b256519", "comment": "Malware payload", "value": "5faf4bcbe47e22ba2c358ae45b1127e27562274b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966132, "uuid": "a8d0fdc5-7369-426d-b7db-4ebd63902a87", "comment": "Malware payload", "value": "b40337b88c08c2ec55cb3efb4d97b2a50f85beaa46fd292f859d5be548778799c0dfa950fd399fac8eef046889752b97", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966132, "uuid": "a13dc287-281d-4298-8137-8c7548707235", "value": "T170747C45D84EA716DDBD246780FFABD2B290D70916D8D91F77B22FEFE6A250C00186C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966132, "uuid": "5ed97a9a-8f3d-4b36-924b-95a2db1b22aa", "value": "6144:nbpmHzL9J/7k5GJ/pjPZdVpI29Cur6D8N5GW5rY2CsSMhVf64gxm0rJ+CAc3n2bL:bun7l/5aDaMWNZhaJn29FFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966132, "uuid": "fd6b0e61-0431-4e49-bb7d-74085a25d227", "value": 366754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966132, "uuid": "048d6927-5f32-4d82-9efe-3675a5f6d68b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966132, "uuid": "8a79d086-b818-421e-83f6-8fae06f58295", "value": "Swift copy #4159735486.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56395de1-314e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690992301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992301, "uuid": "7895717b-bc76-4d3f-ab38-23eaa6178aa2", "comment": "Malware payload (AgentTesla)", "value": "313aa515e741dfada5e0bea88d31d3e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992301, "uuid": "2e7b6651-4605-4c11-a3d7-0789bcc969cc", "comment": "Malware payload (AgentTesla)", "value": "e4bf2c0f2c23c761983ab4c03f287d5692a1446a3087bf043d7fefde261b8e6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992301, "uuid": "1743004b-89da-4c88-8aea-51c0890fe330", "comment": "Malware payload (AgentTesla)", "value": "50a647bc190b3e6a4cd32300cda95c9554ab01a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690992301, "uuid": "84f14bbe-2f87-4fce-8b32-c4593a02516a", "comment": "Malware payload (AgentTesla)", "value": "bb934ca400a489834827936ace72b557688e9889dbd26c78d0de48a8961a1479937f0ee42e6cac6c37c51b82fc5259f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992301, "uuid": "c817b98c-a2e0-4ad2-9340-68b22f8eeb87", "value": "T1ACD42325426C52F9CE5DE7F15D62865043725B8E0224E79BDCD2B48E3EF6B044AB0F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992301, "uuid": "12c82eb2-8b46-4539-a86b-a23904ecd26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992301, "uuid": "187fac41-c577-4765-892d-61e2a679868a", "value": "12288:792iN8JJuz93EqK/MiznB1k7cJW1106V7KC7BLqPzE5RLAHvclfQ:791uJgEqcY0M7JMPkAHvce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690992301, "uuid": "e3b862e3-32ca-4f29-8c7e-ff88c29bf166", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690992301, "uuid": "4d621919-73e8-4b7c-8f30-9998a524cb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690992301, "uuid": "9e664bab-1fb9-422f-97b5-c877451c038f", "value": "z32CurriculumVitaeAdrianaSilva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693d2f04-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966563, "uuid": "94700304-3a04-4dae-831b-b6fa91c6d8dc", "comment": "Malware payload (AgentTesla)", "value": "665985173cdba41ae7c4245aace32735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966563, "uuid": "334d2f56-67ed-457c-ac12-4a1b396a418d", "comment": "Malware payload (AgentTesla)", "value": "e560fff4201d484f88e6c7264d2791b3754504d138e0c0bdcdc99b771074d3d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966563, "uuid": "6a350191-3e92-4fa0-b718-4bb0266992a8", "comment": "Malware payload (AgentTesla)", "value": "f8079cfe9ef0d62c2803b149d82a48661c054c20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966563, "uuid": "0a4048a8-e4d3-4f72-af2c-fa41e48ae20f", "comment": "Malware payload (AgentTesla)", "value": "5b067a1c658e2418e80d48c5fbf2979cc3342ff8321a28c71b018f533e19c5448bcaaef4de499187eacf0f70cd2abc88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966563, "uuid": "c7561c16-6b3e-4f8c-8f53-fddf5d2536fe", "value": "T145C41261B22CA923CE2516F50494161A23F7DAFB449DE2DD8FA2B4E927D7FD0071089B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966563, "uuid": "746524ad-78a3-4a5c-895b-402c37c995e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966563, "uuid": "ecb6da7c-a5ad-46e7-8d9b-58cb4d86ebf7", "value": "12288:kQPQ6NZEX9UYWxJE/5udHKOKzQ9GbPui6lsok+qEByNC5r9K:LviyxJXwaGbPuJ85TNqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966563, "uuid": "4f5623e1-735c-4367-8272-d4d9a7e38b4a", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966563, "uuid": "ad2e0ccb-e845-4206-8c38-20f4c52578b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966563, "uuid": "5e5b42cd-93d8-45cc-b465-87f296c9acb4", "value": "DHL - OVERDUE ACCOUNT - 1300403511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688d6749-30f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690953248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953248, "uuid": "5f489db3-a7fb-400e-849a-cc96534b8f4b", "comment": "Malware payload", "value": "5057042b2949c60f1d598845c26a2a18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953248, "uuid": "31038ad2-6ec1-4385-b4c3-ccd7d3708fcf", "comment": "Malware payload", "value": "e58d93351234c8ba5f47c653f57a7a45ddcb052afb8f331043836c4408533fa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953248, "uuid": "ee1193ff-928d-4d92-8ed4-a2b65b8197c8", "comment": "Malware payload", "value": "a4cf48a4acc19e62418c14c6ded643c26d048261", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690953248, "uuid": "14d16745-d214-4dda-8508-5883c2626204", "comment": "Malware payload", "value": "a035a3c350bdf5076898915d561bfbd8d5d123f39642bffc4b5791c2293e4880f1a925bafb305fe0183b498fa462ec4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953248, "uuid": "a4a6c56b-bf7e-4ee9-8c17-39170d689fcc", "value": "T1376412C9CCCC87A4D3F86DF046D7B5E370A8CF663519145AF858B2AFB4F287AA146054", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953248, "uuid": "d61b34e7-14eb-4a98-8a37-bf1c30784901", "value": "604d14eda74ecb05dc3fd3f2233fd004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953248, "uuid": "722935a8-b312-486f-bfc5-7210795a33f5", "value": "6144:ydkzF43SM5dCsenQjq2Zs4ogcAWUwxPk47oLFldV1jJrBBxRdE3ajLoSg84KH:y6zF4vCT4q2Z7NBWrl7EzdH9BL5LoSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690953248, "uuid": "0da56ac4-41ee-4278-a0c5-35bb44510825", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690953248, "uuid": "0cb99444-0e83-4bbc-9c59-320bb496bb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690953248, "uuid": "3fb4dbce-e0c4-4c6d-b8bf-12db7d7cadf3", "value": "5057042b2949c60f1d598845c26a2a18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4df698-3104-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690960633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960633, "uuid": "6068688d-1b58-4ca1-9323-104543d4291f", "comment": "Malware payload", "value": "6a2053d61cf8968490c3f943cd499f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960633, "uuid": "34b73bcf-4dbb-4d94-83f1-8c9ae5d70050", "comment": "Malware payload", "value": "e67e48a84ea6e6f82b702f02806345e45edf04898c0a6c91d58dbe17af743dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960633, "uuid": "8552f2b8-0749-467b-a424-1d406cf51add", "comment": "Malware payload", "value": "1bd798ceed5ccc883bdc2348a461c6ea1aa93755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690960633, "uuid": "f3680430-cb50-4cb0-86ed-ee8e50b5729f", "comment": "Malware payload", "value": "12f4a14b7b7e8e2887f349b8e362599d8d11da4f9fabbb34be50079c0cbd5612824e30fda3b0b8cf1ee80e87ee76d2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960633, "uuid": "0c94cf10-08a8-49d2-82dc-4d37dbc1233d", "value": "T13C456B07F1E610E9D009C075875AA633EA76B8990B3076EF06908BA52F77FD05B3DB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960633, "uuid": "3ad0e48b-8c6c-4530-ad42-d8fb41c842ef", "value": "24576:hTpdxtIWBiLeQVsCPfWMvyKMZdBcB3d/dDBjX7i8nBMa7nfuajcE:RX+j28jadvQt/dljrSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690960633, "uuid": "0ef9b0c1-955b-464d-98d4-4eb656488a0e", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690960633, "uuid": "cf7fb642-babd-4da7-9dbb-cbaa882f4fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690960633, "uuid": "0899dc64-95e3-43a9-bad1-ec0ac6d18b0f", "value": "LummaC2_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0f93b3-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690966647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966647, "uuid": "9543ac76-f9e3-4218-b844-ed5f5ddedfcb", "comment": "Malware payload (GuLoader)", "value": "4ab1d34bf4b6d9831c3eaf898790f2e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966647, "uuid": "ad925610-9410-4b7e-b7d1-ebcc8bdb6f27", "comment": "Malware payload (GuLoader)", "value": "e749a67d92bf775f6337e3d0324f8208ac9c35f994f758a965dd0602b81a36e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966647, "uuid": "e3e3d8cf-8a05-4b17-80ab-2eeb0bacf1f9", "comment": "Malware payload (GuLoader)", "value": "e9ab6b75764d2952fb9f42eb83e7b52997226836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966647, "uuid": "387a3af2-8c07-48cb-849b-c32d15c39b4a", "comment": "Malware payload (GuLoader)", "value": "433f3a755b6b392d9118bed0c9628739aad565050ab3914471177b61833fe556019cfa3763230ac32f43cf5f9dfca0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966647, "uuid": "80e57b47-3bb3-4fe1-82a6-3e7ac02e347e", "value": "T1A144E1983AF8D457D2814F701EB6E227E2B4FE79142A961F9B523F6C5F38181C60D24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966647, "uuid": "8fc5ff8a-69d3-450d-86c3-3cc135e990e8", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966647, "uuid": "06582c74-db62-4924-b3e9-d1edd94d338c", "value": "3072:H030XCIscLlj+c4qw+bm8RczoBKqa36rdqW9t86yrt0OfTnLzbem1akkWYKTy8KN:Hj+q7FRJBOYk68reOfTJP/zKck0It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966647, "uuid": "6943f0ed-aa67-4f40-a562-102ff41d0ade", "value": 254820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966647, "uuid": "70a95fcf-cc1e-402b-a0fb-6b46ef9569d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966647, "uuid": "6514009f-e1e7-4b1e-a2ac-4af35a56a5e1", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae545a6-3150-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690993302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993302, "uuid": "b26b3ffb-808d-4110-a1c2-9586e235afd7", "comment": "Malware payload", "value": "5d63ba8b461591609a3f2bade40dea72", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993302, "uuid": "ae3ae336-af2f-4161-9989-b6e583f0b386", "comment": "Malware payload", "value": "e9e4ddb200a9eae8cb1708002e33b7a627bc3c5a463e001262fdf29c0cfa3549", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993302, "uuid": "af8ea770-9106-4666-9551-cfb44fce3d86", "comment": "Malware payload", "value": "55e9fbebb8a08c34d951889782974b75f86dab98", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690993302, "uuid": "5d9688b8-91ba-4371-af67-164f0a6af66c", "comment": "Malware payload", "value": "bede6b5a95a5312d6bf01333f18037bd04686f559981567b6d293e1a88f7f37812afa093559d694c5b779d88af73c54c", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993302, "uuid": "96afafd5-ced3-4135-a049-3cf6c84881c4", "value": "T1C7615425E50FE46D95B593658D87E674FF3A40AB56801648B3CD926C0F3182A03FDF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993302, "uuid": "365b5c6c-1a51-4b41-96b3-44d8d2bf1bbc", "value": "48:oeZeWgVF2SxYP4XW4jVuKmc4TQuzRl31lVIxdkDyq9xmdml3nEPuN7tLVYxZ:oLWw2pb41ruOn2Fmdml3guJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690993302, "uuid": "df0e1a84-e8aa-4a28-864f-dc347096e29d", "value": 3335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690993302, "uuid": "baa96ebd-6bc1-4f3d-858b-0bda898294a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690993302, "uuid": "3b517382-c2d0-4377-8936-fe143d9f0f95", "value": "23HQy354.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea66e28d-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690957761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957761, "uuid": "e54db67c-0de3-4ed0-9535-5d53466b1195", "comment": "Malware payload (Loki)", "value": "2931b1cbf4b0d6a14c200cb822f8cfd9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957761, "uuid": "e50f1a47-8b55-44c2-925e-34984a95e346", "comment": "Malware payload (Loki)", "value": "ea6adac3041b4da49d86392e182a93616c73d42585cd0b669b072eb420ef11a3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957761, "uuid": "fbd00772-d646-4e69-817a-56ebf5a8f47b", "comment": "Malware payload (Loki)", "value": "84682b092a4156dc17cff79d86578bbb60f4a3d0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957761, "uuid": "beb94891-c02b-44ba-ba85-579e73cb34d3", "comment": "Malware payload (Loki)", "value": "0f57c619ebce0539ec7b8e9127d7acf87f262d973cac909c2e673625f88fb34c520f83959ee24289a808d327f846c285", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957761, "uuid": "59c62400-62a1-47c9-b831-4d93fc082380", "value": "T172B4236E419C1E630E703A2AED72C77B8C2D08566E3A998BD3742451102D3E9EF92F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957761, "uuid": "7b36ad6c-8cc7-43b4-af04-46d21c75cf30", "value": "12288:M1yzgoIKyfTbitXYmCTcubjj5PX7nvqloKNbs7L3pb6sX:M1egLKaTbQXY8k5XbqsXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957761, "uuid": "a87fec38-b7ee-4760-8e4c-b8aaedaf2f36", "value": 516420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957761, "uuid": "0cb69c4f-8e6b-44a1-becb-ef52d3f11523", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957761, "uuid": "23a94b5a-3053-4d8c-a745-5151788c9c13", "value": "Purchase order_0204217.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2b5ed5-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690966058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966058, "uuid": "6eb02976-2320-4dd3-b396-b442e30700d7", "comment": "Malware payload", "value": "232013a865298f45776f7b142a21e473", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966058, "uuid": "f8e8e43c-2e3f-4dac-af4d-084cb6490e7c", "comment": "Malware payload", "value": "ea7764c23c5983bd93710d268876a9950f0a31a796cb2412f4c55475b2b38e83", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966058, "uuid": "2aadab1a-5f04-434e-aac2-fd6632610679", "comment": "Malware payload", "value": "878805fa5ff7cf2c60e5adedd2bbf7ae146fe528", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966058, "uuid": "251f602c-a089-4757-9553-cefe04fb44fa", "comment": "Malware payload", "value": "e90d9efefb464a97e02239aa72322dc6ded07334f739274ca12a11d0dce97a2f2163a4229b7a5b98eef3a750eb298db9", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966058, "uuid": "2e5b9322-e87a-4c45-a710-32364a08e26c", "value": "T11474F1003208D6A9E18297F829E2B28E511CFD337DC562C76BD4B30F8876EBF561B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966058, "uuid": "897b0e51-f47e-4ee6-a9bc-ef72d5e878c5", "value": "6144:rJunDwQ4YlLSmmeHZMhD6wM3XALQuELdSRVgA4R/zKbk4VfBI2zTw8r:rcDwWQmmme6v3QLQuExOVZzVpI2zTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966058, "uuid": "35931fd8-27f9-4c1f-873e-57fc96dd35a1", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966058, "uuid": "62bc9643-c7e4-467a-ab1b-9e0eff2a294c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966058, "uuid": "8275422b-aa02-455f-a6bd-60f071dcf075", "value": "700.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e96f1a-3135-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690981582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981582, "uuid": "2ca93fa1-b357-4bf4-81b0-a03c82361818", "comment": "Malware payload (AgentTesla)", "value": "37cfb8c52dd40cc6188b0c439a89ad14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981582, "uuid": "f7a895ee-a2d4-4b57-ae8d-752e32e7f7e1", "comment": "Malware payload (AgentTesla)", "value": "ec3f93937d8190ad39e304f09024e223b2700b1db5d6cf9e7f3bc88051639b43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981582, "uuid": "a01a6a47-a700-4db1-a3ce-95f693631ffe", "comment": "Malware payload (AgentTesla)", "value": "c4bac7d23064b08ccaac4feec13f2cb1abde3afd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690981582, "uuid": "a7d0588c-a321-4d59-b258-2948a87a50eb", "comment": "Malware payload (AgentTesla)", "value": "cea053930527c9bf38732b04e01f86e34bed7e9234a076089c51556865b49c19127fea9babc0cb5476b2ba4b9dd6fad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981582, "uuid": "6d71f485-450c-418b-902b-0c1f6fe61c57", "value": "T19005C426417AA0B79F097ABC5E13D83A35DD6B40B1B6E188B72F38C7D5C61120D3A7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981582, "uuid": "acba85d8-4087-4229-afdf-c8acc5ebc687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981582, "uuid": "d906a49b-dee2-49b0-867b-8dcc6226f127", "value": "24576:giKpppNpppppoOQpppNpppppoO3Wq3+S+GMnSmEuayAeU:5O7O3zEEAAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690981582, "uuid": "e78fb404-ef04-4a2e-8b44-c1761c1db231", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690981582, "uuid": "94ed5606-2a35-4732-8965-01cb074e4f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690981582, "uuid": "51ba8d88-69c6-42db-b00e-215fa5146944", "value": "DBr2mSFSyoV59TW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80cfae4-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013162, "uuid": "7a372d58-c053-4429-a7f2-aeed4857b0e5", "comment": "Malware payload (Mirai)", "value": "281d7ab39f048498a9e26e29e91617c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013162, "uuid": "52472996-a2b9-4454-8574-8e362e3dc335", "comment": "Malware payload (Mirai)", "value": "ec5f700f5a2075a02d6332c2212033ae67db59009520cb5825c20fa098048771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013162, "uuid": "970ea19b-7bcf-4b19-847a-480fefc418b3", "comment": "Malware payload (Mirai)", "value": "79a78bdf970f74edcf38fc2020b4d397bde514e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013162, "uuid": "166e5666-70e2-496d-ac75-bd89ad476d15", "comment": "Malware payload (Mirai)", "value": "c838f1b387207f9bfedfe65ad5992e6d606541c1a5b4daaae705336a13eb6544876ee8ee4579a72a3b531532011531ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013162, "uuid": "4e2d3f68-9adb-495f-aec6-364dcf5015e8", "value": "T103C2D15360BACE03C8B3837A6E3C19A622645435635DED2D77B95BC437424D0667ECCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013162, "uuid": "b736e284-5bd2-407a-a9c4-f8903f3f808a", "value": "768:X5+Kcrb9VDJe+2KTgdTHOBcK5ZCAy9ftvCiO:0lrb9veqTg9QB5V2tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013162, "uuid": "e92dd9ad-ea68-46b0-bc83-4241f64b149a", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013162, "uuid": "50f55f22-1b14-4c59-8edc-21c1617bfac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013162, "uuid": "12e374bd-5b64-4f7b-bd3b-4f85a1f7e62f", "value": "281d7ab39f048498a9e26e29e91617c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88219afe-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690967474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967474, "uuid": "bc624fbf-807f-4d62-a09e-127f34486991", "comment": "Malware payload (AgentTesla)", "value": "bc89a42094fac06d565983f94cb4fa2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967474, "uuid": "63b98108-4388-4dd3-ab92-a7ab17e72f2d", "comment": "Malware payload (AgentTesla)", "value": "ed248657afc15600a6b8e5b9cfa94203f9bfeda0ebd1a3007356e99836adeddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967474, "uuid": "f9dd9d2a-ece4-4027-8efe-51aac188921d", "comment": "Malware payload (AgentTesla)", "value": "d7a9a95e4a4b3c4a1e60262fece5e041f18c002c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967474, "uuid": "62619e92-c9da-4a76-ae9e-b04c2ba69ca0", "comment": "Malware payload (AgentTesla)", "value": "e6988d4df20de69b4df44c3d765d2bf9b8a924892e8ef61d7616272ac1bd88baaa30029fc1dabecadd9d4acf93f530a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967474, "uuid": "0b39ff85-9634-47ac-b36a-add1a27bfd4a", "value": "T1E1239C6DD34F01A9CF6253379B1A1A4542FCB77EB28452A5306C437833EEC2D91266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967474, "uuid": "a228be38-f903-4874-9301-60b7a14493dd", "value": "768:UwAbZSibMX9gRWjUsFc5vg4SfnEgLSnKXjFSr/jcYxd/TL9d:UwAlRtg4SfnEgL9jUjjcY/LLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967474, "uuid": "67634b31-50cd-4ccb-a3a6-7aeb43a051b8", "value": 49997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967474, "uuid": "90413d28-7414-42ac-a095-e67f88d487cc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967474, "uuid": "59e4e3e5-7efe-4ded-98fa-73ae94412e51", "value": "bc89a42094fac06d565983f94cb4fa2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27039b8f-318e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691019710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019710, "uuid": "c6f78b0c-5977-4f0b-a500-ac00997e7da3", "comment": "Malware payload", "value": "db43080913c00700c9594c80b9b0136e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019710, "uuid": "8108238e-a7fe-4469-8bfa-5881ae1f8e42", "comment": "Malware payload", "value": "eed8daf124aa2e45b77d2e3ecf36030ab7fb68890d0130ade09cc6e4d83536b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019710, "uuid": "7182ed2d-3687-4604-beb6-c1053bffe589", "comment": "Malware payload", "value": "1995345c37e03c519f04f01f96af44627a6864f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691019710, "uuid": "e6652896-9dcb-42bb-999e-50ab52f9f38d", "comment": "Malware payload", "value": "e08a0abd49aa56d54f171a52c18d5718a3c48fe810da050409677b77f11c3b85476cb1c4ea977af42c6f849d4db919c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019710, "uuid": "21e4a8f6-4e49-44b7-ae06-7b4efac03bce", "value": "T1D9C633B6BD8042B7D5B4143A0932F73269BDCF275392A5AF53C8D42CCF85280E97B949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019710, "uuid": "01b8e3ab-ed4d-4266-8d57-70e0ea753aef", "value": "fa2936ff523bbe01bb11c81e10c9ad2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019710, "uuid": "dea0a240-7186-449c-af1a-b63d59a54de8", "value": "196608:uCT+aj1dsbcUdUnYc0o5Gd7+6YMdBvIoP1HGzyAoxDyEFh/bhEqjFFReyQfDP2tp:uCT+aQbPmYRQK7+NqP1RmUh/7EfDPes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691019710, "uuid": "ac081406-9a0b-4790-a040-f2b9b9eb5f95", "value": 11982074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691019710, "uuid": "7ec1b6fe-bdaf-4311-b469-91c674b69012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691019710, "uuid": "4de88749-202b-4070-9e1e-fd9fd258921f", "value": "System.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12267bd-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966657, "uuid": "7d91e4ff-711f-4c91-ad42-2ea2ba8051cf", "comment": "Malware payload (AgentTesla)", "value": "e2aa61140992f908d4bf6e3fb97a8452", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966657, "uuid": "6b3bb40f-6433-460d-9d82-791429ea2580", "comment": "Malware payload (AgentTesla)", "value": "eedee48614c7092e1e1bfbf5c5e4ec7199057d5228037b76df889ede68f27f46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966657, "uuid": "17388434-57fd-4f3a-89c6-4b37a6c88b48", "comment": "Malware payload (AgentTesla)", "value": "c678254b922dc34aded2df7139d54d496244c2ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966657, "uuid": "32998826-41c6-43b5-a529-b5182b5e6957", "comment": "Malware payload (AgentTesla)", "value": "92f58b0b442e24180423fef3e9b01a119652d7b84a3e3e07bad92a6e0e7a93aa50356e8b37bbea6be45bc3cdb63a6b71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966657, "uuid": "9d97e469-0845-4b4b-b2e8-49676232202b", "value": "T16B05F16056DC9EC9C6160BBD0CB2B5E80251AD162530EF5F9E86B0E56A357C213B3CBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966657, "uuid": "077eb673-b43f-40f8-90c1-dc8712005ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966657, "uuid": "2e098feb-a7f4-4f28-816d-89216bab6424", "value": "12288:1+uZeuYmJ+37nZaRCF+1BF1pny1cntPzkmjPzBo4Kg93UkdJQZ/e0:1+uUuYmQ37nZaLnHDnWmHgi3BUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966657, "uuid": "69554d65-cb8e-4b01-9951-01ea5eedad50", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966657, "uuid": "785a90ca-0451-4db0-a839-3b6bed34af17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966657, "uuid": "1fab779e-8760-4493-8caf-5897389fce16", "value": "Fiyat 10243975 forKARDAG A.S.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c43f1b-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966635, "uuid": "13ce2c32-225c-4cfb-aecf-3f4d0a1b741e", "comment": "Malware payload (AgentTesla)", "value": "ff5612d0eddf06a47e32bbfa4fb01a0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966635, "uuid": "444fd11c-8166-46bb-a3c0-2b060b58dd85", "comment": "Malware payload (AgentTesla)", "value": "eeebde8089d33c9b76eddd2a7c2bf80eac9d56716b45662398385d21ae5853c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966635, "uuid": "aea4bcb8-cc1b-472b-adc8-9471fe0f7134", "comment": "Malware payload (AgentTesla)", "value": "f5943d89a6c06832b7ad59a1b2d00b08e05c24da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966635, "uuid": "6d002218-331b-4fc1-8663-ccc1e1ce30b0", "comment": "Malware payload (AgentTesla)", "value": "016a2d357804e4d7d7eae5f0a131e0e7ee7122429f85f0413934aff6ba0b29fb0c6d21ed875a0b0cd9ac5d740d1834fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966635, "uuid": "a05d1fe1-154f-479f-a95a-6abd588d4f35", "value": "T17BF4F04071BA5F57C5BEC3F92660A11117F26CAF113CE3698EC2A0CA1636F119B95F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966635, "uuid": "187460de-75e3-4b14-8dd2-33ec355444b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966635, "uuid": "18131deb-5c9f-4016-80a9-ba112b119655", "value": "12288:hCbpNZ2DDtz43d6MIxlghTRVDMXxrkx9mX/ZEj5ZzHVpc4mvu4I6xEVRe:UbpvWzMd/Irxdyt1m5tIRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966635, "uuid": "de29f83d-c4b7-417d-b2f5-b5ed78b3f18c", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966635, "uuid": "363daf4a-58d6-4e84-bbff-172781a7b6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966635, "uuid": "bf3b4e57-3d00-4876-bc5f-ac3a0317bbc0", "value": "Halkbank_Ekstre_20230321_080804_358439.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb97b55f-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690957682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957682, "uuid": "22e848f3-34a1-423f-88e5-7d5ef63997f1", "comment": "Malware payload (GuLoader)", "value": "ce8deba0391c82f00d9a44f3b6b6572c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957682, "uuid": "0d1a5f35-078b-4484-90fb-32b9b7c95b66", "comment": "Malware payload (GuLoader)", "value": "eefeebe2fe891d981d6946db706e1719d5b588f73208426e77fbf3a836f205f2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957682, "uuid": "28072e63-806c-4d14-8fc6-1aec741fabea", "comment": "Malware payload (GuLoader)", "value": "c4a4477e0f76f8b21f02d671c0c273f7ad450bad", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957682, "uuid": "5eeabef4-c495-4be0-80e2-ea7459a0cfbf", "comment": "Malware payload (GuLoader)", "value": "4d4577ab185e287e8b18b3be3031f407daad0266ea8563fec3034be538cd828365764c3ac5d37e27595cd140c1a72b3b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957682, "uuid": "a54f852d-5df4-4dde-b299-06299d1e0b94", "value": "T11A4522115FA4C2BBEC238D32983E2A635FF5A4335020764A339C675A7766392D60937F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957682, "uuid": "2071e8ad-b24b-40af-a0ba-f0a99890b7b9", "value": "6144:hQA4Fk4kfn0v6uVqSdyfMj/6wYCaHhqSVTBPFFoKFbwzXSlSpewIYeY64B+4C:Wk4kv0iuBalHBqUBPAKZtlSpslY615", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957682, "uuid": "3bba69c5-e6c8-404b-b84d-d8cbae428e29", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957682, "uuid": "d5614a25-5588-45b2-9b5b-1abd09de28ec", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957682, "uuid": "49a2a4fc-da28-4e11-bcc5-bcb28913c18f", "value": "Revised invoice.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e129c263-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690957745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "a1434997-4883-4644-a55e-ddd20ab9a6bf", "comment": "Malware payload (Loki)", "value": "a3fa762c8514cfe42ba71dfb3daf3910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "4a52900e-6668-4d3e-8ad5-8fff5364bb4e", "comment": "Malware payload (Loki)", "value": "ef4356748324545399e1fcddd003130ecb1fa551e6aae225c1bd486a4019799b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "70743343-6df0-4952-8047-3388fb6bb563", "comment": "Malware payload (Loki)", "value": "1cbb6bfc4a07912496f7863efa17df8f09e43140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "4bb87c03-71b0-45c5-a9f6-33e796dcf00e", "comment": "Malware payload (Loki)", "value": "91a4ed2584d0da89ec9a37284b0f3a82db23f5ed5d480b1f048755b0e6667796b829b38c5eb98bef5f3f8d78c9b1dc3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "ebd831e8-cd39-4b15-9eba-9aa91c5244fd", "value": "T1CDC4027025B49F2FC63A1BBE0971401143B49A6A3631EBAF8F92B5D52A327424714FF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "e2f4ae1a-e386-4a50-8d7f-50a88147bc88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "cfd203c3-edd0-4bde-acf6-cfc306cce597", "value": "12288:3+uZukYmJ+37VZa0vElYmxA+2mOj5hBTnJqcu7IFAb44:3+uAkYmQ37VZaNYs7xOfB1hu7YAM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957745, "uuid": "bf408258-0668-4e43-a269-f2d66ece3dac", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957745, "uuid": "b519b343-264a-4601-9b04-51df63622c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "eeaf46b2-e5bf-4693-b27c-4d670662f007", "value": "report (18) le 31-07-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744c162f-30da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690942530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942530, "uuid": "48995620-d2ae-40c9-b036-d0bcc3927463", "comment": "Malware payload (NanoCore)", "value": "5e00fba03ac67d5fd884cae0a2086615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942530, "uuid": "9cbdfb86-d59b-4a9a-a5b6-23abf1c23147", "comment": "Malware payload (NanoCore)", "value": "f0049c88f414b3fff65f2ebe88ea6d4fc2c89c3c8186193526a12b02eda15d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942530, "uuid": "fe4afb7b-d4ec-440f-a866-ed28e7342f72", "comment": "Malware payload (NanoCore)", "value": "e1298be6d034f00a916f096946eb05348b9bdc4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690942530, "uuid": "8ee2988f-7b0b-4ad9-a4ad-8fe6c06e314f", "comment": "Malware payload (NanoCore)", "value": "037ead6c000e6e07996ee4f1ce313f37b44bdc65b29326f65b01e4f12bd475b14e7035c9bd30dac0eb6d695dbf4db764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942530, "uuid": "9c12df3e-de1b-4832-8445-4110fe64cbcd", "value": "T12CF4D04472A8AB67F43E97F49524518403F5A3BE706EE78A4CE5A0EA1B61F500F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942530, "uuid": "15aed6e0-9622-448f-9625-cdc0dde50b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942530, "uuid": "3c2633be-c836-4961-a9c2-83fdc9cc6c71", "value": "12288:t5MYEP9aC7rG496BHOlGguJhTS0X5oLlC43:t6dP9aslGguTK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690942530, "uuid": "0fd47b2f-4c32-451c-b475-a8274d853af4", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690942530, "uuid": "05511315-78ec-4f3c-9a56-83fc4c8f8f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690942530, "uuid": "b775ed3e-8068-4ff1-952d-202a5a3ed112", "value": "Inquiry44900003469.xz(498.45K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f710db0a-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690963795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963795, "uuid": "d73bac76-08bd-41d0-ba7d-2691ee65f188", "comment": "Malware payload (NetSupport)", "value": "9edcda5a5c3d8a6f55e9becfddfce21f", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963795, "uuid": "6f5e27ff-3742-4c1a-82cf-c621b32653cb", "comment": "Malware payload (NetSupport)", "value": "f01797fdfeb93b43fdf32bd4366475c437d4194575c5091179c40a52eb4937e6", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963795, "uuid": "4c229ff3-8034-40c3-baf1-77cb0e4a0388", "comment": "Malware payload (NetSupport)", "value": "4482d81c0190b81b9b16a48375b30e967c22a20b", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963795, "uuid": "89e2a765-5fc8-4547-aa4e-96452ce17348", "comment": "Malware payload (NetSupport)", "value": "e5b9b4243d4c72e2958e1ac6a0b0bfcf7aface19c2ce16ce0e75db235adbc81064e27e58862457613c66be3f237628f2", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963795, "uuid": "9b998730-731b-43d4-a639-df91f2c201af", "value": "T13BE4133AED6CB193A125341F5CA66B7F1E46CA49029942DF3FCA4FC79029A15C0FB52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963795, "uuid": "76fbbb71-2460-43c5-a682-b8ddaf427a2b", "value": "12288:Ic0Lc0rc0rc0rc0qD0DdD6DyH2sLZdBuuuuuuufRiobqbpbpbpbvUkUWUbU+g:Ic2cgcgcgcPI9yyRZdBuuuuuuufR1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963795, "uuid": "6054dc09-7197-491b-b95b-adcfb54fb58d", "value": 683010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963795, "uuid": "cadfd683-5c2f-4678-8091-13bd2ca99e58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963795, "uuid": "744f319c-cb3b-4188-abc1-177009bb531a", "value": "Chrome_update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda3be7e-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690957739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957739, "uuid": "64e2e681-6e7c-483a-97d8-13b73c86bc44", "comment": "Malware payload (Loki)", "value": "2be71ee8ee63870ff6c63adb679d8ee6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957739, "uuid": "66c76992-455c-4c45-9d11-d1f87f5d3a63", "comment": "Malware payload (Loki)", "value": "f121f41dcad7e56249b016368ab44dac03a9f08df7a7105cc5172a3db9cd94f6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957739, "uuid": "51dd206d-9b1d-4948-b7d2-bed571dfd1ce", "comment": "Malware payload (Loki)", "value": "6ecc88de0cdb927986b17673eb195f7da9ac5621", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957739, "uuid": "9ccdc611-1db0-47b2-bb0d-6caf3fc063c9", "comment": "Malware payload (Loki)", "value": "d18a04e400c223da74a9a2209eba37ba22c0abb5b80058282daaa30812e56f906a6c120ae9ab9dbb210a8e0f37033d9c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957739, "uuid": "89f66af7-c096-4ec9-9337-b5e5bac2a215", "value": "T11FB4236E419C1E630E703A2AED72C77B8C2D04566E3A998FD3742451102D3E9EF92F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957739, "uuid": "73e91fbf-bfb3-41e4-b222-1e725abe24e5", "value": "12288:U1yzgoIKyfTbitXYmCTcubjj5PX7nvqloKNbs7L3pb6sh:U1egLKaTbQXY8k5XbqsX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957739, "uuid": "e878193e-d686-4ed9-86b1-da808447b416", "value": 516426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957739, "uuid": "ca1a74d5-984f-40f8-95b2-edc09086d397", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957739, "uuid": "917e241a-0ae1-4ed5-8cfa-119bcba3e730", "value": "report (18) le 31-07-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96753651-3126-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690975229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975229, "uuid": "12010c3c-2aef-4691-b99f-ef3d23b903e1", "comment": "Malware payload (RedLineStealer)", "value": "6919bb65e3c8c72116c8246cfb6dfd23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975229, "uuid": "4b2b7e4b-437e-4101-8c45-143fc3e6f700", "comment": "Malware payload (RedLineStealer)", "value": "f2dee27aa2129831991daae72e9f1c2763cf189e0b2e09b926165bdb9853f749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975229, "uuid": "49361363-1547-47a1-93c7-17a6750eced9", "comment": "Malware payload (RedLineStealer)", "value": "0caf765498d4850c1874c4c5bf07d8db67ad9add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690975229, "uuid": "eaeca901-c5d4-4c15-9125-a08fb0a362f0", "comment": "Malware payload (RedLineStealer)", "value": "d9322624616a1b2726dc4d9f7754b2995a5c17c85bd0bfda1bdd037753f2f7b7cc2336e32ae1c08bd1438f964d10daa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975229, "uuid": "17ea6d78-f33d-435e-81e7-804adb40b566", "value": "T155C5060211DD4190CF3B713076AD3AC5DA3BE4E80D285A6A3FF495D94BEFAA227E5314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975229, "uuid": "4d318386-4fc5-453f-8e79-39bf92b5ef24", "value": "f11b3f24448cf23a339f974f0a7f21cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975229, "uuid": "f93e4fd3-77ed-4170-b525-34e5824bf209", "value": "24576:Sr6D69tXu8btllsC2hKsk1GAdFDONeMBRtrCBYXjxYM6QrkycbZwz34ybR4:a6quwmCwM1GOD8hBRtrVWM1rkycbZwzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690975229, "uuid": "a1cf2d25-46a7-4ae1-8aa0-9fb6818a2e1b", "value": 2529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690975229, "uuid": "241dd7d1-7216-4512-9c20-35644db5d21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690975229, "uuid": "b1ef3860-6aea-42ae-ae0b-e8d86424aa2b", "value": "6919bb65e3c8c72116c8246cfb6dfd23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ba2eee-3119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690969567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969567, "uuid": "124c5d0e-715e-4596-90a9-f8f1fbe95657", "comment": "Malware payload (AgentTesla)", "value": "2ee53e158f08edc4688f4cd1cb053e11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969567, "uuid": "6aa0d964-e548-4478-b81b-f5ee3a6ac5c8", "comment": "Malware payload (AgentTesla)", "value": "f2df66c0ca19851c33436d938e142f08dc394b1103ec25b122281daf274756c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969567, "uuid": "f429c632-1679-46e1-baf3-9cbde53e1c66", "comment": "Malware payload (AgentTesla)", "value": "49147467691fe7cd27c686a7210b7c3f9c6fe9a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690969567, "uuid": "c3697b1b-9b24-4dbc-9a86-743fb1b9a770", "comment": "Malware payload (AgentTesla)", "value": "570c25cc780df5be844eec72f923812bbcfdc8c7a1cabbf1063680c1c03b762f75b4ba45ede4afb647def229cf5c4c9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969567, "uuid": "cf3ddcf9-0872-4b2b-9eb2-187ef0fbea82", "value": "T1ECA2E1C0E89313E9B5873F3A988D46ABF72BC42951645085EF349D279E50125EBFDC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969567, "uuid": "8a28d872-3c0c-42ed-bc31-2547d7686af7", "value": "384:6FbbwkCoQVMAlzTQM8hwevN+T8A82BE4zv6FjQ9I39RDVPBuVRbfEFrPwM7x+Jrt:GCobsTQJhlvN+5dv6tCw9RDVPEPEhR9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690969567, "uuid": "0dbe74c7-2da2-45b8-bbae-db8722dd3582", "value": 23239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690969567, "uuid": "18939932-01d8-42cd-8178-b19488329fdd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690969567, "uuid": "5b867c95-6776-4b6a-883c-8dbb1cc804b1", "value": "\u00dcr\u00fcn Fiyat 10243975 forBicakcilaroto A.S scan%001% pdf.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63e8de4-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690966773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966773, "uuid": "2613f24c-4727-4580-851a-179a83dd26ed", "comment": "Malware payload (NanoCore)", "value": "595808d528524e99118417f710a3d2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966773, "uuid": "9f8ee778-5cda-424d-a67d-73788606a61b", "comment": "Malware payload (NanoCore)", "value": "f2fb05be4a79a80f569d80028480564efbb6bb07bdac01cbff1c076c347dc7b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966773, "uuid": "4e2818e1-eed5-429d-a06e-6ea73a17d407", "comment": "Malware payload (NanoCore)", "value": "9e7f7ba0707f66f8b9fbe8c875e6d3639213f8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966773, "uuid": "458da1f8-7ee5-40a9-a458-9d284e6afd89", "comment": "Malware payload (NanoCore)", "value": "85e876b0957398e37526cbc358cfaa9e9c85a60f517e846b0ac4f50bca53ab7f05eca0f7f1428edd26e9e5a6d57a438a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966773, "uuid": "7659d96d-a867-4ee6-88ec-8e0d1d35dd6f", "value": "T1EB04E952EBB6EF31CE240A3F8244B3355F2E5ED181F27D8E744DB1652EB9D00C5846AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966773, "uuid": "33da5de0-26ce-4622-a4f1-9ec74c80c9eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966773, "uuid": "ab8ecadf-9ec6-4a76-bc6f-ff6d86070db9", "value": "384:7fFEM1vYTb7mwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYdH:Sf7RpESUJXtdhVm13jWtSHPWcFaY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966773, "uuid": "775fc514-1123-4420-ace1-1d6432540705", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966773, "uuid": "0f5022c3-1ad6-4299-8766-30494d7fa299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966773, "uuid": "67a50759-730f-43de-bdec-637201c6e597", "value": "L\u1ecaCH XU\u1ea4T H\u00c0NG x\u5357\u65b9\u6a5f\u68b0\u79d1\u6280\u6709\u96509874656789E-09847654567804-9874656789487E656.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ade2f66-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690964446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964446, "uuid": "9aaaf24b-a69b-4ad2-b646-9303cd15a417", "comment": "Malware payload (NetSupport)", "value": "975b043ed876f1c265aacb60bbea6b11", "object_relation": "md5", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964446, "uuid": "2b12c03e-3c8e-484e-8a1d-56653678bc49", "comment": "Malware payload (NetSupport)", "value": "f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8", "object_relation": "sha256", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964446, "uuid": "85c68c3e-eb9e-4b3a-90dc-7bf75fda6e63", "comment": "Malware payload (NetSupport)", "value": "3b8f7ae6b0282be88d08b171bf9267fdf4cbf28e", "object_relation": "sha1", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964446, "uuid": "140f7eef-6329-458a-86c0-e33870506493", "comment": "Malware payload (NetSupport)", "value": "c8f7d5dbfcdb83cdc736354c91fb2f0757e7d460c52a7397414c66afea48ed344dbf1bc127eaf0b31e14b73088289d18", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-247-23", "colour": "#44D56F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964446, "uuid": "19d3e7e0-28bd-44ee-b9e0-e1551bbeb4ae", "value": "T1B6F0C9103E93079FB82282B0830AC4B2EB63CF4F31C11A66ECD8661AC041B41F06E1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964446, "uuid": "949c7203-c196-4a3c-83d3-1a896c7cfd2e", "value": "12:kh5ObfauP28nlxWZ3lMVj0ESLXRtf4LXnidEWSDcEA:B62AlMVJuXRtf8XnIED2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964446, "uuid": "9a13aa91-718e-435c-aa89-8dbcb158c964", "value": 532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964446, "uuid": "3edfb56d-e4ab-4d94-a34f-fa9f21c709ff", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964446, "uuid": "7e101e2a-2792-4675-a78a-a664a0dc7e1d", "value": "22.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0118f479-311b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690970254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970254, "uuid": "ec867f65-031b-425b-8e13-ee1746781a84", "comment": "Malware payload (Mirai)", "value": "a6c0e092de429d158ad168872a499b90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970254, "uuid": "084b2d8c-dc6b-4ec0-b644-ba553f87c9fe", "comment": "Malware payload (Mirai)", "value": "f3df9d22f41d4ac10a9eb1392624e9bcbd285940e693633764e88e0fa8bd0444", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970254, "uuid": "96ccd01c-9074-4914-85f2-3e67c2e73fdc", "comment": "Malware payload (Mirai)", "value": "fb861db1a0b5391f1225dd340506a0a07c26ed53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690970254, "uuid": "674627e8-0f46-4474-ab14-310d38ec2cd2", "comment": "Malware payload (Mirai)", "value": "8088ffef16a7e4295bbc83d470c7be7e0a8526f8cfa63eb7ffeac9567771a8bfe49dd377aef0da1499f38e46d2601740", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970254, "uuid": "0858378a-616e-40d0-88db-8ba25da1d6bb", "value": "T14AF31A46EB404B13C0962BB5FADF42453323AB5497EB7305A528ABB43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970254, "uuid": "59ad6538-e6ca-4fde-8a48-a75b31f65342", "value": "3072:Uoame1tXYkpaWsjZuJziJccfW8mS/szDDohM/RbpMwl:3e1N3paWsjZazgeFS/cshM/Rqwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690970254, "uuid": "1ee9ddde-42f5-45e0-a10d-27e8e1af4ac2", "value": 168076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690970254, "uuid": "b3a1968b-7077-4b6d-b1b9-ea25700105c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690970254, "uuid": "d5cc3f6e-7f64-4345-a9c3-80275245252d", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436d4d0c-30d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690940730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690940730, "uuid": "eceaf4dc-09e2-4621-b946-e8ce9a3a7538", "comment": "Malware payload (Loki)", "value": "b8e3248550e9ce905e8d00da46dbdbce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690940730, "uuid": "e6edbaf6-b86b-4f36-afe3-97f0b8a4c2c2", "comment": "Malware payload (Loki)", "value": "f45e301b0445ad5d1b6756132c78f6fa6da84bf9f0f13fc8216b19d8018a41bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690940730, "uuid": "95fc3848-8f8d-4365-bfd3-d848adf6a307", "comment": "Malware payload (Loki)", "value": "5839567535999ecfbe731f216114d65a30fec0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690940730, "uuid": "89765935-7c57-4cfb-a766-4e6a646b3ca1", "comment": "Malware payload (Loki)", "value": "8fc822c928d2085c53862daaf1888b009261bf6f5ff8491a160d2592829b455188c3a940727698e7b7b475b467c73bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690940730, "uuid": "1e33795f-067a-4177-adc9-6f5378168684", "value": "T158D4CF047268EB67F57E9BF45124918007F593BE706EE7498DE6A0EA1AA0F500F40F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690940730, "uuid": "c1e84954-5574-43d5-9075-b33acaa2a99a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690940730, "uuid": "5c5db0e4-2d6a-4482-be6c-9abb80ae255d", "value": "12288:t5MYJUG6dEIOQ4eK4ugDWxpX2gO6lCPbb94+mD19eWgf0N:t6gXmEBcYFO6wbboeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690940730, "uuid": "990e342a-54a3-4aea-8ba0-098372f9d9ee", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690940730, "uuid": "43737e77-a2cb-47d5-9a47-3552e2249603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690940730, "uuid": "73f189d6-50ae-408e-b1a4-b751f75b4eed", "value": "E-Invoice#000002380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bb5ae7-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690957647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957647, "uuid": "a5ceb9ae-5387-40c4-85ad-a3d04cf93f18", "comment": "Malware payload", "value": "2bfc8def8e9cfb46291005e056a331a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957647, "uuid": "f4f1e10e-832c-4095-be61-78e2bd106cc9", "comment": "Malware payload", "value": "f549d7d789bcbd1b9032a79072ee429a4022ea5d8b186e0a6ba5a5e41f098c6d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957647, "uuid": "23c3d751-e877-4e8c-ad7a-09e4fb5ae880", "comment": "Malware payload", "value": "0365fdab6f7e91ab106f8c89ca383b87f741bc72", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957647, "uuid": "462a73b0-9384-43c9-ae37-487bad849395", "comment": "Malware payload", "value": "00357b4a109fea5a8c64613ef1f3ddfa7d9111e1aff18220ba776caf3a673da64d8ab4fca5854933a86eee3c91430f5b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957647, "uuid": "f798f88c-b869-4bba-b699-bca548af2ec6", "value": "T1BF327E3A5AC6187DE30750BA809521C8F6B434A352399FDF7670BA79CD792CE7A08394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957647, "uuid": "802b61b6-fde6-4b93-b24b-d23e3d9b45b3", "value": "192:tya0NV4MSWTARgZVPCK44AG9xXSJ+Ej7fJYBKwAK3GrWYtcWelq:tyXV4MSWTANK4499xXSJf7fJYB/jYtGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957647, "uuid": "f05ae53c-21e8-4173-acdc-94b163093eb8", "value": 11086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957647, "uuid": "896849ce-a4cc-447a-aff4-45143dcc179a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957647, "uuid": "07d88838-8902-4df0-8407-2102a2a8d197", "value": "PaymentCopy2023.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2956bbfc-3114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690967315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967315, "uuid": "e5f0823d-65ef-4613-aa73-aeeb0774737e", "comment": "Malware payload (Stealc)", "value": "cce5b114ddadab4d02b5f2a19c2a0d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967315, "uuid": "316e047b-aaa9-4f0c-b2dc-ee013aa070f7", "comment": "Malware payload (Stealc)", "value": "f5ce102f8dd09ba17a75251376398e6d2462595fec120c7914eb09927b33eeb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967315, "uuid": "6c7e3fcc-6efb-4349-8d32-2dfd52b5ce10", "comment": "Malware payload (Stealc)", "value": "d52080ac11349019e09e70f6333a19ad936a878a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690967315, "uuid": "a67f2e19-d173-4c82-a862-e776a28eee7c", "comment": "Malware payload (Stealc)", "value": "7c1246e65fb9febe4204136620e94285ff27040de7e6a52bf22e9536ef0a91edff609e899abb6c6a0368401dc1de441b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967315, "uuid": "edc45b22-adc6-469c-a4dd-99479a2a5721", "value": "T1FC548D126290B471D3275A324D39CEE42B3EFDA2AF6866D722187F1F1DB11E1C572742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967315, "uuid": "d86e1186-d704-4ac5-ae34-88fcf74ffd19", "value": "4a60f94d678887610d46dafb1219713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967315, "uuid": "b302682f-caf8-47ec-b9e5-30dbcc04fef1", "value": "3072:FRFk7Xx1wsqMT0CoCOJqVCxcJ6XrQ5pB2wBafQqgtBA:7FCh1wsqMTVkEVnarqpB30Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690967315, "uuid": "7df37204-4ef4-4e54-a99f-7399aa87b384", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690967315, "uuid": "8304ac3d-6a5e-44a8-b008-b1c15b96279b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690967315, "uuid": "b8c073a4-be53-46e3-bbfb-ae4a693bfd33", "value": "cce5b114ddadab4d02b5f2a19c2a0d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf0a42c-3138-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1690982782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982782, "uuid": "e5c287a5-2109-4378-aecd-bb7ad57b8d62", "comment": "Malware payload (XWorm)", "value": "1a0fa32e8a632de14603c8d0da0cccce", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982782, "uuid": "04fcf553-0ab1-499b-99d4-c06107b93323", "comment": "Malware payload (XWorm)", "value": "f6f27dd7350760c987a73ed8142bb6874a8c1d652abf9a3de20c0d6316c47b3b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982782, "uuid": "428a13bd-ab9d-484e-aeaf-bda9c7cb8e3e", "comment": "Malware payload (XWorm)", "value": "e3735b6200a5cc972bb2e92b625bcf239d881628", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690982782, "uuid": "0bba6890-348b-4137-91aa-cbe133b8d1bb", "comment": "Malware payload (XWorm)", "value": "63000e459a9918c8195e09bad119052d62be304c3d6482fd55fa8b50cd385e3a65e1ded43d660085435b4d735f7f938f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690982782, "uuid": "2b1f8ec1-16e4-423c-b9b3-ad0fc14498fe", "value": "T1FEF3E31223EB110875723B2CA6FB29B84B5B7F55527C917C05BC251A8BE3A80CAD57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690982782, "uuid": "506e6122-d4de-4ea8-a13f-4055499cc1f4", "value": "3072:iK9F2mPpWppp2mpppppR2+pSpZOuZppWuzmxY:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690982782, "uuid": "a5e12559-1a27-4a74-a160-495aa8b157b4", "value": 172702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690982782, "uuid": "faebb0b9-fccd-4290-9ff8-98343db26a16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690982782, "uuid": "e8d91a18-fbf5-48fc-8da7-5015cdee4d6b", "value": "d5sqz.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b85f1c-3112-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690966611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966611, "uuid": "bb0700bd-4869-4da2-b6f1-3115f6eabfc3", "comment": "Malware payload (AgentTesla)", "value": "0b66c5015410369869b77c8021b187be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966611, "uuid": "225ce382-1c63-4f9c-b9b1-aa1ac5766326", "comment": "Malware payload (AgentTesla)", "value": "f79e68687f0f3089b125964c398199c04e5ba690540d213ee014eabf29e8eeca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966611, "uuid": "a9fb6287-7466-4c48-9ab8-1a789ffbc3ff", "comment": "Malware payload (AgentTesla)", "value": "7ec6fc8e38c611e2757d9c1289069c636af9f0f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966611, "uuid": "03e80a5b-d88f-46b7-a10c-a0066163b321", "comment": "Malware payload (AgentTesla)", "value": "6931d49ed477b9463d13fddf679d9f87d45f72108cb1bf4a42d8165f15f2d746c65d327a7e66ed8ebcd96f03ccb3ef20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966611, "uuid": "ec572057-9760-4e01-9b06-c28c38e7cdc6", "value": "T1C3C42370413917B4D22AC3B56C12A7650BBB010832A1C696DDD7ECDE7AB3FD02494FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966611, "uuid": "8085de39-498c-4eff-bff1-e080180fc568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966611, "uuid": "c89e7601-9402-4cfe-ba4b-ad598104cf4c", "value": "12288:lw2iN8JJNHyg3cp6ISN9O7L3tDzKWwSLJySyH0BeD0yYjT/:lw1uJHSgsSN9GdDebS1yP5D01jT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966611, "uuid": "aa53abef-8883-46a0-b6ae-d1e5b9a3fed7", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966611, "uuid": "137ebcda-01d3-4070-9913-dd94be45789e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966611, "uuid": "f5782b5e-7170-4c3c-8cec-5a067c902424", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93d5949-30f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690954215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954215, "uuid": "8339e9aa-11d2-4f8a-82d6-ce089f921673", "comment": "Malware payload (AgentTesla)", "value": "c216287fd7e8ca82b541a5a9dbb9359f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954215, "uuid": "8741a3cf-5507-49f2-b627-50535daa459c", "comment": "Malware payload (AgentTesla)", "value": "f7b8cd09920d3049f98ed3da783d18bdd1220837cb5a1a8a43a31ae4b11da6ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954215, "uuid": "060e3560-7fc4-4e1c-9eed-c7a51caa3d88", "comment": "Malware payload (AgentTesla)", "value": "995fe33daaa2535f7ba8174aef32d90dadba2172", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690954215, "uuid": "c3ae10d2-6c0d-4629-b57f-3fab059650bb", "comment": "Malware payload (AgentTesla)", "value": "429dc751791cdbc64180b414f6b5d4f83f474258918f2ab261801daee1f020323a8b7f633783271c64eb2503e315ee3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954215, "uuid": "baf05387-9440-4e0c-917d-dd24b5c86776", "value": "T191A4236E9DD548991630A95C742F9DB1BB1F9349E2A020707CB8A4EF83E4CED713AB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954215, "uuid": "0ab6e500-9f12-47c7-8ae7-be35a08db4d5", "value": "12288:gGbC7FLrz5AQRLAJPsUIAEebngtI9wp/4VH:JbgLn5LR0IjezgtIKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690954215, "uuid": "938e401d-a6c8-4efc-a5fe-9195657a61d7", "value": 462054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690954215, "uuid": "d4e69788-e982-42fb-b227-470a125c451c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690954215, "uuid": "8f0e46f2-a4bf-428f-ab77-e35d0e2ac813", "value": "PO H0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a1aa89-3138-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690983066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983066, "uuid": "0944ff84-6b6f-47b1-a933-fd34fb6a465c", "comment": "Malware payload", "value": "ada3a83cd4773b6a55c21f95ac5b6418", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983066, "uuid": "d54c1b45-9690-4f03-9d7f-a13580eb2d1f", "comment": "Malware payload", "value": "f8254fb47869f88b6bac32008c47b3aaad33bfa1d15ccf7b09a243aa52476773", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983066, "uuid": "f2efd85a-130d-45c6-94c8-d48d8fe186b7", "comment": "Malware payload", "value": "49b396e767ffb869b09d9afeb3aa2c903864b463", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690983066, "uuid": "f174ab4d-043b-4527-a977-1cbad832cd12", "comment": "Malware payload", "value": "676f71531c7ac73fc3393a4bf32e7688b4165a5ecd026cbedd16fb410e5df5856d32223a6a1fff7fc101e0b37ee3f23c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983066, "uuid": "1abefb8b-59af-43e8-a9fb-8b928765dcd2", "value": "T181F20B11D6C0ADE6E4FA26FC8B77A52536399D20C34940FF23C12D5E5B286C25E709EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983066, "uuid": "b4d3c82f-c1de-48e3-b5ab-484d7cb6655e", "value": "969ed979bcbb9cc9e109e354589ac767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983066, "uuid": "4188b56b-8dbf-4870-9ea6-e237e7307e06", "value": "768:l1wiCRLQXVuvCS/z5j583KTG94n1Ou5KM2vauZEjxK97n+PL6fhK4rejK18:l1wieOuvCS7BKTxCDcFm2hK4rejD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690983066, "uuid": "b2fb98b1-0642-4e84-9c05-2597d133e837", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690983066, "uuid": "7a2d02e1-2d28-4fab-b367-f1735189acf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690983066, "uuid": "891c5464-24da-48be-8b61-ddbf55fa61e5", "value": "SecuriteInfo.com.Win32.PWSX-gen.19916.2719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3790f06-310b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690963762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963762, "uuid": "2b85846a-2db6-44dc-9a6a-b27f9769a2c8", "comment": "Malware payload", "value": "57c8615ab35bcbc032e003e9ed70abde", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963762, "uuid": "a16531fd-54c5-4c74-91c3-8dc58c9af9c9", "comment": "Malware payload", "value": "f88870d28161ab6e5790108a36e22f702ebd518a1c3679dae2e370db4d9f0a0e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963762, "uuid": "94cf7b23-cf77-4a5e-864a-e5fe7d240d50", "comment": "Malware payload", "value": "4827bae5e8e0789f863673b1af46780ff89d24b9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690963762, "uuid": "ead0b7e8-2ac9-4aff-a5b5-ed9772e9a366", "comment": "Malware payload", "value": "3e8ccd4559548fa14b4864b46a734af24fda7a5586498186e11fcfb8189878b523e621460bd2833aea549a9285ca5ebb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963762, "uuid": "3e8c811f-ca16-4fd8-bc52-f770ff040cd9", "value": "T104E433F64309D01837A25FCE62E63EA49161673888BD161EBC90F8B847FBAF414579C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963762, "uuid": "ede6a574-021e-4b90-b284-76fbe49e36e6", "value": "12288:jOnWzlqGGSxMiuFQ3bqDOSXcCADIhDTJQN/TdNJx4sFNEHVLNRwoZHNMKTZL3r0z:aolMdebq6S6DWTJiTdj6SKHiKJ702jY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690963762, "uuid": "aaad5597-cab0-4825-9531-ef3a2d0df3be", "value": 717099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690963762, "uuid": "bb033ec3-f01b-418b-b585-db97e276d78e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690963762, "uuid": "3213a3b6-f8a9-49ad-b581-63cdc03ba4c2", "value": "PO-1-08-00276 - RISCO.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30098836-3111-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690966038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966038, "uuid": "d01c21b3-e98e-4a28-8479-5e4b3047a29c", "comment": "Malware payload (SnakeKeylogger)", "value": "3fe71522ce5f960304c80b97e6adb728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966038, "uuid": "187f2da4-04cf-470f-b559-b68a5674c6ef", "comment": "Malware payload (SnakeKeylogger)", "value": "f8e0838f1c51682621b32897e221af4ea8248e880a48866de2793ca3dfd3527d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966038, "uuid": "6de0e090-3958-4a00-a8f9-b74c1c093930", "comment": "Malware payload (SnakeKeylogger)", "value": "0d9a69500e417e656bba786275cf71861d02413a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690966038, "uuid": "31b24a49-5ba9-4c7f-a2ba-1fcb793dcd9b", "comment": "Malware payload (SnakeKeylogger)", "value": "e21eb9ac20b10165275087ef380580070ac57b004fa2d0da5fb65ccdc3e2eb4daac0887b549e0c4dc2716937ecc49d46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966038, "uuid": "bf35ae18-2c61-4f50-bb14-70b18027e467", "value": "T14A74016953B79608DE7807F83825AB601771D012119DC3780BD9F4FC3EA3BBA4AE465B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966038, "uuid": "3c8e7e8f-f66e-4d84-b491-f12b56ab750c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966038, "uuid": "ce49aac7-bb54-4a16-b33f-916f624e0371", "value": "6144:Z6ejZRDQ+3HwOU2I6sm3Qtc0fROQNEm9nx9NfC67o0Qam4i:LkoU56sA0cBva9NK67o0QaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690966038, "uuid": "e613d996-38ba-4373-b41b-5b9c4c6fcc47", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690966038, "uuid": "59ca345e-9ba6-494c-b14d-78a8ac07b68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690966038, "uuid": "3bfc8870-8bcb-4a80-bb54-3875e16c6072", "value": "3fe71522ce5f960304c80b97e6adb728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43186b6a-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690957910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957910, "uuid": "4f419fda-f007-4926-bdbc-74dda55bee1c", "comment": "Malware payload (AgentTesla)", "value": "85f0d5bbc35ec089b588832d3974e02a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957910, "uuid": "2e487444-25d7-4706-8798-49663ff79123", "comment": "Malware payload (AgentTesla)", "value": "f8f6cf242730479f310b287a86db54cd1da2ad5cf99fd8f151f94c0a346c0346", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957910, "uuid": "3b6bb56a-1648-4155-9ae3-fc46f1fae946", "comment": "Malware payload (AgentTesla)", "value": "6eaaff8fa458a34efe691d3bfcb705b9a6fb0b9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957910, "uuid": "aea4275c-74d6-4ab9-9a58-5d16f6f64758", "comment": "Malware payload (AgentTesla)", "value": "bcbf84284d35d2a12b74affbde78fdaef507a3d69e2100d0f23bd6db8b9183768b6039b5a90f2cbbe9144b0eb4cd2b6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957910, "uuid": "87346be7-e989-4c86-ae47-2314736368df", "value": "T10EC42372E0C63CE3AD3C45F009A5D55CB97D12D22979D4B6326A38DD08B0DEC562AF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957910, "uuid": "25d73b00-fa71-4cff-b7e6-3e7bd0bff682", "value": "12288:dmeUT7/0bXpeFKyQ8qJtF4DH1WZDoGgSGia8qY9AxlyKH:0748/Q/TF4DH1kUSGiauul5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957910, "uuid": "b60677e4-7531-413b-a3fd-2729f68b71ac", "value": 548370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957910, "uuid": "1002831d-8347-4400-b935-6946f1d930fa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957910, "uuid": "26492fcc-8ccf-41c0-af90-2e3f465e7d2a", "value": "INVOICE.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e37795-30fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690957745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "e944e73c-72d9-46f4-a0f0-b709e8f968fd", "comment": "Malware payload (GuLoader)", "value": "26f11a3b883fa4590fc7fbe31e1ec50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "f431533f-abd7-4d3e-a138-16367f9efbe5", "comment": "Malware payload (GuLoader)", "value": "fa3551c102ce3c003082e53c4936733414440a3396ad32a9a7ac61aa6a315256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "e6c17684-0f96-4251-8da4-816ed86d0191", "comment": "Malware payload (GuLoader)", "value": "c471bc6e1edbdfadcda9d1dc32833f5a7b17f2e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957745, "uuid": "711ed8f5-7afc-49f3-97b6-8fa8e89d07bf", "comment": "Malware payload (GuLoader)", "value": "de60779956b23fbd03ed54846b654c43b2b12abb216dabf5153244cb27528c6e8605245bb5fd62c0dcb5f90ec0a4e6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "48773fda-e597-4720-b6b1-9ee0cf24b0da", "value": "T196A49D9239C9656FDC2F5978035FEAB22B795DE07382486E4F80361D4C3664A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "7c8be0c9-752a-45bb-a10c-5eef45cc2f75", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "fd76b7fe-a221-4b7d-b79d-0c9d612fe78c", "value": "6144:WqC56XPZVheNA+ff0iuf87z5OHZ3zrxz16OVqIYOLtCS1nX7rxTMVhEflg8ts/Wd:hfnhe2epuf87AZRzzLtBnX3AEfW8EgCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957745, "uuid": "3a914030-95e1-4549-baa6-91aac1be999f", "value": 490016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957745, "uuid": "abcc91e4-e031-4cfe-bf8f-f565e160916a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957745, "uuid": "35d834aa-ea76-4bd2-b2e0-75dfa2e34128", "value": "factuur (Fac A213)pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9516eabf-30fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690957188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957188, "uuid": "fa4cd89d-df62-425e-81e5-110ae77cf9ec", "comment": "Malware payload (AgentTesla)", "value": "4d0133d4ae5b9ad806f5b180c5acf8fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957188, "uuid": "9bb98b6c-fb72-46aa-a59a-742dc21c34cf", "comment": "Malware payload (AgentTesla)", "value": "fa87db27b328e001b384801e8321eed754f6ecfeb59ac58dc3616b6e59dacded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957188, "uuid": "dde9d093-c04b-4b55-a53b-dfdf74b10634", "comment": "Malware payload (AgentTesla)", "value": "eefa8dc1fe6646cfafa1754f4c486cb0e80a9569", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957188, "uuid": "c1f235b0-d6bf-4065-8b03-80c2ea9a4db3", "comment": "Malware payload (AgentTesla)", "value": "e4def077a9766f47e17f9ca66d5dd4be7fc10e7367629559cb5ede1970d3fb1c0e1903e0aa007dd4d2737b6cee865b05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957188, "uuid": "2e86ca2d-72a5-4823-94c5-19ced5661f9e", "value": "T1E2E4DF057268ABA7F47E9BF45514418407F553BE706EE78A9CE6A0EA1B60F900F00F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957188, "uuid": "fca16132-1822-4b9e-a9b7-cecbd4579945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957188, "uuid": "32ed2443-307d-4e50-929f-95f9608ddae7", "value": "12288:O5MYnWKgqvQ2kfDh3kKDIhAHdGKnoD7HH0ZyQPVjiQZ4:O64Hgq90SA9Xmn0ZyYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957188, "uuid": "6b64bdf4-e5b9-4c51-a25c-b375c8607ca0", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957188, "uuid": "30033a14-cecf-4086-8a68-747ff087dbe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957188, "uuid": "2f0129a0-4155-4edd-a3e7-2d070ad567c2", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ed2b58-3155-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690995177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995177, "uuid": "cdc42288-db54-4c39-8280-c1162a155881", "comment": "Malware payload", "value": "286ecb29dd3387e09abab937c741362d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995177, "uuid": "f9b132b9-54f2-4b3b-a6ca-6fb868b29837", "comment": "Malware payload", "value": "fe65a6c806f3f650d30e91fc61ad89da933047df16af50028a10d0dd90e1cafe", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995177, "uuid": "d4aa7f6f-f42e-4b76-9539-53c8c036480e", "comment": "Malware payload", "value": "99276d0666a7997fdb477f16518b628fa0a6f0dc", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690995177, "uuid": "09d4082e-61d9-4879-8531-f47127aa034c", "comment": "Malware payload", "value": "2ba2f12671ee5fc5035ad46b3eba28624de535030fdab99b52d18aafdacc56f64c568bc3952314c3ef3c183f60aaacc1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995177, "uuid": "b94f6c4a-8402-4e68-be35-024ae4a4c40b", "value": "T1F1D17DEED3530462C625E030E35738934A4DB842BE2C752FF060B276291729D7A6F565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995177, "uuid": "0f7463ab-5622-4f49-8a55-b9ac8a7280f3", "value": "192:tYnL7Z4CS5Uc/Z3tDEVbq3j7d0QM/A7zMltuX41QddB:epUddaufejyMlkDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690995177, "uuid": "1e059cb4-ad53-4fe4-9204-a573d5e0c176", "value": 6465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690995177, "uuid": "3ef9cf17-49f6-41f4-86c3-e8daa05d3831", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690995177, "uuid": "ca4480f5-0df6-43f6-bc2d-94b4604b9718", "value": "Braemar MTM Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47026caa-30fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690957916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957916, "uuid": "2c3a3851-58f4-4530-8b11-903599bcead3", "comment": "Malware payload (AgentTesla)", "value": "bfe696413171e787e364fb24e8324014", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957916, "uuid": "5223e2b5-c8f2-4107-beb5-36713e12ae97", "comment": "Malware payload (AgentTesla)", "value": "ff2dbc879b2c5fd96099aca696e8caa5af1a99b2915cb257ffe66a860b909b8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957916, "uuid": "97ac5d5b-7963-47af-a039-f148576c9f48", "comment": "Malware payload (AgentTesla)", "value": "68c74871ac884ba814f174c2a095549686dcbe52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690957916, "uuid": "1eaa61e2-949d-4430-a59c-076e99d952bb", "comment": "Malware payload (AgentTesla)", "value": "301addec13c65964c57fcf1afb36926d07a5483f2303f1ed662fdd75412cb68de2a024dc47170e7ef9f2b8555c65deee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957916, "uuid": "0c6d0c70-0937-419f-847b-85f9e45df265", "value": "T1C8E4F00175B68F9BC5BE83F91531A40107F16DAF243DE36A9EC274CA1672F214A91F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957916, "uuid": "bc0b5d58-43a7-49bd-badb-8a5ddff09bd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957916, "uuid": "63779799-54ca-40a3-b965-12a9ea3d5506", "value": "12288:0vgNZ2DHWKKwZp4U5bidNVPDUsO5fy6G/pC2z00J7nhEhuvBHDHj:ogvItZO2aYsAjmhfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690957916, "uuid": "59ab79cf-3c2b-4ff9-8c3a-117de1289771", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690957916, "uuid": "ce604439-e5bb-4669-aaf3-8061feef8222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690957916, "uuid": "e1b0ce83-4200-453c-ac7f-2672d088d4c7", "value": "INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d73f3cf-315c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690998353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998353, "uuid": "0311e24c-b341-4749-b0b9-85ef3cd6beab", "comment": "Malware payload (DarkCloud)", "value": "6582ef989f64b4ed0bdb08765f5a253c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998353, "uuid": "dd864da5-b024-4e5a-b2d8-8984d5ed09e2", "comment": "Malware payload (DarkCloud)", "value": "ff4c6f9c1fcbf3f0281a74e174e9d9e0ed9946e22891622bb534397d85ee078f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998353, "uuid": "651e76ab-685c-4016-b0f8-32a4fb4117d6", "comment": "Malware payload (DarkCloud)", "value": "31b573a7ecdbd165601c3819d62941aa428da979", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690998353, "uuid": "f97cf8db-f0ba-4947-96ac-cd543d76a23e", "comment": "Malware payload (DarkCloud)", "value": "d8f55c0b2cfc522474a6bcb4fa317d5de9347be995baf4c411d280a44de8c47139331fd33fa42e35ee9fd472b8f04781", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998353, "uuid": "91b75361-dc79-4259-883e-6972f068ef55", "value": "T1AD1512175D1472E8C8195B732476962C167F0D4EFDE8D29B4ECEB5AAEBF7B800110A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998353, "uuid": "72dcc5d2-8967-41fe-bd8e-f7a7a7a39996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998353, "uuid": "da69c379-f7b4-4d61-b0bb-ea645cd8826d", "value": "24576:IU1uJRSfig2Mri9n9U3234oTOZkb4d1pe6L:5mSqgxri99UlNZkM1pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690998353, "uuid": "541ac193-577c-4302-8c65-b6b422d465cb", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690998353, "uuid": "2c614a41-0d12-4862-8b58-76474544cd2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690998353, "uuid": "40c25dd4-587e-4553-8a2c-4073b5e7534f", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cbb59c-310d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690964595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964595, "uuid": "8d314ed6-0b4f-4ad3-8300-89429818d537", "comment": "Malware payload", "value": "319bc79bf9d98e769dbb2c3a5140524b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964595, "uuid": "04d0765a-9de7-4065-be8f-f838fd0b3d93", "comment": "Malware payload", "value": "ff7957fa16a3e0a3d4862f78b5df98a7f8ce404a205d4d1fe14abc6fe8b51b9a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964595, "uuid": "ec97f1bd-22e0-4c0e-8497-d5ae1bc99e17", "comment": "Malware payload", "value": "861ac883445f18b5b43e4f40e7331bdfdd6dd941", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690964595, "uuid": "e45d3fe1-1416-4e8d-9cbd-c9d7279aa79c", "comment": "Malware payload", "value": "21593fd9d14b956e9e7427af471d024bcc688f0762b12f0e1d8d63a38b7e42361e0133c3a6cb7a3d920b98f3e5bbf8a2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964595, "uuid": "b19632f3-896a-4013-8205-c9c2c104567d", "value": "T183B4138B6B1D0A6DE0173EFD68B621C00995FE054453868D38CF27A32A6D838775DB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964595, "uuid": "b66498ba-32d8-4b30-8fbe-731190edded4", "value": "12288:TEU1+GyiMpbyJlcM9wcW2aCaTIvkUpr+6y+o/aRzm7PHC:QU1+ZbyIuW2ITo+6u/Czg/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690964595, "uuid": "bc4de86d-aad2-4e3a-a5bc-647aa6231416", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690964595, "uuid": "726cccac-d91e-4641-98d3-ee59042c8eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690964595, "uuid": "6837007a-46cd-4378-8c6c-15afd4de4f84", "value": "319bc79bf9d98e769dbb2c3a5140524b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ebe9fc-3131-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690979983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979983, "uuid": "96a0a7ec-8031-4bf8-ab85-24b9bd14b225", "comment": "Malware payload", "value": "d3def43aa54b2cfb129a2fb99757c4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979983, "uuid": "148944a4-403c-41a3-b6d4-ee0282dd726b", "comment": "Malware payload", "value": "ff916ace266b4340967ba46ae23e2ec730d71029b20e251582c7a54d05a5f613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979983, "uuid": "ec845bcb-12f8-46ab-964d-f29cef9573ba", "comment": "Malware payload", "value": "7ec0b7d08f0b37c361f5213b90451a1a3aa41a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690979983, "uuid": "b54d366c-e96f-4b3b-91ba-3241e16768d8", "comment": "Malware payload", "value": "247b3820fae19231afac2336860c31430ed1e4551617288ab43f410ba3343e75ac970b7e7ac3a43ff520be94f0e52685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979983, "uuid": "d8197d9f-d757-4e8a-95a6-b4e57fb0cf5d", "value": "T114F312E7F391CAB9D16B4BB11CB37D2496376A1C6CC9D82F4C8853188B21B4187F9231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979983, "uuid": "ef608972-2101-44fd-a5a4-10b93c5df978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979983, "uuid": "4b209eda-5f38-4da4-b15a-ddd2d28b6935", "value": "3072:svGbeIOv+g5Byh5e4Gq9TsqAiUNi/jL214RP7gN2ULfSSTnhRYONxwqSSKm5ByT:tbqEGOIgjLU0gNDS8hBKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690979983, "uuid": "09ff5da5-3bf5-4526-991e-5208dfdc7bd2", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690979983, "uuid": "3f2015e3-14d8-463b-8064-78626582097f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690979983, "uuid": "86d2a895-0d3c-4039-8a01-90db58c112be", "value": "FAT-okYY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d6e0e0-317e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691013130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013130, "uuid": "145a82ec-62a4-4686-a60d-b0668f1a5204", "comment": "Malware payload (Mirai)", "value": "9324e53efb08a2ab8d93bd8dc20722ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013130, "uuid": "8bd379d9-f5eb-4e04-9f65-eff06e624edb", "comment": "Malware payload (Mirai)", "value": "ffd65470cf616ec27622f5e8e638b7e7f9e1f043f334933beed585fa867ee66c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013130, "uuid": "7e659fb9-25dd-41a9-b9b6-b533a4afb322", "comment": "Malware payload (Mirai)", "value": "0bf61902087856547fce36cd26c83531511969ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691013130, "uuid": "87b0def5-40ee-4851-a5c9-ba7dfc0052a8", "comment": "Malware payload (Mirai)", "value": "5cc9667bb26a523d9820fda74a5d676217b9e88feff38c7adaf0d31cf4991c338a26b6036ae042c0d29604ab8d3112cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013130, "uuid": "3aa5ce2b-aac0-4b56-b146-aa6f6cf0045a", "value": "T1C6538D75D11DAEA8C0414AB4A9198E704F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013130, "uuid": "9788f5b1-e22c-496f-89ab-89a7bdcd12a4", "value": "1536:ragXV1f1Fl/wtknWPQauiufs3Ii3O/qyD6EZeCc:r57f1b/kQHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691013130, "uuid": "47b40497-20e8-497e-98d2-70f96fa5c014", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691013130, "uuid": "a624fd7d-ba8b-464c-b94a-0878ee5c4673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691013130, "uuid": "8615799d-0d9a-416b-8511-17b971ea7533", "value": "9324e53efb08a2ab8d93bd8dc20722ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }